Microsoft Purview introduces a new Purview Agent Deployment role added to several built-in role groups, allowing analysts to deploy and manage Purview agents without admin help. Rollout starts late February 2026, improving onboarding and agent use while maintaining existing data access and compliance controls.

Microsoft introducing a new Microsoft Purview Role-Based Access Control (RBAC) roleāPurview Agent Deploymentāand adding it to several existing builtāin Purview role groups. This enhancement empowers analysts who work with Purview agents to deploy and manage them directly, without requiring administrator involvement. The change streamlines onboarding and supports broader adoption of Purviewās AIāpowered agent capabilities.
This update corresponds to Roadmap ID 551147.
Rollout Timeline
- General Availability (Worldwide): Begins late February 2026
- Expected Completion: MidāMarch 2026
Who is affected
- Administrators managing Purview role groups
- Analysts deploying or working with Microsoft Purview agents
Whatās changing
The new Purview Agent Deployment role will be added to the following builtāin role groups:
- Compliance Administrator
- Data Security Management
- Information Protection
- Information Protection Analysts
- Information Protection Investigators
- Insider Risk Management
- Insider Risk Management Analyst
- Insider Risk Management Investigator
- Purview Agent Management
The Purview Agent Management role group will continue to include the Purview Content Analyst role and retain access to Posture agent capabilities.
Capabilities enabled
Users assigned to these role groups will be able to deploy, use, and manage Purview agents endātoāend, including:
- Data Loss Prevention (DLP) ā Data Security Triage Agent
- Insider Risk Management (IRM) ā Data Security Triage Agent
- Data Security Posture Management (DSPM) ā Posture Agent
- Future Purview agents as they are released
Important:
- No default data access permissions are modified.
- No new visibility into customer content is introduced.
- Organizations can optionally enforce separation of responsibilities by using custom role groups.














