Microsoft Purview · Purview Agents (Preview)
Data Security DSPM Posture Agent
Combined role requirements for deploying, running, and viewing results from the DSPM Posture Agent (Preview). This agent uses natural language processing to find sensitive data across Microsoft 365, helping security teams understand their data landscape.
Scope: Sensitive data discovery and posture assessment across Microsoft 365 data estate
Permissions
- Deploy Posture Agent - Requires Purview Content Analyst + Compliance Admin/Security Reader/Data Security Viewer + Data Classification Viewer + Security Copilot Contributor/Owner
- Run Posture Queries - Execute natural language searches for sensitive data across Microsoft 365
- View Results - Access Posture Agent findings including data locations and sensitivity classifications
- Data Classification Content Viewer - View classified content identified by the agent
- Data Classification List Viewer - Browse list of classified items
Common use cases
- Discovering sensitive data locations across Microsoft 365 using natural language
- Assessing data security posture before AI deployments (e.g., Copilot)
- Identifying oversharing of sensitive content across SharePoint, OneDrive, Exchange
- Supporting compliance audits with comprehensive data discovery
- Proactively finding unprotected sensitive data for remediation
Best practices
- Use for periodic data posture assessments rather than continuous monitoring
- Review results with data owners before taking remediation actions
- Coordinate with Information Protection team for label gap analysis
- Document findings and create remediation plans from agent results
- Monitor SCU consumption — complex queries increase costs
- Use findings to prioritize sensitivity label deployment
Security considerations
- Agent discovers sensitive data locations — results are themselves sensitive
- Requires broad read access to classified content metadata
- Results may reveal data exposure gaps that need immediate remediation
- Requires role from FOUR different permission groups — complex access model
- Security Copilot Contributor/Owner provides access to all SCU-based features
- Limit access to security and compliance leads only
Common questions
When should I assign the Data Security DSPM Posture Agent role?
Assign Data Security DSPM Posture Agent when you need to: Discovering sensitive data locations across Microsoft 365 using natural language; Assessing data security posture before AI deployments (e.g., Copilot); Identifying oversharing of sensitive content across SharePoint, OneDrive, Exchange; Supporting compliance audits with comprehensive data discovery; and Proactively finding unprotected sensitive data for remediation. It is part of Microsoft Purview and should be granted as a least-privilege alternative to broader roles like Global Administrator.
What can someone with the Data Security DSPM Posture Agent role do?
The Data Security DSPM Posture Agent role grants permissions including: Deploy Posture Agent - Requires Purview Content Analyst + Compliance Admin/Security Reader/Data Security Viewer + Data Classification Viewer + Security Copilot Contributor/Owner; Run Posture Queries - Execute natural language searches for sensitive data across Microsoft 365; View Results - Access Posture Agent findings including data locations and sensitivity classifications; Data Classification Content Viewer - View classified content identified by the agent; and Data Classification List Viewer - Browse list of classified items. See the Permissions section above for the full list.
What are the security risks of the Data Security DSPM Posture Agent role?
Key considerations when assigning Data Security DSPM Posture Agent: Agent discovers sensitive data locations — results are themselves sensitive; Requires broad read access to classified content metadata; Results may reveal data exposure gaps that need immediate remediation; and Requires role from FOUR different permission groups — complex access model. Review the Security considerations section before assignment, and pair with Privileged Identity Management (PIM) for just-in-time access where possible.