Skip to main content
← back to extensions

Purview

@dougschaefer/purviewv2026.08.05.2· 1d agoMODELSWORKFLOWS
01README

Microsoft Purview compliance-portal RBAC — role groups, their constituent management roles, membership, and the eDiscovery Administrator list, over Security & Compliance PowerShell. Exists because eDiscovery permission is invisible from Entra: Global Administrator maps to OrganizationManagement, which carries Case Management, Compliance Search, Hold and Search And Purge but not Export, Preview, Review, RMS Decrypt or Custodian, so a tenant admin can run a search yet be unable to export a single item. auditPrincipals separates canSearch from canExport and flags eDiscovery Administrators, who can open every case in the tenant. Carries its own credential surface because the compliance endpoint rejects Azure CLI tokens regardless of user.

02Release Notes

First public release. Resolves eDiscovery capability that Entra cannot show: Global Administrator maps to OrganizationManagement, which grants Case Management, Compliance Search, Hold and Search And Purge but not Export, Preview, Review, RMS Decrypt or Custodian, so auditPrincipals separates canSearch from canExport and flags eDiscovery Administrators. Adds listCases, a search-only IPPSSession so Start-ComplianceSearch can run, and display-name normalization so shared mailboxes stop reporting false negatives.

03Models1
@dougschaefer/purview-rbacv2026.08.05.2purview/rbac.ts
fn syncRoleGroups()
Sweep every Purview role group with its management roles and membership in one session, flagging which grant eDiscovery capability and which grant evidence egress (Export / RMS Decrypt / Preview). Fan-out by design: one PowerShell connection produces the whole RBAC picture rather than one call per group.
fn listCaseAdmins()
List the eDiscovery Administrators — the tier that can open every case in the tenant, including cases they were never assigned to.
fn auditPrincipals()
Resolve what each supplied principal can actually do in eDiscovery: which role groups contain them, the union of management roles that yields, and crucially whether that adds up to search-only or search-plus-export. Distinguishes canSearch (Compliance Search / Case Management) from canExport (Export / RMS Decrypt / Preview), because Global Administrator grants the former and not the latter.
fn listCases()
List eDiscovery (compliance) cases with their status, so a search or hold can be attached to the exact case name Purview holds rather than a paraphrase of it.
fn placeCustodianHold(holdName: string)
Place a preservation hold on custodian mailboxes within an eDiscovery case (New-CaseHoldPolicy + New-CaseHoldRule). Deliberately preserves the FULL mailbox with no content query by default: a query-scoped hold only preserves what the query happened to match, so any later refinement of the search terms cannot recover what was deleted in the meantime. Holds are preservative and reversible; they never delete. In eDiscovery Standard placing a hold does NOT notify the custodian.
ArgumentTypeDescription
holdNamestringName for the hold policy
fn runComplianceSearch(searchName: string, contentQuery: string)
Create a content search inside an eDiscovery case, start it, and poll until it completes, returning hit counts and size. Read-only against custodian data — it reports what matches and never previews, exports, or alters content. Dates in KQL are evaluated in UTC, so pass boundaries already offset if the intended window is local.
ArgumentTypeDescription
searchNamestringName for this search
contentQuerystringKQL content query
fn addRoleGroupMember(roleGroup: string, member: string)
Add a principal to a Purview role group. Use eDiscoveryManager to grant the Export / Preview / Review / RMS Decrypt set that Global Administrator alone does not provide.
ArgumentTypeDescription
roleGroupstringRole group name, e.g. eDiscoveryManager
memberstringUPN of the principal to add
fn removeRoleGroupMember(roleGroup: string, member: string)
Remove a principal from a Purview role group. Verify current membership with auditPrincipals before running this.
ArgumentTypeDescription
roleGroupstringRole group name, e.g. eDiscoveryManager
memberstringUPN of the principal to remove

Resources

roleGroup(infinite)— Purview role group with its roles and membership
principalAccess(infinite)— Effective Purview eDiscovery capability for one principal
caseAdmin(infinite)— eDiscovery Administrator (sees every case in the tenant)
04Workflows1
@dougschaefer/ediscovery-access-audit5cb40580-1cad-4883-a60e-0f40df66d0ab

Answer "what can this person actually do in eDiscovery?" across both layers that decide it, for any set of principals. Entra directory roles alone are not the answer: Global Administrator maps to the Purview OrganizationManagement role group, which carries Case Management, Compliance Search, Hold and Search And Purge but NOT Export, Preview, Review, RMS Decrypt or Custodian — Compliance Administrator is missing the same four, and only the eDiscoveryManager role group holds them. A tenant admin c

auditCapture the Entra and Purview halves of eDiscovery capability for the supplied principals.
1.entra-directory-rolesentra-users.auditDirectoryRoles— Resolve effective directory roles for each principal — direct assignments plus any inherited through a role-assignable group, which a principalId-filtered roleAssignments query never returns.
2.purview-role-groupspurview-rbac.syncRoleGroups— Snapshot every Purview role group with its management roles and membership, flagging which grant eDiscovery capability and which grant evidence egress.
3.purview-principal-accesspurview-rbac.auditPrincipals— Per principal, resolve role-group membership to effective management roles and record canSearch separately from canExport.
4.ediscovery-case-adminspurview-rbac.listCaseAdmins— List eDiscovery Administrators — the tier that can open every case in the tenant, including cases they were never assigned to. Captured for the whole tenant, not just the audited principals, because this is the membership most often granted once and never reviewed.
05Previous Versions1
2026.08.05.1

Initial release: Purview compliance-portal RBAC with eDiscovery capability auditing that separates search from evidence export.

06Stats
A
100 / 100
Downloads
0
Archive size
21.2 KB
  • Has README or module doc2/2earned
  • README has a code example1/1earned
  • README is substantive1/1earned
  • Most symbols documented1/1earned
  • No slow types (deprecated)1/1earned
  • Dependencies pass trust audit2/2earned
  • Has description1/1earned
  • Platform support declared (or universal)2/2earned
  • License declared1/1earned
  • Verified public repository2/2earned
Repository
https://github.com/dougschaefer6/swamp-purview
07Platforms
08Labels
#purview#compliance#ediscovery#m365#rbac#identity#security#audit#governance#exchange