Microsoft Purview: data protection and governance

Which information problem should Microsoft Purview resolve first?

Microsoft Purview brings together capabilities that answer different questions. Knowing where there is sensitive information, limiting its use, preserving it for a period or locating it for an investigation are related, but not interchangeable, objectives. The initial choice should describe the problem that the organization needs to solve and the evidence that will allow us to verify whether progress has been made.

A company can have customer documents spread across sites and mailboxes without knowing who is sharing them. In that case, starting by understanding location, permissions, and usage provides a basis for deciding controls. Another may know their data well and need to order the retention of certain files. Activating the same functions in both cases would produce work and costs that may not correspond to your priority.

The owner of the information must participate along with IT. The administrator can deploy a policy, but needs to know which documents are sensitive, what use is authorized, and what exceptions make business sense. This collaboration is reflected in a use case with test data, responsible parties and expected results, before extending control to a larger volume of information.

From data classification to sustainable operation

The classification should help make decisions. A label that no one uses or an alert that no one reviews provides little effective control. That is why the project must explain who classifies, what behavior changes and how an incident is handled. Training works better with documents and situations recognizable to each department than with a catalog of product functions.

After implementation, coincidences, exceptions, changes of use and accesses that no longer apply are reviewed. Tracing can correct both incorrect detection and protection that hinders an authorized process. This operation also prevents technical deployment from being confused with the complete fulfillment of all the organization’s obligations, which requires additional decisions and procedures.

What is Microsoft Purview

Microsoft Purview is a set of solutions for data security, compliance, risk, investigation and information governance. We should not understand it as a single application. In fact, within the same portal we can work on completely different problems.

Example

Let’s say a company stores customer contracts within SharePoint. Purview can intervene in several phases:

That’s why simply talking about “activating Purview” makes little sense. We have to define first what problem do we want to solve. Official reference: Microsoft – Learn about Microsoft Purview.

The three major areas of Microsoft Purview

A useful way to understand the platform is to divide it into three large blocks.

This separation is important for licenses. Many capabilities that protect users and data in Microsoft 365 continue to use a security model. per user licensing. Instead, different data governance capabilities, external sources, AI, and other capabilities use models pay-as-you-go associated with Azure. We should not therefore reduce Purview to an E3 vs E5 comparison.

Where to start: use cases, not technology

Before creating a label or a DLP policy we should be able to answer:

A technically perfect control can be a bad business control. A DLP rule that blocks all documents that contain an identification number could generate hundreds of false positives. A label that encrypts all internal documents could break existing integrations. An incorrectly configured retention policy can retain information that the company wanted to delete for years. That’s why Purview should be designed with: IT, security, business, compliance, legal when the nature of the data requires it.

Before protecting data we must know how to identify it

Purview uses different mechanisms to recognize sensitive content. Sensitive Information Types. Microsoft includes numerous predefined types of sensitive information that allow you to detect patterns related to: personal identifiers, financial data, cards, health information and other regulated formats, depending on the country and the type available. Custom types. We may also create our own types of information when the business uses specific identifiers. Exact Data Match.

In appropriate scenarios, Exact Data Match can be used to detect matches based on information known to the organization without directly entering all values into a traditional rule. Trainable Classifiers. Purview also has trainable classifiers for certain types of content that cannot be adequately identified by a simple regular expression. Classifying does not mean blocking. This distinction is essential. We can detect first and then decide what protection each data needs.

1. Microsoft Purview Information Protection

Information Protection allows you to identify, classify and protect information through mechanisms such as sensitivity labels. The classification should represent the business. A simple scheme could be:

Four well-designed labels can be better than twenty. Users should quickly understand what each level means. If they need to read a page of documentation every time they save a file, sorting will not work correctly.

Sensitivity labels: classification that can travel with the data

The sensitivity labels They allow you to classify information and, depending on configuration, apply controls. A label can be used to. classify, add visual marks, encrypt and restrict certain actions. Example.

Persistent encryption. In supported scenarios, Rights Management-based protection can accompany the document even if it leaves its original location. Tagging is not a substitute for permissions. A label can provide an additional layer, but we still need a correct permissions architecture. Official reference: Microsoft – Sensitivity Labels.

Sensitivity labels for Teams, SharePoint, and Microsoft 365 Groups

Labels are not only used on documents and emails. Microsoft also allows you to use them on certain collaboration containers. Currently they can be applied, depending on compatibility, to. Microsoft Teams, Microsoft 365 Groups, SharePoint sites, Viva Engage communities and Loop workspaces. What they can control at the container level.

