Microsoft Purview · Data Map Collections
Workflow Administrator
Access workflow authoring page in Microsoft Purview governance portal and publish workflows on collections where they have access permissions.
Scope: Workflow authoring and publishing within collections where also assigned Data Reader role
Permissions
- Access the workflow authoring page in Microsoft Purview governance portal
- Create and configure approval workflows for data governance processes
- Publish workflows on collections where they have access permissions
- Design workflow logic and approval chains
- Configure workflow triggers and conditions
- Manage workflow templates and reusable components
- Monitor workflow execution and status
Common use cases
- Creating approval workflows for data access requests
- Building workflows for glossary term approval processes
- Configuring classification change approval workflows
- Setting up data product publication approval chains
- Automating data stewardship tasks and approvals
- Implementing governance checkpoints for sensitive data changes
- Creating self-service data request workflows
Best practices
- Design workflows that align with organizational approval policies
- Start with simple workflows and add complexity as needed
- Test workflows thoroughly before publishing to production
- Document workflow logic and approval criteria
- Coordinate with Collection Administrators on workflow scope
- Consider timeout and escalation paths for approvals
- Monitor workflow completion rates and bottlenecks
- Create reusable workflow templates for common scenarios
- Involve business stakeholders in workflow design
Security considerations
- Workflow Administrator only has access to authoring - not data access
- Requires Data Reader role to access the Purview governance portal
- Workflows can affect data access and governance decisions
- Published workflows run in context of their configured permissions
- Should coordinate with Collection Admins on approval chain participants
- Monitor workflow logs for unusual approval patterns
- Ensure workflow approvers have appropriate authority
Common questions
When should I assign the Workflow Administrator role?
Assign Workflow Administrator when you need to: Creating approval workflows for data access requests; Building workflows for glossary term approval processes; Configuring classification change approval workflows; Setting up data product publication approval chains; and Automating data stewardship tasks and approvals. It is part of Microsoft Purview and should be granted as a least-privilege alternative to broader roles like Global Administrator.
What can someone with the Workflow Administrator role do?
The Workflow Administrator role grants permissions including: Access the workflow authoring page in Microsoft Purview governance portal; Create and configure approval workflows for data governance processes; Publish workflows on collections where they have access permissions; Design workflow logic and approval chains; Configure workflow triggers and conditions; and Manage workflow templates and reusable components. See the Permissions section above for the full list.
What are the security risks of the Workflow Administrator role?
Key considerations when assigning Workflow Administrator: Workflow Administrator only has access to authoring - not data access; Requires Data Reader role to access the Purview governance portal; Workflows can affect data access and governance decisions; and Published workflows run in context of their configured permissions. Review the Security considerations section before assignment, and pair with Privileged Identity Management (PIM) for just-in-time access where possible.