Keystone Studio
Unified Catalog browser
A governance studio for Microsoft Purview Unified Catalog. Purview administrators use it to see every governance domain in one place and make role changes in minutes instead of clicking through the portal one person at a time.
What it does
Browse the whole catalog
Governance domains, data products, glossary terms and who holds each role, in one searchable view.
Assign roles in bulk
Add or remove people and security groups across many domains at once, from a CSV upload or the screen. Preview every change before it runs.
Check access before you start
Verify access tells you exactly which permission or role is missing, including whether your admin rights are active in Privileged Identity Management.
Keep an audit trail
Every change is logged with who made it and when, and exports to CSV for your records.
Requirements and security
| Runs on | The administrator's Windows PC, opened in the browser. No server to host and nothing installed in your tenant beyond one app registration. |
|---|---|
| Permissions | Delegated only, so Keystone can never do more than the signed-in user. Microsoft Purview Purview.DelegatedAccess, plus Microsoft Graph User.Read, User.ReadBasic.All and GroupMember.Read.All. |
| Sign-in | Microsoft Entra ID with MFA. Sessions sign out after 30 minutes idle. |
| Your data | Directory look-ups stay in memory for the length of a request. Keystone loads no third-party scripts, fonts or analytics. |
| Security pack | Threat model, permissions approval record, data protection impact assessment and software bill of materials come with every licence. |
Not sure where to start?
Book a 30-minute call and tell us what worries you about Microsoft 365: oversharing, an audit, or a Copilot rollout. Or email us and we'll reply within one working day.