Hello and welcome to Part 3 of this blog post series on Microsoft Purview. You can visit the previous posts via the links below:
Part 1: Introduction to Microsoft Purview
Part 2: Microsoft Purview Portal
In this post, I explore Microsoft Purview roles and scopes.
As we know from the previous posts, Microsoft Purview offers a robust data governance and compliance solution, enabling organisations to manage sensitive information across multiple platforms. Given the highly sensitive nature of the data within Microsoft Purview, it is crucial to restrict access to authorised individuals only. To ensure that access is granted to the right individuals, Microsoft Purview leverages Role Based Access Control (RBAC), which allows for more precise control over who can access specific solutions and datasets.
Please note that holding a Compliance Admin or even a Global Admin role may not grant access to highly confidential data. Additional roles may need to be assigned to manage specific areas within Microsoft Purview. Furthermore, granting highly privileged roles to admins does not follow best practices and the principle of least privilege. We should always assign just enough permissions for the admin to perform their duties.
Let’s explore roles and scopes further.
- Access purview.microsoft.com, click Settings, and click to expand Roles and scopes from the left pane.
2. The first two options available under Roles and scopes are Microsoft Entra ID and Role groups.
Microsoft Entra ID roles, visible within Entra ID at entra.microsoft.com, include over 100 built in roles that serve various administrative functions. In the Microsoft Purview Portal, however, only 9 specific Entra ID roles are listed, each capable of performing tasks related to compliance and governance in Microsoft Purview. These roles, when assigned or if already assigned to users, grant them permissions to access and perform specific tasks within Microsoft Purview. Therefore, if you’re assigned one of these roles via Entra ID, you will have certain permissions inside Microsoft Purview depending on the role assigned. However, this does not mean you have full control to Microsoft Purview, as additional Purview roles need to be assigned to perform specific tasks.
For example, to view Role Groups (under the option Entra ID) in the Purview portal, users need to have the Global Administrator role assigned. If you’re already a Global Admin, you’ll automatically have access to view and manage users within Role Groups in Microsoft Purview.
However, assigning such a powerful role (Global Administrator) might not always be ideal, as it provides extensive permissions beyond just viewing Role Groups in Entra ID. To address this, there is a more targeted Microsoft Purview role available under Role Groups, the Role Management role. This role enables users to view, create, and modify Role Groups and much more inside Microsoft Purview without granting the broad permissions associated with a Global Admin, which has significant control over your environment.
But what is the purpose of Role Groups? Role groups in Microsoft Purview are specific to data governance and compliance tasks within Purview itself. These groups allow you to manage user permissions for accessing and performing tasks in Purview, like working with policies or data classifications. Essentially, Entra ID roles control broader administrative access, while the 65 built in Role Groups target Purview specific permissions. Apart from the one Entra ID role (Global Administrator), the remaining 8 Entra ID roles can also be located inside Role Groups.
Why is it called a Role Group? Because it’s a group of roles. Let’s take Organization Management as an example.
3. If I click on the Organization Management role group, I see a number of roles included as part of this role group.
The image above displays a list of roles in the Organization Management group.
4. Click Edit to add members to this group.
5. From here, we can add members to this role group and click next to complete.
6. But what if one of the role groups was ideal for you, but you wanted to remove some roles or slightly tweak the role group to fulfil your requirements? You can clone the role by clicking “Copy” and configure it as needed.
7. Give the role group a suitable name and click Copy.
8. Locate the custom role group you created from the list, open it, and click Edit. You can then remove any unwanted roles as needed.
9. What if you wanted to create a role group and add the required roles from scratch? Click Role groups located under Roles and scopes, and click + Create role group as shown in the images below.
Important note:
It’s crucial to assign the right permissions following the principle of least privilege, ensuring that users managing Purview have only the permissions necessary to perform their job functions. Over provisioning permissions can increase the attack surface and lead to excessive control in the event the account is compromised by a bad actor.
Finally, we come to Adaptive scopes.
Adaptive Scopes
What are Adaptive Scopes?
