What Are Permissions in Microsoft Purview?

The Microsoft Purview portal lets administrators centrally manage permissions for users who work with compliance, data security, data governance, and risk solutions.
Using Roles and Scopes in the portal, you can grant people only the access they need—nothing more.

To view or manage role groups, a user must be:

• A Global Administrator, or
• Assigned the Role Management role (available only through the Organization Management role group)

Principle of Least Privilege

Always assign the lowest level of access needed for someone to perform their duties.
Avoid giving Global Administrator to more people than necessary.

This approach:

• Reduces risk
• Minimizes accidental changes
• Improves overall security posture

How Permissions Work in Purview (RBAC Model)

Purview uses Role-Based Access Control (RBAC)—similar to other Microsoft 365 services.
This means:

• You assign roles to users
• Roles are grouped into role groups
• Role groups grant the ability to perform tasks inside Purview

Note: Some services require separately managed permissions (e.g., Exchange MRM, auditing). Those must still be assigned in their own admin centers.

For solution‑specific permission guidance

Here are the links to each category (keep as-is):

• Adaptive Protection – Insider Risk Management
• Administrative Units
• Audit
• Collection Policies
• Communication Compliance
• Compliance Manager
• Data Classification (Activity Explorer, Content Explorer, Data Explorer)
• Data Governance – Unified Catalog
• Data Governance – Classic Data Catalog
• Data Lifecycle Management
• Data Loss Prevention
• Data Security Investigations
• Data Security Posture Management
• Data Security Posture Management for AI
• Device Onboarding
• eDiscovery
• Information Barriers
• Insider Risk Management
• Privileged Access Management
• Records Management
• Triage Agent (DLP, Insider Risk)
• Security Copilot for Purview
• Sensitive Information Types – Custom
• Sensitive Information Types – Exact Data Match
• Sensitivity Labels

To view default role groups and their assigned roles:
Roles and role groups in Microsoft Defender XDR and Microsoft Purview portals

Roles, Role Groups & Members — How They Relate

• A role = permission set (e.g., Case Management)
• A role group = several roles bundled together to match job functions
• A member = user or group you add to a role group

Role groups allow administrators, analysts, investigators, or auditors to get the right level of access across Purview solutions.

Microsoft Entra Roles in Purview

In the Roles and Scopes area, Global Administrators can also view Microsoft Entra roles (formerly Azure AD roles).
These roles align with common IT job functions.

To modify Entra role membership, Purview links to the Azure portal.

Examples of available Entra roles

Managing Purview Role Groups

Add Users or Groups to a Role Group

1. Sign in to the Purview portal with a Role Management‑assigned admin account.
2. Go to Settings → Roles and scopes → Role groups.
3. Select a role group → Edit.
4. Choose users or groups to add. Note: Security group support applies only to commercial Microsoft 365 tenants.
5. Select the users/groups.
6. If needed, assign admin units.
7. Select Next → Save → Done.

Remove Users or Groups

1. Go to Settings → Roles and scopes → Role groups.
2. Open the role group → Edit.
3. Check the members to remove.
4. Select Remove members → Next.
5. Select Save → Done.

Create a Custom Role Group

1. Go to Settings → Roles and scopes → Role groups.
2. Choose Create role group.
3. Name and describe the group.
4. Add roles.
5. Add users or groups.
6. Assign admin units if needed.
7. Review → Create.

Update a Custom Role Group

1. Open the custom role group → Edit.
2. Update the description.
3. Add or remove roles.
4. Add or remove members.
5. Modify admin units if required.
6. Review → Save.

Delete a Custom Role Group

1. Open the role group in Settings → Roles and scopes.
2. Select Delete.
3. Confirm the deletion.