Microsoft Purview compliance portal: Admin assignment time limit

🚨 The Signal: Microsoft Purview now allows setting time limits for admin role assignments. This enables temporary, least-privilege access, reducing standing privileges and improving security posture against insider threats and account compromise.

The Impact

Security teams and Purview administrators are affected, reducing the risk of persistent excessive privileges.

• Security Teams: Reduced risk from over-privileged or compromised Purview admin accounts.
• Purview Administrators: Enforces time-bound access, improving security hygiene.
• Auditors: Provides clearer evidence of temporary administrative access controls.

The Action

1. Review existing Purview role group assignments for permanent administrative access.
2. When assigning new users/groups to Purview role groups, specify an appropriate time limit.
3. Establish an internal policy for maximum duration of temporary Purview admin assignments.
4. Regularly audit Purview role group assignments to ensure adherence to time limits.

Domain: Purview · Impact: high · Workload: Microsoft Purview · Essential Eight: Restrict Administrative Privileges · ISM: ISM-0445, ISM-1175, ISM-1380, ISM-1507, ISM-1508, ISM-1509, ISM-1647, ISM-1648, ISM-1650, ISM-1686, ISM-1688, ISM-1689, ISM-1883, ISM-1897, ISM-1898