diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/group10/read_privileges.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/group10/read_privileges.ts
index b95c6771367f4..563bba803ea64 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/group10/read_privileges.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/group10/read_privileges.ts
@@ -478,31 +478,31 @@ export default ({ getService }: FtrProviderContext) => {
         username: 'detections_admin',
         has_all_requested: false,
         cluster: {
-          monitor_ml: true,
+          monitor_ml: false,
           manage_ccr: false,
           manage_index_templates: true,
-          monitor_watcher: true,
-          monitor_transform: true,
-          read_ilm: true,
+          monitor_watcher: false,
+          monitor_transform: false,
+          read_ilm: false,
           manage_api_key: false,
           manage_security: false,
           manage_own_api_key: false,
           manage_saml: false,
           all: false,
-          manage_ilm: true,
-          manage_ingest_pipelines: true,
+          manage_ilm: false,
+          manage_ingest_pipelines: false,
           read_ccr: false,
-          manage_rollup: true,
-          monitor: true,
-          manage_watcher: true,
-          manage: true,
+          manage_rollup: false,
+          monitor: false,
+          manage_watcher: false,
+          manage: false,
           manage_transform: true,
           manage_token: false,
-          manage_ml: true,
-          manage_pipeline: true,
-          monitor_rollup: true,
-          transport_client: true,
-          create_snapshot: true,
+          manage_ml: false,
+          manage_pipeline: false,
+          monitor_rollup: false,
+          transport_client: false,
+          create_snapshot: false,
         },
         index: {
           '.alerts-security.alerts-default': {
diff --git a/x-pack/test/security_solution_endpoint/apps/endpoint/endpoint_permissions.ts b/x-pack/test/security_solution_endpoint/apps/endpoint/endpoint_permissions.ts
index 061e8936bf241..55ce4bed99098 100644
--- a/x-pack/test/security_solution_endpoint/apps/endpoint/endpoint_permissions.ts
+++ b/x-pack/test/security_solution_endpoint/apps/endpoint/endpoint_permissions.ts
@@ -36,7 +36,6 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
 
     // Run the same set of tests against all of the Security Solution roles
     const ROLES: SecurityRoleName[] = [
-      't1_analyst',
       't2_analyst',
       'rule_author',
       'soc_manager',