It isn't available yet. The roadmap lists it as In development, with preview targeted for December 2026 and general availability for January 2027. It's a web portal feature, and the listed cloud is Worldwide (Standard Multi-Tenant) only. Microsoft's roadmap dates can move, so treat both months as estimates.
What the roadmap says the role will do
According to roadmap item 577187, someone with View-Only Device Management will be able to:
- See onboarding status for each device
- Search the device list
- Review configuration details for each device
- Export device data
The same entry says the role won't let users change onboarding configuration or other administrative settings. Microsoft names auditors and security analysts as the intended users. Existing administrative roles keep full access, so Microsoft says current workflows won't change.
The roadmap describes the role as least-privilege Purview role-based access control (RBAC) scoped to device operations. Today, the same page is mostly reserved for broad admin roles such as Compliance Administrator, Global Administrator and Security Administrator.
Summary: This is a planned read-only role for the Endpoint DLP Devices page. It includes export, and preview is targeted for December 2026.
Why the Devices page matters
The page is more than a setup screen. Microsoft's onboarding documentation says Endpoint data loss prevention (Endpoint DLP) and insider risk management require that Windows 10 and Windows 11 devices be onboarded into the service so that they can send monitoring data to the services. A PC that doesn't appear there isn't sending Endpoint DLP data. If you want to know whether DLP policies actually reach your fleet, this is where you look.
The page is also shared with Microsoft Defender for Endpoint (MDE). Microsoft says devices already onboarded to MDE show up in Purview's managed-device list, and onboarding a device through Purview also onboards it to MDE. One Microsoft Q&A answer adds a practical detail: if your devices are already onboarded to Microsoft Defender for Endpoint, enabling device onboarding in Purview will automatically make them appear in Purview. There is currently no way to sync only a subset of those already-onboarded devices.
Microsoft's documentation says admins use the Devices page to track Configuration status and Policy Sync status. Onboarded devices stay listed for 180 days after they go offline. That history is useful to an auditor reviewing coverage over time, and it's also data you might not want leaving the tenant casually. That point matters because the new role includes export.
Summary: The Devices page shows whether Endpoint DLP is deployed and syncing across the fleet, which is why auditors want read access.
Current documentation says Purview roles don't apply here
Microsoft's current onboarding documentation conflicts with the roadmap. The permissions section says: "Device management currently only supports Entra roles. Purview roles are not supported."
Here is what that documentation currently lists:
| Task | Required Microsoft Entra role (any one) |
|---|---|
| Enable device management | Security admin, Compliance admin, Global admin |
| View device management settings | Compliance admin, Compliance data admin, Global reader, Security admin, Global admin |
| Access the onboarding/offboarding page | Compliance admin, Security admin, Global admin |
| Turn device monitoring on/off | Compliance admin, Security admin, Global admin |
Microsoft's general roles and role groups reference already includes View-Only Device Management among Purview roles. So the role exists in the catalog. The documentation doesn't show that it currently opens the Device Onboarding page, and the onboarding page's warning is the more specific guidance. Until Microsoft updates that page or the preview reaches your tenant, assume the Entra role table above still applies.
The table shows why this change matters. Today, read-only access to device management settings usually means Global reader. That role is the read-only version of Global Administrator and can see settings across Microsoft 365. Giving an auditor Global reader just to check DLP onboarding gives them far more access than the job needs. Global reader also isn't listed for the onboarding/offboarding page itself. View-Only Device Management is meant to cover that gap without the extra exposure.
Summary: Today this area works with Entra roles only. The new role should eventually replace awkward workarounds such as Global reader, but you can't count on it until rollout.
Entra roles override Purview scoping
Microsoft's Purview permissions guidance has a warning that matters for anyone testing this role. Microsoft recommends that you use roles with the fewest permissions, but least privilege only works if the user doesn't already hold something broader. When a user has both an Entra role and a scoped Purview role group assignment, Microsoft says the Entra role wins at runtime. For overlapping capabilities, the user's effective access is then unscoped.
If you give an analyst View-Only Device Management while they still hold Security admin or Compliance admin in Entra, they still have the broader admin access. A new role only reduces access if you also remove the old one. Check Entra assignments as well as Purview role groups.
How to prepare before December
None of the steps below depend on the new role existing yet. They use controls Microsoft documents today.
- List who can see the Devices page now. Check Entra assignments for Compliance admin, Compliance data admin, Global reader, Security admin and Global admin. Mark anyone who has one of these only so they can view onboarding status.
- Find the people who only need to read. Internal audit, governance reviewers and SOC analysts who check DLP coverage are the likely candidates.
- Know where Purview role groups are managed. Microsoft documents this under Settings → Roles and scopes → Role groups in the Purview portal. You need the Role Management role, which by default belongs only to the Organization Management role group, or Global Administrator.
- Plan expiring assignments for audits. Purview role group assignments can expire automatically. Microsoft documents a minimum of one day and a maximum of two years. Microsoft also says no notification is sent before the permission expires, so tell auditors when their access will end.
- Test in preview before removing anything. When the role reaches your tenant, use a test account with no Entra admin roles. Confirm it can view, search and export, and confirm it can't turn device onboarding on or off, download onboarding packages, or offboard devices. Remove the old Entra role only after that test passes.
- Decide what to do about export. The roadmap includes export in the role. View-only still lets data leave the portal, so decide whether that fits your data-handling rules for device inventory.
What Microsoft hasn't said yet
The roadmap and current documentation don't answer these questions:
- Whether the December preview is public or limited to some tenants
- Which default role group, if any, will include the role, or whether you'll need a custom role group
- Whether it can be scoped to administrative units
- What exactly the export contains
- Whether it covers anything beyond the onboarding Devices page
- Whether GCC, GCC High or DoD tenants are planned; only Worldwide is listed
Don't guess at these from the role name. Watch the Message Center and the onboarding documentation's permissions section. The "Purview roles are not supported" warning should change once the role is live.
Bottom line
This is a small permissions change, but it fixes a real problem. Seeing whether Endpoint DLP reaches every Windows PC shouldn't require a role that can also turn device monitoring off. If preview arrives in December 2026, check who has access now, test the new role with an account that has no Entra admin roles, and remember that "view-only" still includes export.