Microsoft Purview · Information Protection
Information Protection ABAC Policy Administrators
[Preview] Define, configure, and manage Microsoft 365 Information Protection ABAC Policies and Rules that govern Mandatory Access Control (MAC) decisions. Create, view, edit, delete, enable, and disable ABAC security policies and evaluation rules across supported Microsoft 365 workloads.
Scope: Organization-wide creation and management of M365 Information Protection ABAC / MAC policies. Does not include defining new attribute schemas or assigning attributes to identities (separation of duties).
Permissions
- Create, edit, and delete M365 Info Protect ABAC Policies and Rules
- Enable and disable Mandatory Access Control (MAC) enforcement rules
- Configure condition expressions evaluating user and resource attributes
- View all ABAC policy definitions and execution scopes
- Read M365 Info Protect Attribute Definitions (via included Attribute Definition Reader)
- Test and simulate ABAC policy enforcement against target identities and resources
Common use cases
- Authoring mandatory access control policies that enforce attribute-based restrictions on classified content
- Implementing multi-dimensional security clearance controls for government and defense contracts (GCC High / DoD)
- Activating and disabling emergency policy overrides or stricter access constraints during security escalations
- Auditing and refining ABAC policy logic based on compliance evaluations
Best practices
- Maintain strict separation of duties: policy authors should not manage attribute assignments
- Test all ABAC policies in non-enforcing or simulation mode before enabling mandatory enforcement
- Use PIM for time-limited, just-in-time administrative assignment
- Document all policy rule sets and coordinate with enterprise compliance and legal teams
- Review policy audit logs regularly to verify intended access decision outcomes
Security considerations
- High-privilege role: incorrectly authored MAC policies can block legitimate user access to critical business data
- Policy changes apply across all target workloads and cannot be bypassed by standard user permissions
- Restrict assignment to a small, vetted team of senior security policy architects
Common questions
When should I assign the Information Protection ABAC Policy Administrators role?
Assign Information Protection ABAC Policy Administrators when you need to: Authoring mandatory access control policies that enforce attribute-based restrictions on classified content; Implementing multi-dimensional security clearance controls for government and defense contracts (GCC High / DoD); Activating and disabling emergency policy overrides or stricter access constraints during security escalations; and Auditing and refining ABAC policy logic based on compliance evaluations. It is part of Microsoft Purview and should be granted as a least-privilege alternative to broader roles like Global Administrator.
What can someone with the Information Protection ABAC Policy Administrators role do?
The Information Protection ABAC Policy Administrators role grants permissions including: Create, edit, and delete M365 Info Protect ABAC Policies and Rules; Enable and disable Mandatory Access Control (MAC) enforcement rules; Configure condition expressions evaluating user and resource attributes; View all ABAC policy definitions and execution scopes; Read M365 Info Protect Attribute Definitions (via included Attribute Definition Reader); and Test and simulate ABAC policy enforcement against target identities and resources. See the Permissions section above for the full list.
What are the security risks of the Information Protection ABAC Policy Administrators role?
Key considerations when assigning Information Protection ABAC Policy Administrators: High-privilege role: incorrectly authored MAC policies can block legitimate user access to critical business data; Policy changes apply across all target workloads and cannot be bypassed by standard user permissions; and Restrict assignment to a small, vetted team of senior security policy architects. Review the Security considerations section before assignment, and pair with Privileged Identity Management (PIM) for just-in-time access where possible.