How to Export Microsoft Purview Permissions (RBAC Roles) Easily

Introduction

Recently, someone asked me if I had any way to export Microsoft Purview Role-Based Access Control (RBAC) roles with their assigned members. I didn’t have anything ready at hand, and after a quick Google, I couldn’t find any easy solution online.

Since I’ve been upskilling myself on PowerShell, I decided to give it a go and write a script that does exactly what I wanted. Sharing it here in case it helps others too.

Table of Contents

What is Purview RBAC?

The Script

Conclusion

What is Purview RBAC?

Microsoft Purview RBAC (Role-Based Access Control) defines who can do what in your Purview environment. Roles like eDiscovery Manager, Content Explorer Content Viewer, Data Reader, Data Curator, or Collection Administrator give different permissions to users.

If you’re new to Purview permissions, check out my previous post: Microsoft Purview permission guide - it’s a great intro.

Export Microsoft Purview RBAC Roles with PowerShell

I’ve just launched my GitHub page (https://github.com/welkasworld), and the script is available in my Purview repository. This script:

• Connects to your Purview instance

• Lists all RBAC roles directly in the PowerShell output window for quick viewing

• Shows members assigned to each role

• Exports everything to an Excel file

I plan to make more scripts publicly available, so this is just the start.

You can grab the script directly from this link or copy the one below.

NOTE: It’s worth noting that Microsoft Purview does not currently have a dedicated PowerShell module that targets only the Purview portal. When you work with roles and permissions through PowerShell, you’re actually interacting with Exchange Online and the Security & Compliance endpoint behind the scenes. This is why you’ll typically see Connect-ExchangeOnline and Connect-IPPSSession used together. While you can apply the principle of least privilege by assigning a custom Exchange RBAC role such as View-Only Configuration or View-Only Role Management, this alone won’t provide visibility into all Purview role groups and permissions. To retrieve a complete and accurate list of roles, role groups, and members, the account must be able to connect to both modules and hold permissions that extend beyond what is visible in the Exchange admin center.

Conclusion

Exporting Microsoft Purview RBAC roles doesn’t have to be tedious. With a simple PowerShell script, you can quickly audit roles, see who has access, and keep control over your environment.

References:

• https://learn.microsoft.com/en-us/powershell/exchange/scc-powershell?view=exchange-ps

• https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/get-user?view=exchange-ps

• https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/get-rolegroup?view=exchange-ps

• https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/get-rolegroupmember?view=exchange-ps