Microsoft Entra ID · M365 Workloads & Services
Purview Workload Content Administrator
Allows Microsoft Purview operations to read, write, and delete Microsoft 365 content. Microsoft manages this Entra role from mapped Purview role assignments; do not assign it directly in Entra.
Scope: Runtime authorization for Purview operations against content in SharePoint, Teams, OneDrive, and Exchange
Permissions
- Runtime content access - Allow Microsoft Purview operations to read, write, and delete Microsoft 365 content
- Content purge - Authorize long-running purge operations, such as deleting messages in Microsoft Teams
Common use cases
- Authorizing Search and Purge operations submitted from Microsoft Purview
- Authorizing Data Security Investigation Admin and Analyst operations
- Supporting long-running Purview operations that must delete Microsoft 365 content
Best practices
- Assign the mapped role in Microsoft Purview instead of assigning this Entra role directly
- Keep the Purview Role Assignment Migrator enterprise application enabled
- Use PIM for Groups on Purview role groups when just-in-time access is required
- Size activation windows to cover the full duration of long-running operations
Security considerations
- Highest-privilege Purview workload content role: can authorize destructive content deletion
- Manual Entra assignments can be overwritten during the next Purview synchronization
- Disabling the Role Assignment Migrator can cause long-running Purview operations to fail authorization checks
Common questions
When should I assign the Purview Workload Content Administrator role?
Assign Purview Workload Content Administrator when you need to: Authorizing Search and Purge operations submitted from Microsoft Purview; Authorizing Data Security Investigation Admin and Analyst operations; and Supporting long-running Purview operations that must delete Microsoft 365 content. It is part of Microsoft Entra ID and should be granted as a least-privilege alternative to broader roles like Global Administrator.
What can someone with the Purview Workload Content Administrator role do?
The Purview Workload Content Administrator role grants permissions including: Runtime content access - Allow Microsoft Purview operations to read, write, and delete Microsoft 365 content; and Content purge - Authorize long-running purge operations, such as deleting messages in Microsoft Teams. See the Permissions section above for the full list.
What are the security risks of the Purview Workload Content Administrator role?
Key considerations when assigning Purview Workload Content Administrator: Highest-privilege Purview workload content role: can authorize destructive content deletion; Manual Entra assignments can be overwritten during the next Purview synchronization; and Disabling the Role Assignment Migrator can cause long-running Purview operations to fail authorization checks. Review the Security considerations section before assignment, and pair with Privileged Identity Management (PIM) for just-in-time access where possible.