diff --git a/.github/workflows/defender-for-devops.yml b/.github/workflows/defender-for-devops.yml
index d9ba4c25c..56992356d 100644
--- a/.github/workflows/defender-for-devops.yml
+++ b/.github/workflows/defender-for-devops.yml
@@ -26,6 +26,10 @@ on:
   schedule:
     - cron: '32 9 * * 4'
 
+permissions:
+  contents: read
+  security-events: write
+
 jobs:
   MSDO:
     # currently only windows latest is supported