When you create retention and communication compliance policies (more on these policies later) in Microsoft Purview, you can add an adaptive scope for your policy. But, what’s the benefit? An adaptive scope allows you to create policies that automatically adjust to include or exclude data based on a specific criteria. This helps ensure that the right policies are applied to the right data without needing constant manual updates. For, example, you want to create a retention policy that ensures all documents related to financial transactions are retained for 7 years, regardless of where the data is stored. You can create and assign an adaptive scope based on queries, such as if the user’s country is the US. The retention policy will retain data for the specified number of years in the US only. If the requirement for retention in the UK is different, you could create a retention policy to retain data for 10 years and assign the adaptive scope including a query based on UK users. An adaptive scope reduces the management overhead.
Adaptive scopes are similar to dynamic groups in Entra ID but offer more and work with specific Purview policies, which will be covered later. To summarise, an adaptive scope is a scope that is dynamically filled based on a query you configure.
Adaptive scopes can also be applied to SharePoint site names and URL’s, OneDrive, Teams messages and more. See image below for a list. Source: Adaptive scopes | Microsoft Learn
Let’s go through the steps
- Navigate to the Microsoft Purview portal and click on Adaptive scopes.
2. Click on Create scope to start creating a new adaptive scope
3. Enter a name for your adaptive scope. For example, you want to create an adaptive scope for your finance team. You can later create a retention policy to store data for the finance team for 7 years and assign this adaptive scope to the policy. Microsoft Purview will look for individuals in the finance team with a specific attribute, which we will configure shortly.
Click Next to proceed
4. The next page allows you to assign an admin unit you may have created in Entra ID. You don’t have to select admin units and could click Next to move to the next page, but it’s worth knowing why you would want to use an admin unit.
Explanation of Admin Units
Administrative Units (AUs) are created in Microsoft Entra ID to enable delegated administration. They allow you to assign specific admins to one or more administrative units, ensuring that these admins can manage only the users within their assigned units.
For example, consider a university with thousands of student user accounts in Entra ID. To distribute support responsibilities, the university divides its IT support across three teams:
- IT Team A supports Law students.
- IT Team B supports Medicine students.
- IT Team C supports Engineering students.
Each team is granted permissions scoped to their respective administrative unit. This means:
- IT Team A can manage only Law student accounts.
- IT Team B can manage only Medicine student accounts.
- IT Team C can manage only Engineering student accounts.
Administrative Units provide a structured way to split management responsibilities, ensuring that each team can operate independently and securely within their designated scope.
In Microsoft Purview, administrative units help ensure that data governance policies, such as sensitivity labels or DLP policies, are scoped only to the users within the admin unit, aligning with delegated responsibilities. For example, if you assign an administrative unit that includes five Law students to a labeling policy in Purview, only those five students will be affected by the policy.
I can apply a policy directly to an administrative unit, so if the Law Students admin unit contains 300 users, the policy will apply only to 300 users; however, if I need to target a more specific subset or use dynamic filtering (e.g., based on country, city and more), I can use an adaptive scope instead.
In this demonstration, I will not be assigning an administrative unit. Click Next to continue.
5. On the scope type page, we can select the scope. Here we can scope the adaptive scope to users, SharePoint sites or Microsoft 365 groups.
6. I’ll select SharePoint sites and click Next.
7. This is where we can build a query. For example, these attributes can be used in our policy to apply a retention policy of 7 years if the SharePoint URL or name starts with “finance”.
8. Here is an example query
Query: Site URL starts with finance
and here is my SharePoint page starting with finance in the URL.
You can also add additional queries if required
You can also add custom attributes if needed
You can also use a different condition if you don’t wish to use “starts with”
9. Now, when I apply the adaptive scope to a policy, it will only apply the policy to SharePoint sites starting with Finance.
We can also create an adaptive scope for users, SharePoint site or Microsoft 365 Groups. Images below.
User attributes available for users
Microsoft 365 Groups
Attributes available for Microsoft 365 Group
That’s it for roles and scopes.
Join me in Part 4, where I walk through the process of turning on audit logs in Microsoft Purview.
Click the following link: Turn on audit logs in Microsoft Purview – Part 4
