24.2 Manage Roles and Permissions for DSPM for AI

Manage Roles and Permissions for DSPM for AI

Quick Answer: Give operators Microsoft Entra Compliance Administrator or the Microsoft Purview Compliance Administrator role group when they must complete Get started and recommendations. Give investigators Content Explorer Content Viewer or Purview Data Security AI Content Viewer before they can read AI prompts and responses. Use Insider Risk Management Analyst or Investigator for user risk level and AI website-visit events. Do not use Global Administrator just to open DSPM for AI.

SC-401 does not treat DSPM for AI permissions as “anyone in Compliance Administrator can do everything on the page.” Microsoft publishes an activity-by-activity matrix. The exam will pair a job (create a data risk assessment, read a Copilot prompt, see whether someone visited ChatGPT) with the additional role that the matrix requires.

Assign roles in the portal that owns them: Purview role groups, Microsoft Entra roles, and Exchange Online roles when audit activation is involved. Microsoft’s standing guidance is to use roles with the fewest permissions and to minimize Global Administrator.

Full management versus view-only

Roles and role groups that can view, create, and edit in DSPM for AI (classic):

• Microsoft Entra Compliance Administrator
• Microsoft Entra Global Administrator (works; avoid for daily operations)
• Microsoft Purview Compliance Administrator role group

Roles and role groups that are view-only in DSPM for AI:

• Microsoft Purview Security Reader role group
• Purview Data Security AI Viewer role
• AI Administrator role from Microsoft Entra
• Purview Data Security AI Content Viewer role for AI interactions only

View-only identities can open Overview, read recommendation cards, read Reports graphs, view the Apps and agents page, and view data risk assessment summaries. They cannot complete Get started actions, complete recommendation cards, or create data risk assessments. If the scenario is a security analyst who should see posture but must not turn on one-click policies, Security Reader or Data Security AI Viewer is the documented fit — not Compliance Administrator.

Purview Data Security AI Content Viewer is easy to over-assign. It is not a general DSPM reader. Microsoft documents it for AI interactions only. Someone who only needs dashboards does not need it; someone who must read prompt and response text does.

Permissions by activity (what the exam actually tests)

The following behaviors are from Microsoft’s DSPM for AI (classic) permissions table. ✓ means the management roles (Entra Compliance Administrator, Entra Global Administrator, Purview Compliance Administrator) can do it unless a footnote says otherwise. View-only means Security Reader, Data Security AI Viewer, and Entra AI Administrator unless noted.

Read that table twice. The most common SC-401 trap is assuming Compliance Administrator can open Copilot prompt text. It cannot. Prompt and response content is a content explorer privilege, the same family of permission used to view the actual classified item in Content explorer. A second trap is assuming Global Administrator magically reveals user risk level. It does not. Risk level is an Insider Risk Management analyst/investigator capability.

Activate Audit is an Exchange-shaped exception

When Get started says Activate Microsoft Purview Audit and the operator is in the Purview Compliance Administrator role group, that operator cannot complete the Activate Audit action from DSPM for AI. Microsoft routes that action through Exchange Online compliance roles: Compliance Management, Records Management, or Organization Management. Viewing whether audit is on has its own Exchange view-only set (View-Only Organization Management, Hygiene Management, plus the same management roles).

In practice, many tenants already have audit on, so the Get started card is already complete. The exam still likes the exception because it separates “I can administer Purview DLP” from “I can enable the unified audit log.”

Custom role groups

You do not have to use the built-in groups. You can grant DSPM for AI access by putting Microsoft Purview Compliance Administrator into a custom role group. For read-only, include Microsoft Purview Security Reader, Purview Data Security AI Viewer, or the Entra AI Administrator role.

Custom groups are not identical to built-in groups:

• A custom group that includes Compliance Administrator matches the built-in Compliance Administrator DSPM access except it cannot create, view, update, or delete Insider Risk Management and Communication Compliance policies.
• A custom group that includes Security Reader, Data Security AI Viewer, or Entra AI Administrator matches Security Reader DSPM access except it cannot view information protection policies.

If a one-click recommendation created DSPM for AI - Detect risky AI usage (Insider Risk Management) or DSPM for AI - Unethical behavior in AI apps (Communication Compliance), operators who only have a custom Compliance Administrator group will be blocked from managing those policies inside the owning solutions. Assign the IRM or Communication Compliance role groups for that work.

Least privilege patterns that map to exam scenarios

Use these staffing patterns rather than adding Global Administrator.

1. DSPM operator (turn on policies, create assessments): Entra Compliance Administrator or Purview Compliance Administrator role group. Add Exchange roles only if they must activate audit. They still cannot read prompts.
2. AI interaction reviewer (read prompts and responses): add Content Explorer Content Viewer or Purview Data Security AI Content Viewer. This is the privacy-sensitive assignment; treat it like permission to read mail and files, because that is what prompt text is.
3. Oversharing file reviewer: add Content Explorer Content Viewer and Content Explorer List Viewer to see file details inside data risk assessments.
4. Insider-risk investigator: Insider Risk Management Analyst or Investigator for AI Visit events, user risk level, and the link into IRM user details.
5. Communication-compliance reviewer: Communication Compliance Administrator to see Unethical Behavior card status and to remediate matches in Communication Compliance — DSPM only links you there.
6. Executive reader: Security Reader or Data Security AI Viewer. They can watch Reports and Apps and agents without creating policies.

Administrative units still apply. A restricted AU admin with Compliance Administrator can complete actions only in scope and cannot create the org-wide one-click policies. Permissions and AU scope are separate gates; both must pass.

Scenario: the Copilot investigation that “has no text”

Contoso’s information security administrator is in the Purview Compliance Administrator role group. Activity explorer shows AI interaction events for Microsoft 365 Copilot. The flyout lists the user, time, app category, and sensitive information types, but the prompt and response fields are empty for that admin. A colleague in Content Explorer Content Viewer can see the text on the same events.

Nothing is wrong with auditing. The first administrator is missing the content viewer assignment. Granting Global Administrator would still not be the documented way to reveal prompt text. Grant Content Explorer Content Viewer or Data Security AI Content Viewer, and only to people who are allowed to read AI content.

Scenario: risk level stays blank

The same Compliance Administrator opens an AI interaction and expects to see the user’s Insider Risk Management risk level because DSPM created DSPM for AI - Detect risky AI usage. Microsoft documents that Sensitive info types events do not display user risk level as a known issue, and that viewing risk level on activity explorer events requires IRM Analyst or Investigator in any case. Do not troubleshoot this as a missing Copilot license.

Official reference: Permissions for DSPM for AI (classic).