"You’ve been added as a reviewer in a Microsoft Purview communication compliance policy"

J-3804 1,596

Hi team,

Could you please let me know why I got the following notification "You’ve been added as a reviewer in a Microsoft Purview communication compliance policy"

Thank you for your help

Tim Wrinkle 0 Reputation points

2023-09-22T13:35:47.19+00:00

This has also happened to all global admins at my company @ 12am. None of us assigned the role to anyone at that time.
Jarvis Sun-MSFT 10,196 Reputation points Microsoft Vendor

2023-10-05T01:57:54.97+00:00

I wanted to follow up and know if the below responses helped in answering your query. If it did, please do not forget to accept the appropriate response as Answer so that others in the community facing similar issues can easily find the solution.
KimYunek-2481 0 Reputation points

2024-02-28T12:35:08.1866667+00:00

Has anyone received an answer to the real question here. Mine was triggered this morning (Feb 2024) from one of our Break Glass accounts. It does not appear anyone has logged in with them and I have not (I am the only one with the passwords right now as well). So what triggered this message?

7 answers

Dennis Schierenbeck 20 Reputation points

2023-09-22T08:06:41.3633333+00:00

Hi Jennifer,

We have also received the message. I think your question was not what the message means (this is clear), but what triggered it. In our case, it says that the authorisation was granted by the first Global Admin in the organisation (but he has definitely changed).

I currently assume that this authorisation was automatically assigned by Microsoft and that the first global administrator is always entered as the author.

However, confirmation from Microsoft of this theory would be helpful.
Please sign in to rate this answer.

4 people found this answer helpful.
Michael Larrivee 0 Reputation points

2023-09-22T10:12:27.16+00:00

This answer makes the most sense to me as well. I received the alert this morning. I checked the sign in and audit logs after removing the global admin role and changing the password on the account that my alert said gave my other global admin the rights to the purview center. I found no log ins or actions in the audit log in the past month from that account (I shouldn't have seen any logins as it is a break glass account).

I wish I would have received a warning about this. I imagine thousands of other global admins are freaking out a bit.

Bobby Hodges 0 Reputation points

2023-09-22T12:57:53.7+00:00

I, too, received this same alert from a global admin account. To top it off, the alert came in at 4am and caused some alarm bells to go off.

Beaudoin, Marc 5 Reputation points

2023-09-22T14:52:04.8433333+00:00

I witnessed strange identification behaviors like this during our Stream (classic) migration : the "Stream Migrated Folder" had a creator which had no link to this operation other than being a global admin. This does not look like an expected thing, more like a leak of some sort.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Christophe Fiessinger 20 Reputation points Microsoft Employee

2023-09-22T17:30:34.5033333+00:00

Microsoft Purview Communication Compliance (CC) policy was created as part of this new feature rollout: Report a message in Microsoft Teams which includes a default CC policy that is automatically provisioned, once a CC policy is created, investigators are notified via email.

The Microsoft Teams “report this message” aims at empowering Teams end users to report any inappropriate or concerning messages for investigators to review and act if deemed necessary within Communication Compliance (blog post).

Notification about this feature went out on May 15<sup>th</sup>, 2023, via Message Center post MC555619 and roadmap number 88916.

The feature’s roll out is scheduled to be complete by end of September and once fully rolled out, it is encouraged for the customer to edit the reviewers after receiving the policy if the automatically assigned users are not the correct users to be reviewing these reports.
Please sign in to rate this answer.

4 people found this answer helpful.
Beaudoin, Marc 5 Reputation points

2023-09-23T14:21:34.9333333+00:00

This means the IT administrators will now receive notifications about reported messages in Teams. So, if a user reports an offensive message, the IT administrators are now in charge of acting accordingly. Which is, in most use cases I can think of, a bad idea. This feature should be off by default and stay that way until a valid reviewer is named.

This is the kind of thing that is very useful, even mandatory in some environments. But it is also the kind of thing that should either be taken cared of seriously, or not at all. Most IT administrators have neither the proper authority or training for that.

Anielka Oliveros 110 Reputation points

2023-09-26T19:01:56.7333333+00:00

You can always change the role permission in your Compliance Portal, By default Microsoft triggered the alert to all Admins, but you can change who is responsible in the Purview Porta/Roles&Scope/Permissions.

Also in the same Purview Portal/CommunicationCompliance/Policies you can edit the Reviewers

Anielka Oliveros 110 Reputation points

2023-09-26T19:11:34.6+00:00

Well, I tried to change the Reviewers but I got this error,

"Couldn't create the policy because the following reviewers you included are no longer active in Azure Active Directory"

And the users are my Global admin. So I think that Microsoft still need to improve this feature.

Jarvis Sun-MSFT 10,196 Reputation points Microsoft Vendor

2023-09-28T06:39:18.6533333+00:00

Hi @Jennifer ,

Have you read the answers from Christophe Fiessinger above? This is the new notification feature rolled out by MS Purview. If the answer is help, please do not forget to accept the appropriate response as "Answer" so that others in the community facing similar issues can easily find the solution. Thanks for your understanding.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Alex Mata 5 Reputation points

2023-09-22T14:28:39.2666667+00:00

We also got the same notification. Ours came in just before 6am EST.
Please sign in to rate this answer.

1 person found this answer helpful.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Jarvis Sun-MSFT 10,196 Reputation points Microsoft Vendor

2023-09-22T05:11:37.7066667+00:00

Hi @Jennifer,

The notification you received indicates that you have been added as a reviewer in a Microsoft Purview communication compliance policy. As a reviewer, your role would be to investigate and review communications that are flagged by the policy. You would then take appropriate actions based on your organization’s message standards.

For more details about communication compliance policies and how to manage them, you can refer to the official Microsoft documentation:

https://learn.microsoft.com/en-us/purview/communication-compliance?view=o365-worldwide

https://learn.microsoft.com/en-us/purview/communication-compliance-policies

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Please sign in to rate this answer.
VenkatHC 6 Reputation points

2023-09-22T06:30:14.61+00:00

Hi Jarvis, Was it sent by Microsoft automatically? I am asking this because while the message reads

xxxx@example.com assigned you to review any alerts generated by the communication policy User reported messages. That xxxx claims he/she never added or edited any policy.

Please clarify.

Greg LaViolette 0 Reputation points

2023-09-22T15:31:45.2533333+00:00

Not helpful, just a regurgitation/summarizing of the documentation.

Similar to others, none of the Global Admins made any changes that would trigger such an event. Assumedly this was a result of a change MS rolled out and this was an unexpected result. Seeing others here with the similar issues at least reduce my worries of something security related.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Deleted

This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Comments have been turned off. Learn more

Share via

"You’ve been added as a reviewer in a Microsoft Purview communication compliance policy"

7 answers

Your answer