Hello and welcome to Part 3 of this blog post series on Microsoft Purview. You can visit the previous posts via the links below:
Part 1: Introduction to Microsoft Purview – Part 1 – Cloud Build
Part 2: Microsoft Purview Portal – Part 2 – Cloud Build
In this post, I explore Microsoft Purview roles and scopes.
As we know from the previous posts, Microsoft Purview offers a robust data governance and compliance solution, enabling organisations to manage sensitive information across multiple platforms. Given the highly sensitive nature of the data within Microsoft Purview, it is crucial to restrict access to authorised individuals only. To ensure that access is granted to the right individuals, Microsoft Purview leverages Role Based Access Control (RBAC), which allows for more precise control over who can access specific solutions and datasets.
Please note that holding a Compliance Admin or even a Global Admin role may not grant access to highly confidential data. Additional roles may need to be assigned to manage specific areas within Microsoft Purview. Furthermore, granting highly privileged roles to admins does not follow best practices and the principle of least privilege. We should always assign just enough permissions for the admin to perform their duties.
Let’s explore roles and scopes further.
- Access purview.microsoft.com, click Settings, and click to expand Roles and scopes from the left pane.
2. The first two options available under Roles and scopes are Microsoft Entra ID and Role groups.
Microsoft Entra ID roles, visible within Entra ID at entra.microsoft.com, include over 100 built in roles that serve various administrative functions. In the Microsoft Purview Portal, however, only 9 specific Entra ID roles are listed, each capable of performing tasks related to compliance and governance in Microsoft Purview. These roles, when assigned or if already assigned to users, grant them permissions to access and perform specific tasks within Microsoft Purview. Therefore, if you’re assigned one of these roles via Entra ID, you will have certain permissions inside Microsoft Purview depending on the role assigned. However, this does not mean you have full control to Microsoft Purview, as additional Purview roles need to be assigned to perform specific tasks.
For example, to view Role Groups (under the option Entra ID) in the Purview portal, users need to have the Global Administrator role assigned. If you’re already a Global Admin, you’ll automatically have access to view and manage users within Role Groups in Microsoft Purview.
However, assigning such a powerful role (Global Administrator) might not always be ideal, as it provides extensive permissions beyond just viewing Role Groups in Entra ID. To address this, there is a more targeted Microsoft Purview role available under Role Groups, the Role Management role. This role enables users to view, create, and modify Role Groups and much more inside Microsoft Purview without granting the broad permissions associated with a Global Admin, which has significant control over your environment.
But what is the purpose of Role Groups? Role groups in Microsoft Purview are specific to data governance and compliance tasks within Purview itself. These groups allow you to manage user permissions for accessing and performing tasks in Purview, like working with policies or data classifications. Essentially, Entra ID roles control broader administrative access, while the 65 built in Role Groups target Purview specific permissions. Apart from the one Entra ID role (Global Administrator), the remaining 8 Entra ID roles can also be located inside Role Groups.
Why is it called a Role Group? Because it’s a group of roles. Let’s take Organization Management as an example.
3. If I click on the Organization Management role group, I see a number of roles included as part of this role group.
The image above displays a list of roles in the Organization Management group.
4. Click Edit to add members to this group.
5. From here, we can add members to this role group and click next to complete.
6. But what if one of the role groups was ideal for you, but you wanted to remove some roles or slightly tweak the role group to fulfil your requirements? You can clone the role by clicking “Copy” and configure it as needed.
7. Give the role group a suitable name and click Copy.
8. Locate the custom role group you created from the list, open it, and click Edit. You can then remove any unwanted roles as needed.
9. What if you wanted to create a role group and add the required roles from scratch? Click Role groups located under Roles and scopes, and click + Create role group as shown in the images below.
Important note:
It’s crucial to assign the right permissions following the principle of least privilege, ensuring that users managing Purview have only the permissions necessary to perform their job functions. Over provisioning permissions can increase the attack surface and lead to excessive control in the event the account is compromised by a bad actor.
Finally, we come to Adaptive scopes.
