Microsoft Entra ID · M365 Workloads & Services
Purview Workload Content Writer
Allows Microsoft Purview operations to read and write Microsoft 365 content. Microsoft manages this Entra role from mapped Purview role assignments; do not assign it directly in Entra.
Scope: Runtime read and write authorization for Purview operations against content in SharePoint, Teams, OneDrive, and Exchange
Permissions
- Runtime content access - Allow Microsoft Purview operations to read and write Microsoft 365 content
- Content storage - Authorize operations that store content, such as mail items in Exchange
Common use cases
- Authorizing Hold operations submitted from Microsoft Purview
- Authorizing Privacy Management Investigation operations
- Authorizing Data Security Investigation Investigator operations
Best practices
- Assign the mapped role in Microsoft Purview instead of assigning this Entra role directly
- Keep the Purview Role Assignment Migrator enterprise application enabled
- Use PIM for Groups on Purview role groups when just-in-time access is required
- Size activation windows to cover the full duration of long-running operations
Security considerations
- Can authorize Purview operations that write content into Microsoft 365 workloads
- Manual Entra assignments can be overwritten during the next Purview synchronization
- Does not authorize content deletion; Administrator is the higher synchronized level
Common questions
When should I assign the Purview Workload Content Writer role?
Assign Purview Workload Content Writer when you need to: Authorizing Hold operations submitted from Microsoft Purview; Authorizing Privacy Management Investigation operations; and Authorizing Data Security Investigation Investigator operations. It is part of Microsoft Entra ID and should be granted as a least-privilege alternative to broader roles like Global Administrator.
What can someone with the Purview Workload Content Writer role do?
The Purview Workload Content Writer role grants permissions including: Runtime content access - Allow Microsoft Purview operations to read and write Microsoft 365 content; and Content storage - Authorize operations that store content, such as mail items in Exchange. See the Permissions section above for the full list.
What are the security risks of the Purview Workload Content Writer role?
Key considerations when assigning Purview Workload Content Writer: Can authorize Purview operations that write content into Microsoft 365 workloads; Manual Entra assignments can be overwritten during the next Purview synchronization; and Does not authorize content deletion; Administrator is the higher synchronized level. Review the Security considerations section before assignment, and pair with Privileged Identity Management (PIM) for just-in-time access where possible.