New Entra admin roles for Microsoft Purview, managed through Purview role assignments 

Microsoft is rolling out three new Entra admin roles for Microsoft Purview to strengthen security when Purview interacts with Microsoft 365 services such as Exchange, SharePoint, OneDrive, and Teams.

• Purview Workload Content Reader
• Purview Workload Content Writer
• Purview Workload Content Administrator

The key point of these new roles is that Microsoft explicitly notes an admin should not directly assign them to users. These roles are managed through Purview role assignments. Any manual assignment in Entra will be overwritten by Purview.

Do not manually assign these roles in Entra; Purview will overwrite changes.

After the rollout, specific Microsoft Purview roles are linked to these three Entra admin roles (see the table below). It is important to understand the Entra role itself is not linked to Purview; instead, the account assigned to a Purview role receives the corresponding Entra role.
This is particularly interesting because, if you are already using Purview roles, you may have noticed role permission updates usually take up to 24 hours. For the new Entra roles, Microsoft notes new assignments should sync from Purview to Entra within 15 minutes.

Timeline

These new admin roles should be available by the end of March 2026, although you may already find them in Entra.

Updated 17 April 2026:
The rollout should be completed in May 2026.

Updated 14 May 2026:
Microsoft began assigning new Purview workload admin roles to Entra ID user accounts.

Purview role mapping with Entra admin roles

Microsoft has published a Purview role mapping table. The Purview roles are listed and described here.
As an example, if your account has the Purview role “Privacy Management Investigation”, you will automatically receive the Purview Workload Content Writer role in Entra. If an account has multiple Purview roles, it will receive the highest privilege Entra role in the following order: Administrator > Writer > Reader.