Microsoft Purview: Endpoint Data Loss Prevention-View-only access to device onboarding with the View-Only Device Management role
Microsoft Purview Data Loss Prevention is introducing more granular, role-based access to the Devices page under Settings → Device Onboarding. Previously, viewing or managing device onboarding required broad administrative roles (such as Compliance Administrator, Global Administr
DIGITAL SKILL WORKS LTD / 12 PANES
What it is
Microsoft Purview: Endpoint Data Loss Prevention-View-only access to device onboarding with the View-Only Device Management role is a Microsoft 365 roadmap item published via Microsoft Release Communications. Current status: In development.
What it does
Microsoft Purview Data Loss Prevention is introducing more granular, role-based access to the Devices page under Settings → Device Onboarding. Previously, viewing or managing device onboarding required broad administrative roles (such as Compliance Administrator, Global Administrator, or Security Administrator). With this update, organizations can grant access using least-privilege Purview role-based access control (RBAC) roles scoped specifically to device operations. A new View-Only Device Management role enables users, such as auditors or security analysts, to view device onboarding status, search for devices, review configuration details, and export device data, without granting permission to change onboarding configuration or other administrative settings. Existing administrative roles continue to have full access, so current workflows are unaffected. This change helps organizations follow the principle of least privilege and simplifies granting read-only visibility into device onboarding without over-provisioning permissions.
Why you should care
Board
Security/compliance control — fund Steady before more seats.
CISO
Prioritise as Steady control; wire into IR and GRC evidence paths.
CFO
Map licence or consumption impact to the frozen value case; avoid seat spray.
Adoption
Pilot with a named cohort and measure changed work, not vanity clicks.
Suggested action
Wave 0 first: Security → GRC → Cost & Value → Licence → Adoption. Add to Horizon watchlist with an owner. Pilot only after Steady controls for the affected surface are in place.
12 Panes: 03 Horizon · 04 Security · 05 GRC · 08 Adoption
Communication needed
- Security: Lead review; confirm control mapping before enablement.
- GRC: Update AI/agent register and evidence path; confirm DPIA triggers if personal data is in scope.
- FinOps: Forecast seat or credit impact; align to frozen value case.
- Adoption: Plan cohort messaging, clinics, and success measures.
- Comms: One story for board and staff — what changes, what does not, who owns risk.
Benefits
- May improve productivity on a specific Microsoft 365 surface when permissions and data quality allow.
- Roadmap visibility helps Horizon planning without guessing dates.
Risks
- Status and dates change; treat MRC as directional, not a contract.
- Enabling without Steady controls can amplify overshare or cost leakage.
- Preview or rolling features can change behaviour; fence exploration on Pane 12 Frontier.
Source
- MRC id: 577187
- Status: In development
- Products: Microsoft Purview
- GA / disclosure: January CY2027
- Preview: December CY2026
- Platforms: Web
- Cloud instances: Worldwide (Standard Multi-Tenant)
- moreInfoUrls: —
- Open on Microsoft 365 Roadmap
Microsoft Release Communications / Microsoft 365 Roadmap (AI at Work). Content is subject to Microsoft API Terms of Use. Dates and status change; verify in the official roadmap before acting.