How to create custom role in Purview for Data Loss Prevention?

Question

I have 2 DLP policies configured, Policy #1 for HR and Policy #2 for Finance.

May I know how to create 2 custom role where:

• Role #1 can only view/manage Policy #1 and alerts generated by Policy #1.
• Role #2 can only view/manage Policy #2 and alerts generated by Policy #2.

Answer 1

Hi @Ng Yin Fai

Thanks for the question and using MS Q&A platform.

Unfortunately, there is no option to create custom roles in Microsoft Purview.

Appreciate if you could share the feedback on our feedback channel. Which would be open for the user community to upvote & comment on. This allows our product teams to effectively prioritize your request against our existing feature backlog and gives insight into the potential impact of implementing the suggested feature.

The Microsoft Purview governance portal uses a set of predefined roles to control who can access what within the account. These roles are currently:

Reference: How can we design Microsoft Purview built-in roles?

However, you can manage access to resources, including Data Loss Prevention (DLP) policies and alerts, using Azure role-based access control (RBAC) and the built-in roles available for Purview.

To manage access to your DLP policies (Policy #1 for HR and Policy #2 for Finance), you can utilize the following built-in roles:

Purview Data Reader: This role allows users to view data and metadata, which may be suitable for users who need to see the DLP policies without making changes.

Purview Data Curator: This role allows users to manage data sources and classifications, which may be necessary for users who need to manage DLP policies.

Purview Data Source Administrator: This role allows users to manage data sources and their configurations, which may be relevant depending on your specific needs.

Assign the appropriate built-in roles to users or groups based on their responsibilities related to Policy #1 and Policy #2. While you cannot create custom roles, you can control access through these built-in roles.

Use Azure RBAC: If you need more granular control, consider using Azure RBAC to manage access to resources in Azure, including Microsoft Purview. This allows you to assign roles at the subscription, resource group, or resource level.

For more details, refer to: Access control in the Microsoft Purview governance portal.

Hope this helps. Do let us know if you have any further queries.

---

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.