Microsoft Purview: Endpoint Data Loss Prevention-View-only access to device onboarding with the View-Only Device Management role Beta
Data as of 2 hours ago (26 October 2026)
Description
Microsoft Purview Data Loss Prevention is introducing more granular, role-based access to the Devices page under Settings → Device Onboarding. Previously, viewing or managing device onboarding required broad administrative roles (such as Compliance Administrator, Global Administrator, or Security Administrator). With this update, organizations can grant access using least-privilege Purview role-based access control (RBAC) roles scoped specifically to device operations. A new View-Only Device Management role enables users, such as auditors or security analysts, to view device onboarding status, search for devices, review configuration details, and export device data, without granting permission to change onboarding configuration or other administrative settings. Existing administrative roles continue to have full access, so current workflows are unaffected. This change helps organizations follow the principle of least privilege and simplifies granting read-only visibility into device onboarding without over-provisioning permissions.
Change history
Added to the roadmap 20 October 2026. Tracked here since 21 October 2026. Earliest target we recorded: January 2027 (since tracked — Microsoft may have moved it before we started watching).
Nothing has changed on this item since tracking began on 21 October 2026. Changes appear here as Microsoft updates the feed.