Important: The site label is not automatically inherited to all documents. A label applied to a container controls certain properties of the workspace. That doesn’t mean that all files inside automatically receive the same content label. Official reference: Microsoft – Sensitivity labels for groups and sites.

Auto-labeling: automate only after you understand the classification well

Once the taxonomy is consolidated we can evaluate automatic labeling mechanisms. Example. If a document contains certain financial data and meets sufficient conditions: Purview can automatically propose or apply a classification depending on capacity, policy and license. Don’t start here. Before we need to know: what we detect, what false positives exist, what protection the label applies and what impact it will have on applications and users.

2. Data Loss Prevention: control how information is used

Data Loss Prevention It allows you to identify certain data and make decisions when someone tries to carry out a risky action. DLP should not be understood as: “If it is sensitive, block.” You can work with different levels of response.

Locations. DLP policies can work on different supported locations, including: Exchange Online, SharePoint, OneDrive, Teams and endpoints, in addition to other scenarios that depend on integration and licensing. One rule can combine several signals. For example: If the document is labeled “Highly Confidential”, an attempt is made to share externally → block and generate an alert. Official reference: Microsoft – Data Loss Prevention.

How to correctly design a DLP policy

A useful DLP policy needs business context. Phase 1: detect. First we look for: what data matches, how many times and which users use it. Phase 2: analyze false positives. A pattern can appear within perfectly legitimate content. That is why we must review the matches before blocking. Phase 3: educate. In many cases a warning to the user can solve the problem without introducing a hard lock.

Phase 4: justify. Certain legitimate processes may require exception. We can allow override with justification when the risk allows it. Phase 5: block. Only when we have enough information.

3. Endpoint DLP: protect the data when it reaches the device

Information does not always remain within SharePoint or Exchange. Users download it and work with it from their devices. Endpoint DLP Allows you to extend data control to compatible endpoints incorporated into Microsoft Purview. Examples of activity.

Endpoint DLP does not necessarily mean “Intune required.” Devices must meet the requirements and be properly incorporated into the solution. Intune is a popular way to manage your environment and coordinate configuration, but we shouldn’t describe it as a universal requirement for Endpoint DLP. Test before blocking. A bad Endpoint DLP policy can prevent: legitimate printing, exports, internal applications or processes that are part of normal work.

Official reference: Microsoft – Get started with Endpoint DLP.

4. Data Security Posture Management: See the risk before creating more policies

Microsoft Purview Data Security Posture Management (DSPM) has become one of the most important pieces of Purview’s modern approach. Its goal is to help answer questions like: Where do we have sensitive information? What is overexposed? Which users interact with that data? What part is not sufficiently protected? What policies are we missing? DSPM unifies signals. The solution uses information from various areas of Purview such as: DLP, Information Protection, Insider Risk Management and Data Security Investigations.

Beyond Microsoft 365. The current version expands visibility to: Microsoft 365, Azure, Microsoft Fabric, and supported third-party platforms depending on connectors, configuration and licensing. Objective.

DSPM does not replace DLP. DSPM helps to understand posture and prioritize. The policies that carry out much of the protection continue to rely on solutions such as DLP, Information Protection or Insider Risk Management. DSPM and AI. Microsoft is also adding visibility into interactions with Copilots, agents and other AI applications, making data posture an increasingly important piece of enterprise AI strategy.

Official reference: Microsoft – Data Security Posture Management.

5. Data Security Investigations: What information was exposed during an incident

One of the most relevant additions to Purview is Data Security Investigations. While other tools focus on detecting that something suspicious has occurred, Data Security Investigations is aimed at helping the security team understand What data could have been affected and what risk does it contain?. Example. A compromised user downloads hundreds of documents. The question is no longer just: “what did this account do?”

We also need to know: “What information was within the downloaded documents?” It can help analyze. personal information, credentials, secrets, intellectual property and other risks present within the content. Integration. You can use data from supported Microsoft 365 sources and relate to activity and investigations initiated from other solutions. AI to analyze large volumes. Data Security Investigations incorporates AI capabilities to: Semantic search, categorization and analysis of the affected content.

It is not licensed simply as another E5 module. Microsoft documents models of pay per use and capacity related to storage and analysis using AI. That is why the operational cost should also be reviewed before enabling continuous analysis capabilities. Official reference: Microsoft – Data Security Investigations.

6. Insider Risk Management

Not all incidents start with an external attacker. An employee with legitimate access can: make a mistake, share information inappropriately, extract data before leaving the company or use resources in a way that is incompatible with corporate policy. Insider Risk Management allows signals to be correlated to detect potentially relevant patterns. Examples.

