check before: 2026-02-15
Product:
Entra, Exchange, OneDrive, Purview, Purview Communication Compliance, Purview Insider Risk Management, SharePoint, Teams
Platform:
Online, World tenant
Status:
Change type:
Admin impact, Feature update, Updated message
Links:
Details:
Summary:
Microsoft Purview is updating role management by mapping certain Purview admin roles to new Microsoft Entra roles, synchronizing assignments automatically from mid-February to late March 2026. No customer action is needed, but new Entra roles will appear in audit logs and should not be assigned manually.
Details:
Updated February 17, 2026: We have updated the content. Thank you for your patience.
[Introduction]
To strengthen security when Microsoft Purview interacts with Microsoft 365 services (Exchange, SharePoint, OneDrive, and Teams), we're updating how roles are managed in Microsoft Purview. Certain admin roles in Purview will now be mapped to three newly created roles in Microsoft Entra. Role assignments will be synchronized between Purview roles and Entra roles without any customer action. This ensures that user permissions and identity flow securely from Purview to Microsoft 365. M365 services will only allow high-privileged operations like search/export to Purview users with the correct level of permissions in Entra, further protecting customer data.
[When this will happen:]
General Availability (Worldwide): Rollout begins mid-February 2026, finishes by late March 2026.
Change Category:
XXXXXXX ... free basic plan only
Scope:
XXXXXXX ... free basic plan only
Release Phase:
Created:
2025-12-19
updated:
2026-02-19
Task Type
XXXXXXX ... free basic plan only
Docu to Check
XXXXXXX ... free basic plan only
MS How does it affect me
XXXXXXX ... free basic plan only
MS Preperations
XXXXXXX ... free basic plan only
MS Urgency
XXXXXXX ... free basic plan only
MS workload name
XXXXXXX ... free basic plan only
summary for non-techies**
Microsoft is updating role management in Microsoft Purview by mapping certain admin roles to new roles in Microsoft Entra, enhancing security and ensuring seamless permission flow with Microsoft 365 services, with the transition occurring automatically between mid-February and late March 2026.
Direct effects for Operations**
Role Synchronization Issues
If the role synchronization from Purview to Entra fails, admins may not have the correct permissions, leading to potential access issues for critical operations.
- roles: Compliance Admin, Data Security Admin
- references: https://learn.microsoft.com/microsoft-365/compliance/
Audit Log Confusion
New Entra roles appearing in audit logs without prior notice may confuse admins, leading to misinterpretation of user permissions and potential security risks.
- roles: Compliance Admin, IT Security Manager
- references: https://learn.microsoft.com/microsoft-365/compliance/
Manual Role Assignment Errors
If admins attempt to manually assign new Entra roles, it may lead to overwriting of permissions, causing unauthorized access or denial of access to necessary resources.
- roles: Compliance Admin, Data Security Admin
- references: https://learn.microsoft.com/microsoft-365/compliance/
Configutation Options**
XXXXXXX ... paid membership only
Opportunities**
XXXXXXX ... free basic plan only
Potentional Risks**
XXXXXXX ... paid membership only
Data Protection**
XXXXXXX ... paid membership only
IT Security**
XXXXXXX ... paid membership only
Hypothetical Work Council Statement**
XXXXXXX ... paid membership only
DPIA Draft**
XXXXXXX ... paid membership only
explanation for non-techies**
XXXXXXX ... free basic plan only
** AI generated content. This information must be reviewed before use.
a free basic plan is required to see more details. Sign up here
A cloudsocut.one plan is required to see all the changed details. If you are already a customer, choose login.
If you are new to cloudscout.one please choose a plan.
