Microsoft Purview · Information Protection
Information Protection ABAC Policy Readers
[Preview] View and inspect Microsoft 365 Information Protection ABAC Policies and Rules. Read-only role for auditing Mandatory Access Control (MAC) policy configurations, rules, and condition logic without ability to modify or toggle policies.
Scope: Read-only visibility into M365 Info Protect ABAC policies and rules across the tenant. No permission to edit, create, activate, or assign attributes.
Permissions
- View M365 Info Protect ABAC Policies and rule configurations
- Inspect policy enforcement status (enabled/disabled)
- Review attribute condition expressions and target scopes
- Audit policy metadata and modification history
- Export policy configurations for compliance documentation and audit reports
Common use cases
- Security audits and regulatory compliance verification of access control policies
- Reviewing mandatory access control logic during compliance and clearance assessments
- Assisting help desk and security analysts in diagnosing access denial issues related to ABAC rules
- External audit and oversight review for defense and government compliance programs
Best practices
- Assign to auditors, compliance officers, and security reviewers instead of the Policy Administrator role
- Use for routine policy review and architectural documentation validation
- Pair with Attribute Definition Reader and Attribute Assignment Reader for complete read-only visibility
Security considerations
- Low security risk: cannot create, edit, or disable access policies
- Policy condition logic reveals security requirements and classification boundaries; restrict to authorized personnel
Common questions
When should I assign the Information Protection ABAC Policy Readers role?
Assign Information Protection ABAC Policy Readers when you need to: Security audits and regulatory compliance verification of access control policies; Reviewing mandatory access control logic during compliance and clearance assessments; Assisting help desk and security analysts in diagnosing access denial issues related to ABAC rules; and External audit and oversight review for defense and government compliance programs. It is part of Microsoft Purview and should be granted as a least-privilege alternative to broader roles like Global Administrator.
What can someone with the Information Protection ABAC Policy Readers role do?
The Information Protection ABAC Policy Readers role grants permissions including: View M365 Info Protect ABAC Policies and rule configurations; Inspect policy enforcement status (enabled/disabled); Review attribute condition expressions and target scopes; Audit policy metadata and modification history; and Export policy configurations for compliance documentation and audit reports. See the Permissions section above for the full list.
What are the security risks of the Information Protection ABAC Policy Readers role?
Key considerations when assigning Information Protection ABAC Policy Readers: Low security risk: cannot create, edit, or disable access policies; and Policy condition logic reveals security requirements and classification boundaries; restrict to authorized personnel. Review the Security considerations section before assignment, and pair with Privileged Identity Management (PIM) for just-in-time access where possible.