Privacy by design. Microsoft incorporates pseudonymization by default and role-based access mechanisms. Still, using Insider Risk requires a much broader business decision than a technical setup. In Spain and the European Union. Before implementing policies aimed at employee behavior, the implications must be evaluated: labor, privacy, data protection, worker representation and internal procedure with the corresponding legal representatives.

Official reference: Microsoft – Insider Risk Management.

7. Communication Compliance

Communication Compliance It is aimed at organizations that need to analyze certain communications to detect possible regulatory breaches, inappropriate conduct or sharing of sensitive information. It can work on compatible channels such as. Exchange, Microsoft Teams, Microsoft 365 Copilot, Microsoft 365 Copilot Chat, Viva Engage, and select additional sources depending on integration, license and billing model. Use cases.

Researchers must be expressly authorized. Communication Compliance uses specific roles and Microsoft recommends the principle of least privilege. Official reference: Microsoft – Communication Compliance.

8. Microsoft Purview eDiscovery

eDiscovery helps identify and manage electronic information that may be needed for an investigation, litigation, regulatory request, or internal proceeding. Current experience is organized around cases. Depending on the license level, we can have more basic functionalities or activate premium capabilities for a case. That is why in a current guide it is more useful to talk about: eDiscovery, Premium capabilities We have to treat it as if there were necessarily two completely independent tools.

A case may include.

Review sets. Premium capabilities allow you to work with review sets and features such as: Topic detection, near duplicates and email conversation analysis among other supported review tools. Prepare it before you need it. An urgent investigation is not the best time to discover: who has permissions, how much we keep, what sources exist and who can export data. Official reference: Microsoft – eDiscovery features and components.

9. Microsoft Purview Audit: Find out what happened

Microsoft Purview Audit records thousands of types of activity from supported Microsoft services. It is essential for: security, investigations, compliance, troubleshooting and forensic analysis. Audit Standard. The current Audit Standard default retention is 180 days for records generated under current service conditions. Audit Premium. Expands available capabilities, including: longer retention, audit retention policies, certain high-value events, and greater API access capabilities.

One year retention. Audit Premium currently provides a one-year default policy for certain records of: Microsoft Entra, Exchange, SharePoint and OneDrive when the activity corresponds to users with the appropriate license. Up to ten years. Microsoft allows you to configure audit retention of up to ten years for users who have the necessary add-in. It is not retroactive. Creating a ten-year policy today does not recover historical records that no longer exist.

That’s why audit retention must be defined before you need that data. Official references:

• Microsoft – Audit solutions
• Microsoft – Audit log retention policies

10. Data Lifecycle Management: keep what is necessary and eliminate what is no longer necessary

Not all information should be retained indefinitely. Data Lifecycle Management Allows you to define retention and deletion policies for supported Microsoft 365 information. A policy can respond to rules such as. keep for X years → delete later or keep for X years → leave disposal to another process as per requirement. Retention Policy vs. Retention Label.

Keeping everything forever is not a strategy either. A company can unnecessarily increase: costs, exhibition area, complexity of investigations and obligations related to information that should have been eliminated. Official reference: Microsoft – Retention.

11. Records Management

Some documents are not simply information that we want to keep. They may have formal consideration of registration. Records Management adds capabilities to more tightly control: retention, disposition, records declaration, review and evidence of the process. Examples. It may be relevant to: financial documentation, files, contracts, minutes, regulated documentation and other elements whose retention is formally defined.

12. Microsoft Purview Data Map: Know what data assets exist

From here we enter another area of Purview: Data Governance. Data Map should not be confused with DLP or Microsoft 365 document labels. Your goal. Build a metadata map about the organization’s data assets. You can include sources like. Azure SQL, SQL Server, Azure Data Lake, Fabric, Power BI, Amazon S3, and other supported sources.

What a catch.

Data Map does not copy the data. Its main objective is to work with metadata and knowledge of the data heritage, not to become another repository where all databases can be moved. Official reference: Microsoft – Data Map.

13. Unified Catalog: convert a technical inventory into a useful catalog for the business

Microsoft Purview Unified Catalog relies on Data Map to provide a more business-oriented governance experience. The goal is not for a user to search only for an SQL table. We want to be able to answer questions like: What does this data mean? Who is responsible? What quality does it have? What data product does it belong to? Can I use it for this analysis? Common concepts. governance domains, data products, glossary terms, critical data elements, ownership and data health.

Example.

Billing. The modern Data Governance experience currently uses a pay per use associated with an Azure subscription. Microsoft uses different meters related to: governed assets and processing associated with Data Health Management depending on the functionality used. Official reference: Microsoft – Data Governance billing.

