diff --git a/windows/security/threat-protection/microsoft-defender-atp/user-roles.md b/windows/security/threat-protection/microsoft-defender-atp/user-roles.md
index 9723b0afa6..a923e76e1e 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/user-roles.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/user-roles.md
@@ -45,7 +45,7 @@ The following steps guide you on how to create roles in Microsoft Defender Secur
             >[!NOTE]
             >This setting is only available in the Microsoft Defender ATP administrator (default) role. 
 
-		  - **Manage security settings** - Users can configure alert suppression settings, manage allowed/blocked lists for automation, manage folder exclusions for automation, onboard and offboard machines, and manage email notifications.
+		  - **Manage security settings** - Users can configure alert suppression settings, manage allowed/blocked lists for automation, create and manage custom detections, manage folder exclusions for automation, onboard and offboard machines, and manage email notifications.
 
 		  - **Live response capabilities** - Users can take basic or advanced live response commands. <br>
 			- Basic commands allow users to:
@@ -90,4 +90,4 @@ After creating roles, you'll need to create a machine group and provide access t
 
 ## Related topic
 - [User basic permissions to access the portal](basic-permissions.md)
-- [Create and manage machine groups](machine-groups.md)
\ No newline at end of file
+- [Create and manage machine groups](machine-groups.md)