Why can people open emails marked CUI but they are NOT in the "Group" created for accessing CUI?

Question

So, a group was created in purview with curtain members in that group and when we tested the email part of it we sent to someone that was outside of that group and they were able to open it why is that?

Answer 1

Hi @Jordan Gonzalez ,

This may be because in Microsoft Purview, permission management is the role-based access control (RBAC) permission model. Even if a person is not in a specific Purview group, they may still have access to certain information, depending on their role and the permissions they have been granted.

More information, see: Permissions in the Microsoft Purview portal (preview)

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.