Microsoft Purview · Information Protection
Information Protection ABAC Attribute Assignment Readers
[Preview] Read and inspect Microsoft 365 Information Protection Attributes assigned to supported objects (users and service principals). View-only role for auditing which security attributes and clearance values are assigned to identities.
Scope: Read-only visibility into assigned M365 Info Protect attributes across all supported objects. No permission to assign, modify, remove, or define attributes.
Permissions
- Read M365 Info Protect Attributes assigned to users
- Read M365 Info Protect Attributes assigned to service principals
- Search and filter objects by assigned attribute values
- Export attribute assignment reports for compliance and auditing
Common use cases
- Verifying employee clearance and attribute assignment status during security audits
- Investigating access denial incidents where a user claims missing attribute tags
- Validating automated identity provisioning and HR sync accuracy
- Periodic access certification and attribute compliance reviews
Best practices
- Assign to help desk tier 2/3 and SOC analysts investigating ABAC access issues
- Use for scheduled compliance reviews and auditor sampling
- Pair with Policy Reader for diagnosing why an identity was granted or denied access
Security considerations
- Low operational risk: cannot modify or grant attributes
- Assigned attributes may reveal sensitive employee clearance or project involvement
Common questions
When should I assign the Information Protection ABAC Attribute Assignment Readers role?
Assign Information Protection ABAC Attribute Assignment Readers when you need to: Verifying employee clearance and attribute assignment status during security audits; Investigating access denial incidents where a user claims missing attribute tags; Validating automated identity provisioning and HR sync accuracy; and Periodic access certification and attribute compliance reviews. It is part of Microsoft Purview and should be granted as a least-privilege alternative to broader roles like Global Administrator.
What can someone with the Information Protection ABAC Attribute Assignment Readers role do?
The Information Protection ABAC Attribute Assignment Readers role grants permissions including: Read M365 Info Protect Attributes assigned to users; Read M365 Info Protect Attributes assigned to service principals; Search and filter objects by assigned attribute values; and Export attribute assignment reports for compliance and auditing. See the Permissions section above for the full list.
What are the security risks of the Information Protection ABAC Attribute Assignment Readers role?
Key considerations when assigning Information Protection ABAC Attribute Assignment Readers: Low operational risk: cannot modify or grant attributes; and Assigned attributes may reveal sensitive employee clearance or project involvement. Review the Security considerations section before assignment, and pair with Privileged Identity Management (PIM) for just-in-time access where possible.