Security Policy Errors

Fix Unable to Download or Preview Emails in Microsoft 365 Defender

Camila Milosovich Oct 8, 2026 868 views

Question details

A user with the Security Administrator role needs to preview or download emails in the Microsoft 365 Defender portal but is unable to do so.

How to Fix Unable to Download or Preview Emails in Microsoft 365 Defender

Product: Microsoft 365 Defender
Device & OS: not provided
Scenario: An administrator is attempting to investigate security threats by previewing or downloading specific emails within the Microsoft 365 Defender portal but finds the action blocked or unavailable.
Observed behavior: The system prevents the user from downloading or previewing the email content, indicating that the permanent Security Administrator role alone does not grant sufficient access rights.

Before you start

Ensure you have access to a Global Administrator account or can coordinate with one, as resolving this issue requires modifying specialized role groups in the Microsoft Purview and Defender portals.

Solution 1Recommended

Assign the Required Preview and eDiscovery Roles

The standard Security Administrator role does not automatically grant access to read or download user email content due to privacy boundaries. You must explicitly assign the 'Preview' or eDiscovery roles.

Microsoft intentionally separates security metadata monitoring from email content access. To view message bodies or download emails, administrators must be assigned specialized roles within the Email & collaboration permissions.

Access the Defender Portal

Sign in to the Microsoft 365 Defender portal (security.microsoft.com) using an account with Global Administrator privileges.

Navigate to Roles

In the left navigation pane, scroll down to 'Permissions' and select 'Email & collaboration roles'.

Modify Role Groups

Click on 'Roles' to view the available groups. Look for a role group that includes the 'Preview' role (such as the default Security Investigator group) or create a custom role group containing the 'Preview' permission.

Assign the User

Edit the selected role group and add the affected Security Administrator's account to the members list. Save your changes and allow up to 24 hours for the new permissions to fully propagate across the tenant.

Assign the Required Preview and eDiscovery Roles

Permission Propagation Delay: Changes to role assignments in Microsoft 365 Defender or Purview are not instantaneous. It can take anywhere from 1 to 24 hours for the user to successfully preview or download emails after the role is assigned.

Solution 2

Contact Microsoft 365 Support for Tenant Investigation

If the correct roles are assigned and the propagation period has passed but the issue persists, a backend tenant configuration issue may be the cause.

Free Microsoft Office alternative

Looking for a Lightweight Alternative to Microsoft Office?

While you manage complex security configurations in Microsoft 365 Defender, your organization may also need a reliable, cost-effective office suite for everyday document management. WPS Office provides a powerful, free alternative to Microsoft Office.

1. Download the Installer: Visit the official WPS Office website and download the free version for your specific operating system.
2. Install the Software: Run the setup file and follow the quick on-screen prompts to install the suite on your computer.
3. Open Your Documents: Double-click any existing Microsoft Word, Excel, or PowerPoint file to instantly open and edit it within WPS Office.

Fully compatible with Microsoft Office file formats (.docx, .xlsx, .pptx).Lightweight design that requires minimal system resources and runs seamlessly on Windows, Mac, and Linux.Familiar user interface ensuring zero learning curve for users switching from Microsoft Office.Built-in robust PDF editing, merging, and conversion tools for complete document workflows.

microsoft office alternative - wps office

Frequently Asked Questions

Why doesn't the Security Administrator role allow downloading emails by default?

Microsoft operates on a principle of least privilege and strict privacy boundaries. The Security Administrator role is designed for monitoring alerts, analyzing metadata, and managing policies. Reading or downloading actual user email content requires distinct permissions, such as the Preview role, to prevent unauthorized access to sensitive communications.

How long does it take for new permissions to apply in Microsoft 365 Defender?

When you assign a new role, such as Preview or eDiscovery Manager, the changes typically take between 1 to 24 hours to fully synchronize across the Microsoft 365 environment and become active in the Defender portal.

Can I preview quarantined emails without downloading them?

Yes. Once you have the appropriate Preview permission assigned under the Email & collaboration roles, you can securely view the message body of quarantined emails directly within the Microsoft 365 Defender portal without needing to download the raw file.

Microsoft Office Security Issues