Microsoft Purview · Information Protection
Information Protection ABAC Attribute Assignment Administrators
[Preview] Assign and remove Microsoft 365 Information Protection Attributes for supported objects, including users and service principals. Controls which security attributes and clearance values are bound to identities for ABAC evaluation.
Scope: Tenant-wide authority to attach, update, and detach M365 Information Protection attributes on users and service principals. Does not include defining new attribute schemas or drafting access control policies (separation of duties).
Permissions
- Assign M365 Info Protect Attributes to supported objects (users, service principals)
- Remove M365 Info Protect Attributes from supported objects
- Update assigned attribute values on target identities
- Read M365 Info Protect Attribute Definitions (via included Attribute Definition Reader)
- View all assigned attribute values across tenant users and principals
Common use cases
- Provisioning security clearance attributes or citizenship tags to employee accounts
- Assigning project-specific security tags to partner accounts and automated service principals
- Deprovisioning attribute values upon employee offboarding or transfer to immediately revoke ABAC access
- Maintaining synchronized attribute values based on HR or clearance database records
Best practices
- Never combine Attribute Assignment Admin and Policy Admin in the same account (prevents unilateral privilege escalation)
- Automate attribute provisioning through verified HR or clearance feeds with approval gates
- Audit attribute assignment changes frequently via Purview and unified audit logs
- Use PIM for time-limited activation with mandatory business justification
Security considerations
- Critical privilege: assigning a higher clearance attribute grants access to protected data under ABAC policies
- Unauthorized attribute assignment bypasses intended data boundaries without altering the policy itself
- Must be subject to rigorous access reviews and logging
Common questions
When should I assign the Information Protection ABAC Attribute Assignment Administrators role?
Assign Information Protection ABAC Attribute Assignment Administrators when you need to: Provisioning security clearance attributes or citizenship tags to employee accounts; Assigning project-specific security tags to partner accounts and automated service principals; Deprovisioning attribute values upon employee offboarding or transfer to immediately revoke ABAC access; and Maintaining synchronized attribute values based on HR or clearance database records. It is part of Microsoft Purview and should be granted as a least-privilege alternative to broader roles like Global Administrator.
What can someone with the Information Protection ABAC Attribute Assignment Administrators role do?
The Information Protection ABAC Attribute Assignment Administrators role grants permissions including: Assign M365 Info Protect Attributes to supported objects (users, service principals); Remove M365 Info Protect Attributes from supported objects; Update assigned attribute values on target identities; Read M365 Info Protect Attribute Definitions (via included Attribute Definition Reader); and View all assigned attribute values across tenant users and principals. See the Permissions section above for the full list.
What are the security risks of the Information Protection ABAC Attribute Assignment Administrators role?
Key considerations when assigning Information Protection ABAC Attribute Assignment Administrators: Critical privilege: assigning a higher clearance attribute grants access to protected data under ABAC policies; Unauthorized attribute assignment bypasses intended data boundaries without altering the policy itself; and Must be subject to rigorous access reviews and logging. Review the Security considerations section before assignment, and pair with Privileged Identity Management (PIM) for just-in-time access where possible.