change history
| Date | Property | old | new |
| 2026-02-19 | MC MessageTagNames | Feature update, Admin impact | Updated message, Feature update, Admin impact |
| 2026-02-19 | MC Summary | Microsoft Purview will map certain admin roles to new Microsoft Entra roles to enhance security and synchronize permissions automatically by March 2026. High-privileged Purview roles will correspond to three Entra roles, with no customer action needed. Do not assign these roles directly in Entra. | Microsoft Purview is updating role management by mapping certain Purview admin roles to new Microsoft Entra roles, synchronizing assignments automatically from mid-February to late March 2026. No customer action is needed, but new Entra roles will appear in audit logs and should not be assigned manually. |
| 2026-02-19 | MC Last Updated | 12/19/2025 00:40:28 | 2026-02-18T20:21:52Z |
| 2026-02-19 | MC Messages | [Introduction]
To strengthen security when Microsoft Purview interacts with Microsoft 365 services (Exchange, SharePoint, OneDrive, and Teams), we're updating how roles are managed in Microsoft Purview. Certain admin roles in Purview will now be mapped to three newly created roles in Microsoft Entra. Role assignments will be synchronized between Purview roles and Entra roles without any customer action. This ensures that user permissions and identity flow securely from Purview to Microsoft 365. M365 services will only allow high-privileged operations like search/export to Purview users with the correct level of permissions in Entra, further protecting customer data. [When this will happen:] General Availability (Worldwide): Rollout begins mid-February 2026, finishes by late March 2026. | Updated February 17, 2026: We have updated the content. Thank you for your patience.
[Introduction] To strengthen security when Microsoft Purview interacts with Microsoft 365 services (Exchange, SharePoint, OneDrive, and Teams), we're updating how roles are managed in Microsoft Purview. Certain admin roles in Purview will now be mapped to three newly created roles in Microsoft Entra. Role assignments will be synchronized between Purview roles and Entra roles without any customer action. This ensures that user permissions and identity flow securely from Purview to Microsoft 365. M365 services will only allow high-privileged operations like search/export to Purview users with the correct level of permissions in Entra, further protecting customer data. [When this will happen:] General Availability (Worldwide): Rollout begins mid-February 2026, finishes by late March 2026. |
| 2026-02-19 | MC Title | Microsoft Purview: Role management update | (Updated) Microsoft Purview: Role management update |
| 2026-02-19 | MC How Affect | Who is affected: All customers with admins assigned to high-privileged roles in Purview that access Microsoft 365 data. These admins will have their assignments synced to Entra, meaning they will be assigned membership to mapped Entra roles.
What will happen: New roles will be created in Entra to map to Purview roles listed below. Existing role assignments will sync automatically. New assignments will sync from Purview to Entra within 15 minutes. If an admin has multiple Purview roles, they will receive the highest privilege Entra role: Administrator > Writer > Reader. Customers may see new Purview-specific Entra roles in audit logs. Do not assign to these roles directly in Entra; Purview manages them. Role Mapping Table: Purview Role(s)Mapped Entra Role Insider Risk Management Analysis Insider Risk Management Investigation Compliance Search Export Privacy Management Admin Privacy Management Analysis Privacy Management Investigation Privacy Management Permanent Contribution Privacy Management Temporary Contribution Privacy Management ViewerPurview Workload Content Reader Hold Privacy Management InvestigationPurview Workload Content Writer Search and PurgePurview Workload Content Administrator Example: If you have both Export and Search and Purge roles, you'll get the Purview Workload Content Administrator role in Entra. | Who is affected: All customers with admins assigned to high-privileged roles in Purview that access Microsoft 365 data. These admins will have their assignments synced to Entra, meaning they will be assigned membership to mapped Entra roles.
What will happen: New roles will be created in Entra to map to Purview roles listed below. Existing role assignments will sync automatically. New assignments will sync from Purview to Entra within 15 minutes. If an admin has multiple Purview roles, they will receive the highest privilege Entra role: Administrator > Writer > Reader. Customers may see new Purview-specific Entra roles in audit logs. Do not assign to these roles directly in Entra; Purview manages them. Role Mapping Table: Purview Role(s)Mapped Entra Role Insider Risk Management Analysis Insider Risk Management Investigation Compliance Search Export Privacy Management Admin Privacy Management Analysis Privacy Management Investigation Privacy Management Permanent Contribution Privacy Management Temporary Contribution Privacy Management Viewer Data Security Investigation ReviewerPurview Workload Content Reader Hold Privacy Management Investigation Data Security Investigation InvestigatorPurview Workload Content Writer Search and Purge Data Security Investigation Admin Data Security Investigation Analyst (New Role)Purview Workload Content Administrator Example: If you have both Export and Search and Purge roles, you'll get the Purview Workload Content Administrator role in Entra. |
Last updated 2 days ago ago
