azureblog.co.uk
← cd ~/roles
// roles/entra

Purview Workload Content WriterMicrosoft Entra built-in role

Read and edit data from Microsoft 365 when accessing from the Microsoft Purview portal.

Role ID02d5655b-c1cf-4e5f-98da-5fb919085bf6
PrivilegedNo
Permissions0

What it can do

No permissions listed.

Assign it

The role ID is the same in every tenant, so these work as they are. Make it eligible through PIM:

powershell13 lines
Connect-MgGraph -Scopes "RoleEligibilitySchedule.ReadWrite.Directory"
$user = Get-MgUser -UserId "jane.doe@contoso.com"
New-MgRoleManagementDirectoryRoleEligibilityScheduleRequest -BodyParameter @{
    Action           = "AdminAssign"
    Justification    = "Needs Purview Workload Content Writer for <reason>"
    RoleDefinitionId = "02d5655b-c1cf-4e5f-98da-5fb919085bf6"
    DirectoryScopeId = "/"
    PrincipalId      = $user.Id
    ScheduleInfo     = @{
        StartDateTime = (Get-Date).ToUniversalTime().ToString("o")
        Expiration    = @{ Type = "afterDuration"; Duration = "P180D" }
    }
}

Who already has it?

powershell3 lines
Connect-MgGraph -Scopes "RoleManagement.Read.Directory"
Get-MgRoleManagementDirectoryRoleAssignment -Filter "roleDefinitionId eq '02d5655b-c1cf-4e5f-98da-5fb919085bf6'" -ExpandProperty Principal |
    ForEach-Object { $_.Principal.AdditionalProperties.displayName }

Related roles

Find the smallest role for a task →