Microsoft Purview and Microsoft 365 Copilot

The adoption of AI has greatly increased the importance of information governance. Microsoft 365 Copilot respects user permissions. This is important, but introduces a conclusion: If permissions are too broad, Copilot can make it easier to find information that was already inappropriately accessible. Before deploying Copilot widely. We recommend reviewing:

Purview can also work on AI interactions. Purview’s current capabilities can intervene, depending on the product and license, on: auditing, classification, labels, DLP, Insider Risk, Communication Compliance, eDiscovery and lifecycle in scenarios supported by Microsoft 365 Copilot and other AI experiences. DSPM as an entry point. Microsoft is positioning DSPM as one of the leading experiences for understanding data risk around: Copilots, agents and generative applications.

Official reference: Microsoft – Purview for Microsoft 365 Copilot.

Purview does not automatically fix incorrect SharePoint permissions

It is one of the most important ideas in this entire guide. Example. We have an Address folder accidentally accessible to the entire company. We can: classify it, detect it in DSPM, apply DLP and audit its use. But the fundamental solution remains: correct permission. Before sophisticating Purview it is worth checking. sites, owners, members, visitors, guests, sharing links, groups, inheritance and sites without an owner.

Especially before Copilot. A solid strategy should combine: Permissions Governance, Information Protection, DLP, Retention, Audit.

Microsoft Purview Licensing and Billing

Purview can no longer be explained correctly by a simple table: Business Premium / E3 / E5. Currently, at least two important models coexist. 1. Licensing per user. It is the model traditionally used by Microsoft 365 for capabilities that protect data from: users, Microsoft 365 services and Windows/macOS endpoints.

2. Pay-as-you-go

Purview also uses consumption billing for certain capabilities related to: external sources, data governance, AI, and capabilities that are not dependent on an individual Microsoft 365 user. Normally requires linking the tenant with a Azure subscription.

Purview Suite for Business Premium. Microsoft currently offers Microsoft Purview Suite for Microsoft 365 Business Premium for organizations that meet their eligibility requirements. It allows you to add different advanced data security and compliance capabilities without having to automatically transform all users to Microsoft 365 E5. Do not buy before designing. The correct question is: Which users really need each capability?

and then: What license combination qualifies? Official references:

• Microsoft – Purview service description
• Microsoft – Purview billing models
• Microsoft – Purview Suite for Business Premium

Roles and least privilege in Purview

Purview may provide access to extremely sensitive information. That’s why we shouldn’t automatically make everyone responsible for the project a Global Administrator. Purview has specific roles. Depending on the solution there are roles related to: Information Protection, DLP, eDiscovery, Audit, Insider Risk, Communication Compliance, Data Security and Data Governance. Separation of functions.

Privacy. Just because we can technically show content to an investigator doesn’t mean everyone who manages Microsoft 365 should be able to see it.

How to deploy Microsoft Purview without locking down your organization

Proper deployment typically moves from visibility to protection. Phase 1. Assessment. Identify: sensitive data, locations, users, permissions, processes, compliance, licenses and responsible parties. Phase 2. Data Classification. Understand what types of information exist and where they appear. Phase 3. Sensitivity Labels. Create a simple taxonomy. Phase 4. Pilot. Publish to representative users. Phase 5. DLP in audit. Observe behavior before blocking.

Phase 6. Adjustment. Reduce false positives. Phase 7. Endpoint. Extend control when data leaves Microsoft 365. Phase 8. DSPM. Use posture and recommendations to identify additional gaps. Phase 9. Retention and Audit. Define what we keep and for how long. Phase 10. Research. Prepare eDiscovery and Data Security Investigations procedures. Phase 11. Advanced Risk. Insider Risk / Communication Compliance when the use case and organizational basis are clear.

Phase 12. Data Governance. Data Map and Unified Catalog when we need to govern the data estate beyond Microsoft 365.

Practical 90-day roadmap

Days 1–15: discover.

Days 16–30: Sort.

Days 31–45: Observe risk.

Days 46–60: protect.

Days 61–75: lifecycle and research.

Days 76–90: government and evolution.

Purview Maturity Model

Common errors when implementing Microsoft Purview

Checklist for a Microsoft Purview project

Microsoft Purview FAQ

Is Microsoft Purview only a labelling tool?

No. It brings together different protection, governance and information management capabilities. Labels are a part of the set and should be used when they help solve a specific case. Before selecting functions, it is important to identify the data, locations, users and the result that the organization needs to achieve.

