Microsoft Purview is continuing to improve how organisations delegate administrative responsibilities without compromising security. Roadmap ID 577187 introduces a new View-Only Device Management role for the device onboarding experience in Microsoft Purview Endpoint Data Loss Prevention (Endpoint DLP).
For organisations working towards least-privilege administration, this is a small but meaningful change.
The principle is simple: people who need visibility into device onboarding should not automatically need permission to manage it.
👉 What is Microsoft introducing?
According to the roadmap entry, Microsoft is developing a more granular approach to access the Devices page under:
Microsoft Purview → Settings → Device Onboarding
Previously, access to device onboarding and management has relied on broader administrative roles, depending on the operation being performed. These can include roles such as Compliance Administrator, Security Administrator and Global Administrator.
The new View-Only Device Management role is intended to let authorised users inspect device onboarding information without granting them permission to change onboarding configuration or other administrative settings.
The planned read-only capabilities include:
Viewing device onboarding status.
Searching for devices.
Reviewing device configuration details.
Exporting device data.
Existing administrative roles will retain their current level of access, so the change is designed to introduce more choice rather than disrupt established administrative workflows.
You can follow the announcement through Microsoft 365 Roadmap ID 577187.
👉 Why does this matter for Endpoint DLP?
Endpoint DLP depends on supported devices being onboarded and reporting the information needed for monitoring and protection. Administrators need to understand which devices are present, whether they are reporting correctly, and whether their configuration is healthy.
Microsoft’s device onboarding documentation explains how onboarding supports Endpoint DLP and Insider Risk Management, including the monitoring of sensitive information and potentially risky activity on endpoints.
However, not everyone who needs to review this information should be able to change the configuration.
Consider three common scenarios.
1. The security analyst
A security analyst needs to investigate whether a device is onboarded and reporting correctly before troubleshooting a potential DLP issue. They need visibility, not necessarily administrative control.
2. The internal auditor
An auditor needs evidence of device onboarding coverage and may need to export device information for an assurance review. Granting a broad administrative role simply to retrieve that information can create unnecessary privilege.
3. The compliance team
A compliance specialist needs to understand the state of endpoint protection as part of a wider review of data security controls. They should be able to inspect the relevant information without automatically gaining the ability to change onboarding settings.
In each scenario, read-only access is a better fit for the task.
Least privilege is about more than Global Administrator
Organisations rightly focus on reducing the number of Global Administrators. But least privilege is not achieved simply by removing Global Administrator from a few accounts.
It also means examining the everyday administrative tasks that require access to security and compliance platforms.
Ask yourself:
Does this person need to view information, change configuration, or both?
Is the role broader than the task requires?
Can the responsibility be delegated without giving away control of the underlying security settings?
Can access be reviewed and removed when the business need ends?
Roadmap 577187 supports this way of thinking by introducing a more specific access option for device onboarding visibility.
The wider lesson is that read-only access is a security control in its own right. It helps reduce unnecessary privilege while allowing the people responsible for assurance, investigation and reporting to do their jobs.
👉 What should administrators do now?
The feature is listed as In Development, with a preview planned for December 2026 and rollout scheduled to start in January 2027. These are planned dates and may change.
In the meantime, organisations can prepare by reviewing how device onboarding access is currently assigned.
1. Review existing role assignments
Identify who can access the device onboarding area and distinguish between people who administer devices and those who only need to inspect status or export information.
2. Identify opportunities to reduce privilege
Look for auditors, analysts and compliance staff who have been given broad roles solely to obtain device information.
Do not remove existing permissions until you have confirmed that the users’ other responsibilities are covered.
3. Define a read-only access model
Establish which teams need visibility, what information they require, and who should approve and periodically review that access.
4. Validate the new role during preview
When the feature becomes available, test the role in a controlled environment. Confirm the actual permissions, the scope of accessible data, export behaviour and whether any related pages or actions remain restricted.
Do not assume that the role grants access to every device-management function across Purview or Microsoft Defender; validate the documented scope.
👉 The bigger governance picture
This roadmap item may not introduce a new DLP detection capability or change how sensitive data is protected on endpoints. Its value is in how organisations manage access to the controls and information that support those protections.
Effective security governance requires both strong technical controls and appropriate administrative boundaries.
We need people to investigate, review and demonstrate that controls are working. We do not need to give every one of them the ability to change those controls.
💡 The Jim Talks takeaway
The goal is not simply to give fewer people administrator roles. It is to give every person the access they need – and no more than they need.
That is what practical least-privilege governance looks like.
References
Microsoft Purview Roadmap ID 577187
Microsoft Learn: Onboard Windows devices into Microsoft 365
Roadmap status and target dates are based on the published roadmap entry supplied for this article and may change.
Leave a Reply