Microsoft Purview · Information Protection
Information Protection ABAC Attribute Definition Administrators
[Preview] Define, configure, activate, and deactivate the valid set of Microsoft 365 Information Protection Attributes that can be assigned to supported objects (such as users and service principals) for ABAC policy evaluation.
Scope: Tenant-wide administration of the attribute catalog for M365 Information Protection. Does not include assigning attributes to users or authoring access policies (separation of duties).
Permissions
- Define valid M365 Info Protect Attribute schemas and keys
- Configure attribute data types, allowed values, and validation rules
- Activate new attribute definitions for operational use in policies
- Deactivate retired or deprecated attribute definitions
- View all active and inactive attribute definitions
Common use cases
- Establishing security clearance levels, citizenship tags, or project code schemas
- Standardizing attribute definitions across multi-tenant or defense organizational units
- Retiring obsolete security attributes without deleting audit history
- Managing the governance taxonomy for attribute-based mandatory access control
Best practices
- Maintain strict separation between attribute definers, attribute assigners, and policy authors
- Enforce standardized naming conventions and allowed-value enumerations for attributes
- Deactivate rather than delete attributes that were previously used in policy enforcement
- Coordinate attribute definitions with enterprise identity teams and Entra directory schemas
Security considerations
- Deactivating an in-use attribute definition can disrupt active ABAC policy evaluations
- Poorly defined attribute schemas can lead to ambiguous policy matches or unexpected access grants
Common questions
When should I assign the Information Protection ABAC Attribute Definition Administrators role?
Assign Information Protection ABAC Attribute Definition Administrators when you need to: Establishing security clearance levels, citizenship tags, or project code schemas; Standardizing attribute definitions across multi-tenant or defense organizational units; Retiring obsolete security attributes without deleting audit history; and Managing the governance taxonomy for attribute-based mandatory access control. It is part of Microsoft Purview and should be granted as a least-privilege alternative to broader roles like Global Administrator.
What can someone with the Information Protection ABAC Attribute Definition Administrators role do?
The Information Protection ABAC Attribute Definition Administrators role grants permissions including: Define valid M365 Info Protect Attribute schemas and keys; Configure attribute data types, allowed values, and validation rules; Activate new attribute definitions for operational use in policies; Deactivate retired or deprecated attribute definitions; and View all active and inactive attribute definitions. See the Permissions section above for the full list.
What are the security risks of the Information Protection ABAC Attribute Definition Administrators role?
Key considerations when assigning Information Protection ABAC Attribute Definition Administrators: Deactivating an in-use attribute definition can disrupt active ABAC policy evaluations; and Poorly defined attribute schemas can lead to ambiguous policy matches or unexpected access grants. Review the Security considerations section before assignment, and pair with Privileged Identity Management (PIM) for just-in-time access where possible.