Microsoft Purview · Information Protection
Information Protection ABAC Attribute Definition Readers
[Preview] Read and inspect the definitions of Microsoft 365 Information Protection Attributes. View-only role for reviewing available attribute keys, data types, allowed values, and operational status without modification privileges.
Scope: Read-only visibility into M365 Info Protect attribute definitions. Cannot create, edit, activate, deactivate, or assign attributes.
Permissions
- Read definitions of all M365 Info Protect Attributes
- View attribute schema details, data types, and allowed values
- Check attribute lifecycle status (active vs deactivated)
- Export attribute schema definitions for documentation and auditing
Common use cases
- Auditing defined security attribute schemas against regulatory frameworks
- Allowing policy authors or developers to review available attribute names before drafting policies
- Cataloging organizational attributes for data governance reporting
Best practices
- Included automatically in Policy Administrators and Attribute Assignment Administrators role groups
- Assign standalone to auditors or junior policy analysts
Security considerations
- Low risk: read-only access to attribute metadata
- Attribute names and schemas may reflect sensitive project codes or organizational structures
Common questions
When should I assign the Information Protection ABAC Attribute Definition Readers role?
Assign Information Protection ABAC Attribute Definition Readers when you need to: Auditing defined security attribute schemas against regulatory frameworks; Allowing policy authors or developers to review available attribute names before drafting policies; and Cataloging organizational attributes for data governance reporting. It is part of Microsoft Purview and should be granted as a least-privilege alternative to broader roles like Global Administrator.
What can someone with the Information Protection ABAC Attribute Definition Readers role do?
The Information Protection ABAC Attribute Definition Readers role grants permissions including: Read definitions of all M365 Info Protect Attributes; View attribute schema details, data types, and allowed values; Check attribute lifecycle status (active vs deactivated); and Export attribute schema definitions for documentation and auditing. See the Permissions section above for the full list.
What are the security risks of the Information Protection ABAC Attribute Definition Readers role?
Key considerations when assigning Information Protection ABAC Attribute Definition Readers: Low risk: read-only access to attribute metadata; and Attribute names and schemas may reflect sensitive project codes or organizational structures. Review the Security considerations section before assignment, and pair with Privileged Identity Management (PIM) for just-in-time access where possible.