InformationProtectionAdmins role grants Content Explorer content viewing without Content Explorer Content Viewer role

Hi @Hernán Velasco
Thanks for providing the detailed role assignments.

Based on the documentation, membership in Information Protection Administrators should provide access to Content Explorer, while viewing the actual content of items is expected to require the Content Explorer Content Viewer permission.

Since the user is also assigned the Purview Workload Content Administrator Entra ID role through the Purview RBAC migration process, it is possible that this role (or another inherited permission) is contributing to the content-viewing capability. However, Microsoft documentation does not clearly state that this role independently grants Content Explorer content-view permissions.

At this point, it would be difficult to determine whether the behavior is by design or the result of permission inheritance without product team confirmation.

For your second question, the recommended approach is to use the principle of least privilege and assign only the specific Purview role groups required for DLP and auto-labeling administration. If content viewing remains available despite the absence of the Content Explorer Content Viewer role, I recommend opening a Microsoft support case so the product team can verify the effective permissions and confirm whether the observed behavior is expected.

Could you also confirm whether removing the Information Protection Administrators role group (while retaining the other assignments) changes the behavior? That information would help narrow down which role is granting the content-view capability.

"Thank you for the response. However, my question is specifically about observed behavior that contradicts the documentation. In our tenant, a user assigned to InformationProtectionAdmins and other IP role groups — but NOT to Content Explorer Content Viewer — CAN view document contents in Content Explorer. The user also has the Entra ID role 'Purview Workload Content Administrator' automatically assigned by PurviewRoleAssignmentMigrator. We need to understand whether this automatic Entra ID role assignment is what grants content viewing, as it would make the documented separation of duties ineffective."