Microsoft is adding a new Microsoft Purview RBAC role: Purview Agent Deployment. The role will also be added to several existing Purview built-in role groups.
This update allows analysts who work with Purview agents to deploy them directly, reducing administrator involvement and improving onboarding efficiency.
Timeline
The rollout should be completed in March 2026.
How does this affect your organization?
Microsoft will add the new Purview Agent Deployment role to the following Purview built-in role groups:
- Compliance Administrator
- Data Security Management
- Information Protection
- Information Protection Analysts
- Information Protection Investigators
- Insider Risk Management
- Insider Risk Management Analyst
- Insider Risk Management Investigator
- Purview Agent Management
With the introduction of the Purview Agent Deployment role, organizations can now enforce a clear separation of duties across Purview agent administration, agent analysis, and agent deployment.
There are now three Purview Agent roles. Review the Purview RBAC overview to understand which roles are included in each role group.
- Purview Agent Management
Designed for Purview agent administrators responsible for enabling, configuring, and managing AI agents within Purview compliance solutions. This role group includes the Purview Content Analyst and the new Purview Agent Deployment role. - Purview Agent Analysis
Designed for compliance analysts who work directly with the output and behavior of Purview AI agents. Users with this role can customize agent settings (such as adjusting alert timeframes and trigger conditions) and review the data and insights that agents produce. This role does not include the new Purview Agent Deployment role. - Purview Agent Deployment (NEW)
Designed for analysts who need to deploy Purview agents without requiring administrator involvement. This role improves onboarding efficiency and supports broader adoption of Purview’s AI-powered agent capabilities across compliance teams.
Members assigned to the Purview Agent Management role group or Purview Agent Deployment role have permissions to deploy the Data Security Triage Agent DLP (for Data Loss Prevention), the Data Security Triage Agent IRM (for Insider Risk Management), the Data Security Posture Agent DSPM (for Data Security Posture Management), and upcoming Purview agents.
Organizations should review their existing role assignments and update custom role groups to include the new Purview Agent Deployment role.