Adaptive Scopes
What are Adaptive Scopes?
When you create retention and communication compliance policies (more on these policies later) in Microsoft Purview, you can add an adaptive scope for your policy. But, what’s the benefit? An adaptive scope allows you to create policies that automatically adjust to include or exclude data based on a specific criteria. This helps ensure that the right policies are applied to the right data without needing constant manual updates. For, example, you want to create a retention policy that ensures all documents related to financial transactions are retained for 7 years, regardless of where the data is stored. You can create and assign an adaptive scope based on queries, such as if the user’s country is the US. The retention policy will retain data for the specified number of years in the US only. If the requirement for retention in the UK is different, you could create a retention policy to retain data for 10 years and assign the adaptive scope including a query based on UK users. An adaptive scope reduces the management overhead.
Adaptive scopes are similar to dynamic groups in Entra ID but offer more and work with specific Purview policies, which will be covered later. To summarise, an adaptive scope is a scope that is dynamically filled based on a query you configure.
Adaptive scopes can also be applied to SharePoint site names and URL’s, OneDrive, Teams messages and more. See image below for a list. Source: Adaptive scopes | Microsoft Learn
Let’s go through the steps
- Navigate to the Microsoft Purview portal and click on Adaptive scopes.
2. Click on Create scope to start creating a new adaptive scope
3. Enter a name for your adaptive scope. For example, you want to create an adaptive scope for your finance team. You can later create a retention policy to store data for the finance team for 7 years and assign this adaptive scope to the policy. Microsoft Purview will look for individuals in the finance team with a specific attribute, which we will configure shortly.
Click Next to proceed
4. The next page allows you to assign an admin unit you may have created in Entra ID. You don’t have to select admin units and could click Next to move to the next page, but it’s worth knowing why you would want to use an admin unit.
Explanation of Admin Units
Admin units provide the ability to assign admins to one or more administrative units, with the result that these now restricted admins can manage only the users in their assigned administrative units. For example, a university may have thousands of student user accounts located in Entra ID. You need to split support responsibility amongst three IT teams. IT Team A are responsible for taking support calls from the Law students. IT Team A have the needed permissions to manage Law student user accounts. Team B will only manage Medicine students and Team C will only manage Engineering students. Admin units allow us to split responsibility between the IT teams.
This boundary of management flows into Microsoft Purview for supported solutions to ensure that restricted admins can manage only the users they have been assigned to manage.
For example, let’s take IT team A who manage and support Law students. IT team A only have the permissions to manage Law student user accounts. We create a new adaptive scope for Law students and select the administrative unit named Law Students. Then, because we want the adaptive scope to include only Law students, we use the department attribute to specify Department = Faculty of Law. If we misconfigure this attribute and instead specify, Department = Faculty of Art, but the users with that value aren’t included in the Law students administrative unit, the scope won’t contain any users. The target users can be Law students only. You can learn more about administrative units at the following Microsoft Learn link, Administrative units in Microsoft Entra ID – Microsoft Entra ID | Microsoft Learn.
In this demo, I won’t be assigning an admin unit. Click Next
5. On the scope type page, we can select the scope. Here we can scope the adaptive scope to users, SharePoint sites or Microsoft 365 groups.
6. I’ll select SharePoint sites and click Next.
7. This is where we can build a query. For example, these attributes can be used in our policy to apply a retention policy of 7 years if the SharePoint URL or name starts with “finance”.
8. Here is an example query
Query: Site URL starts with finance
and here is my SharePoint page starting with finance in the URL.
You can also add additional queries if required
You can also add custom attributes if needed
You can also use a different condition if you don’t wish to use “starts with”
9. Now, when I apply the adaptive scope to a policy, it will only apply the policy to SharePoint sites starting with Finance.
We can also create an adaptive scope for users, SharePoint site or Microsoft 365 Groups. Images below.
User attributes available for users
Microsoft 365 Groups
Attributes available for Microsoft 365 Group
That’s it for roles and scopes.
I hope this post was useful.
Stay tuned for further blog posts where we explore the different solutions available in Microsoft Purview.
