Super user membership is configured for Microsoft Purview Information Protection
Overview
Section titled “Overview”The super user feature of the Azure Rights Management service grants designated accounts the ability to decrypt content your organization has encrypted by using this service, regardless of the original permissions assigned. Super users might be necessary for eDiscovery, data recovery, compliance investigations, and content migration. The super user feature ensures that authorized people and services can always read and inspect the data that the Azure Rights Management service encrypts for your organization.
When you use a group to designate super user accounts, membership of that group must be carefully controlled and limited, for example, to service accounts used by compliance tools or eDiscovery platforms. Unless you have a feature or business need that requires the feature to be enabled all the time, Microsoft recommends keeping the feature disabled by default, and enabling it only when needed. When you use a group to designate super user accounts, use Microsoft Entra Privileged Identity Management (PIM) to reduce risk by enabling just‑in‑time access when required and minimizing permanent privilege.
Remediation
Section titled “Remediation”Run it
Section titled “Run it”The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
Install-Module ZeroTrustAssessment -Scope CurrentUserConnect-MaesterInvoke-Maester -Pack ZTA -SkipBuiltInLeave out -SkipBuiltIn to run Maester’s own checks in the same run.
About this check
| Severity | Medium |
| Effort to fix | Medium |
| Impact on users | Low |
| Pillar | Data, AI |
| Category | Advanced Label Features |
| Product | Purview |
| Feature | Information protection |
| Area | Data protection |
| Licence | RMS_S_PREMIUM2, Microsoft 365 E5 |
| Tenant | Workforce, External |
Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.
A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.