176155 – Microsoft Purview compliance portal: Information Protection – Exact Data Match adding support for role-based access control (RBAC) for EDM upload authorization

Product:

Purview, Purview Communication Compliance, Purview compliance portal, Purview Information Protection

Platform:

US Instances, Web, World tenant

Status:

In development

Change type:

Feature update

Links:

Details:

Customers will be able to choose to leverage RBAC to authorize users for uploading data to the Exact Data Match (EDM) service instead of leveraging the EDM_DataUploaders security group for authorization.

Change Category:
XXXXXXX ... free basic plan only

Scope:
XXXXXXX ... free basic plan only

Release Phase:
General Availability

Created:
2023-09-28

updated:
2026-01-21

Public Preview Start Date

XXXXXXX ... free basic plan only

Docu to Check

XXXXXXX ... free basic plan only

MS workload name

XXXXXXX ... free basic plan only

summary for non-techies**

XXXXXXX ... free basic plan only

Direct effects for Operations**

Role-Based Access Control Implementation
Without proper preparation, the implementation of RBAC for EDM upload authorization may lead to unauthorized access or denial of access for legitimate users, causing disruptions in data management processes.
   - roles: Data Compliance Officer, IT Administrator
   - references: https://techcommunity.microsoft.com/t5/security-compliance-identity/introducing-role-based-access-control-for-exact-data-match/ba-p/3651230

User Experience Disruption
If the change is made without adequate training or communication, users may face confusion regarding their permissions, leading to frustration and decreased productivity as they navigate new access protocols.
   - roles: End User, Compliance Analyst
   - references: https://www.microsoft.com/en-us/microsoft-365/blog/2021/06/24/introducing-microsoft-purview-compliance-portal/

Configutation Options**

XXXXXXX ... paid membership only

IT Security**

XXXXXXX ... paid membership only

explanation for non-techies**

Imagine you're managing a large library. In this library, only certain people are allowed to bring in new books. Previously, you had a special group of librarians who were the only ones allowed to add books to the collection. This group was like a special club, and only they had the keys to the book storage room.

Now, think of Microsoft Purview's Exact Data Match (EDM) service as that library, and the books as sensitive data that needs to be uploaded securely. Previously, only members of a specific security group, like our special club of librarians, could upload this data. This was managed through something called the EDM_DataUploaders security group.

With the new change, you can now use something called Role-Based Access Control (RBAC) to decide who can upload data. It's like giving specific keys to different librarians based on their roles. For example, you might decide that any librarian with the title "Senior Librarian" can bring in new books, regardless of whether they're in the special club or not. This gives you more flexibility and control over who can perform this task.

In the context of Microsoft Purview, RBAC allows you to assign permissions based on roles rather than just group membership. This means you can tailor access more precisely to fit the needs of your organization, ensuring that only the right people have the authority to upload sensitive data. This approach can help streamline processes and enhance security by ensuring that permissions align closely with job responsibilities.