Why is it necessary to know the data before blocking its use?

Without context it is difficult to distinguish improper exposure from authorized process. Knowing the location, owner, and expected use allows you to fine-tune detections and define reasoned exceptions. It also makes it easier to check if the control covers relevant information or if it only generates events that the team cannot interpret.

What should the department that owns the information contribute?

The department should explain which data it handles, how sensitive that information is and which uses are authorised. It also participates in testing and resolving exceptions. IT translates those decisions into controls and provides operational evidence, but should not decide alone which information each business area needs to retain or share.

How is the outcome of a Purview project measured?

Measure the outcome against the agreed use cases: coverage of relevant information, detection quality, response to alerts and the operation of authorised processes. Counts of labels or alerts are insufficient on their own. Ongoing review should show which risks are better controlled and which adjustments still need an owner and follow-up.

Final recommendations: Purview’s goal is not to create policies, but to understand and reduce data risk

Microsoft Purview has evolved into a much broader platform than a Microsoft 365 compliance tool. It can help us classify documents, protect information, prevent certain leaks, monitor actions on endpoints, investigate activity, preserve data for litigation, and build an enterprise catalog of data assets. But the breadth of the platform is also its main difficulty.

It doesn’t make sense to deploy all solutions simultaneously. Implementation should start by answering a simpler question: What information would really harm the company if it were exposed, lost, or misused? Then we need to locate it. Information Protection and Data Classification allow you to build a coherent classification. Sensitivity labels add context and can apply protection. DLP controls certain uses and Endpoint DLP extends that protection to the device.

DSPM adds an especially important layer to the current Purview model because it helps look at data security posture and uncover gaps that aren’t evident by reviewing policies individually. When the problem has already become an incident, Data Security Investigations can help us answer a different question: What sensitive information could have actually been exposed?. Audit provides the traceability necessary to investigate activity, while eDiscovery allows you to preserve, search and review content related to internal, regulatory or legal investigations.

Retention and Records Management control the life cycle of information. And when we need to extend governance beyond Microsoft 365 documents, Data Map and Unified Catalog enable work on enterprise data assets distributed across databases, analytics, Fabric, Azure, and other supported platforms. The adoption of Microsoft 365 Copilot and other AI experiences makes this work even more important.

AI should not force us to start from scratch with data security. It should accelerate a need that already existed: have correct permissions, know where sensitive information is, classify it, control how it is shared and have sufficient traceability to understand what happens to it. Finally, it must be taken into account that Purview licensing has changed substantially. The per-user model of Microsoft 365 now coexists with pay-as-you-go capabilities associated with Azure, especially in data governance, external sources, and certain AI-based functions.

That means that the functional architecture and the licensing architecture must be designed together. A mature Microsoft Purview deployment is not measured by the number of policies activated. It is measured by our ability to respond accurately: What data do we have, which is sensitive, who can access it, what actions are allowed, what risks do we have and what can we prove if an incident occurs tomorrow.

Recommended official documentation

Microsoft Purview.

• Microsoft – Learn about Microsoft Purview
• Microsoft – Microsoft Purview documentation

Data Security Posture Management.

• Microsoft – Data Security Posture Management
• Microsoft – Deploy Data Security Posture Management

Data Security Investigations.

• Microsoft – Data Security Investigations
• Microsoft – Get started with Data Security Investigations

Information Protection.

• Microsoft – Sensitivity Labels
• Microsoft – Create sensitivity labels
• Microsoft – Sensitivity labels for groups and sites
• Microsoft – Sensitivity labels in SharePoint and OneDrive

Data Loss Prevention.

• Microsoft – Data Loss Prevention
• Microsoft – DLP policy reference
• Microsoft – Endpoint DLP

Insider Risk and Communication Compliance.

• Microsoft – Insider Risk Management
• Microsoft – Communication Compliance

eDiscovery.

• Microsoft – eDiscovery features and components
• Microsoft – eDiscovery settings
• Microsoft – eDiscovery limits

Audit.

• Microsoft – Purview Audit
• Microsoft – Search the audit log
• Microsoft – Audit log retention policies

Retention and Records.

• Microsoft – Retention
• Microsoft – Data Lifecycle and Records Management deployment

Data Governance.

• Microsoft – Data Map
• Microsoft – Data Governance billing

Microsoft 365 Copilot and AI.

• Microsoft – Purview for Microsoft 365 Copilot and Copilot Chat
• Microsoft – Purview for generative AI applications

Licenses and billing.

• Microsoft – Purview service description
• Microsoft – Purview billing models
• Microsoft – Purview Suite for Business Premium