Purview roles and role groups: who can do what, and fixing portal permission errors

Most "I can't see it" tickets in Microsoft Purview aren't bugs: the account holds the wrong role, holds it in the wrong system, or holds it through an assignment that isn't active. In this post I'll explain how Purview role groups relate to Microsoft Entra roles, which role group common jobs need, and how to fix missing pages, read-only screens and permission messages.

Symptoms#

• A solution or page is missing, or opens without data, for one admin but works for another.
• Settings › Roles and scopes doesn't show Role groups at all.
• Content explorer lists the locations, but selecting one shows You must be a member of the following role groups to use content explorer.
• An admin can open DLP policies or sensitivity labels but can't create or edit them.
• An eDiscovery user can't find a case that a colleague created.
• Scoping an admin to an administrative unit changes nothing: they still see everything.
• Security & Compliance PowerShell connects, but a cmdlet then fails like this:

The term 'New-ComplianceSearch' is not recognized as the name of a cmdlet, function, script file, or operable program.

PowerShell 7 says "as a name of a cmdlet, function, script file, or executable program". If the connection itself fails, see my guide to Connect-IPPSSession errors.

Why it happens#

Purview uses role-based access control: a role allows a set of tasks, a role group bundles roles for a job, and you add users or security groups to role groups. To use the portal at all, an account must be a Global Administrator or a member of at least one role group. The confusion comes from four places.

Overlapping systems#

Several Microsoft Entra roles map to Purview role groups: Compliance Administrator, Compliance Data Administrator, Security Administrator, Security Operator, Security Reader and Global Reader each map to the role group with the same name, and Global Administrator maps to Organization Management and Purview Administrators, among others. The Security Administrator and Security Reader role groups can look empty because they inherit membership from the Entra role. Exchange Online role groups are a separate system that shares no membership or permissions with Purview, so mail flow rules are still delegated in the Exchange admin center.

Broad roles still have gaps#

The Compliance Administrator role group covers DLP, retention, holds, eDiscovery cases and information barriers, but not the content explorer viewer roles, which is why the content explorer message appears for people who "already have Compliance Administrator". Microsoft also notes that Compliance Administrator and Organization Management don't grant audit log search or Exchange-based reports on their own, because the underlying search cmdlet is an Exchange Online cmdlet.

Scope and activation#

• Administrative units. You can assign admin units to a member of a role group. If that person also holds an overlapping Entra role, such as Compliance Administrator or Global Reader, the Entra role takes precedence and their access is unscoped.
• Just-in-time access. An eligible Entra role does nothing until it's activated in Privileged Identity Management. For Purview role groups, just-in-time access works only through PIM for Groups (a security group assigned to the role group), not through direct user assignments.
• Expiring assignments. When a role group assignment's expiration date passes, access is removed without a notification.
• Case membership. An eDiscovery Manager can only access cases they created or are a member of. An eDiscovery Administrator can see every case and add themselves to it.

Which role group fits which job#

How to fix it#

1. Pin down the failing task. Note the account, the exact page or cmdlet, and whether the problem is "can't see", "can't edit" or "sees too much".
2. Check Entra roles first. In the Microsoft Entra admin center, open the user's Assigned roles, including eligible assignments that must be activated in PIM. Global Administrators can also see Entra role holders in the Purview portal under Settings › Roles and scopes, in the Microsoft Entra ID section.
3. Check Purview role groups. With an account that has the Role Management role (or Global Administrator), go to Settings › Roles and scopes › Role groups and open the role group to see its members. In PowerShell:
   PowerShell

   Connect-IPPSSession -UserPrincipalName admin@contoso.com
   Get-RoleGroup | Sort-Object DisplayName | Format-Table DisplayName, Name
   Get-RoleGroupMember -Identity "<Name from the list above>"

   Global Administrators are added to Organization Management automatically but don't appear in Get-RoleGroupMember output.
4. Add the least-privilege role group. Open the role group, select Edit, then Choose users or Choose groups. Optionally use Edit expiration or Assign admin units, then Next and Save. The PowerShell equivalents:
   PowerShell

   Add-RoleGroupMember -Identity "<Name>" -Member adele@contoso.com
   # eDiscovery Administrator: can see every case
   Add-eDiscoveryCaseAdmin -User adele@contoso.com

5. Remove scope conflicts. If an admin must be limited to an administrative unit, remove the overlapping Entra roles; otherwise the scoped assignment is silently overridden.
6. Handle the Exchange side separately. For audit search in the portal, add Audit Reader. For the audit cmdlets, mail flow rules or Exchange-based reports, assign the matching permissions in the Exchange admin center as well.
7. Start a fresh session. Have the user sign out and back in (a private browser window is a quick test). In PowerShell, reconnect, because the session's cmdlet list is built when you connect.

Verify the fix#

• In a new session, the page loads with data and the needed create or edit actions are available.
• Content explorer opens a location and lists items. File contents open only for members of Content Explorer Content Viewer, or of a role group that includes that permission, such as Information Protection Investigators.
• After reconnecting, Get-Command New-ComplianceSearch returns the cmdlet instead of an error.
• An admin scoped to an administrative unit holds no overlapping Entra role.

Prevent it next time#

• Grant solution role groups instead of Compliance Administrator or Global Administrator; Microsoft recommends the roles with the fewest permissions.
• Assign security groups to role groups (supported only in commercial cloud organizations), and use PIM for Groups when you want just-in-time access. My guide to Privileged Identity Management covers the Entra side.
• Use expiration dates, from one day to two years, for project access. eDiscovery Manager and eDiscovery Administrator don't support them.
• Keep a short matrix of who holds which Entra role, Purview role group and Exchange Online role group.
• Remember that the Defender portal has its own model; see Defender XDR unified RBAC errors. For solution-specific access, see eDiscovery cases and holds, audit log search and DSPM for AI.

References#

• Permissions in the Microsoft Purview portal
• Roles and role groups in Microsoft Defender for Office 365 and Microsoft Purview
• Assign permissions in eDiscovery