Microsoft Purview

Purview is a big brand over two related-but-distinct jobs — protecting sensitive data and governing the data estate — both riding one classification engine. Separate the halves and the whole product stops being overwhelming.

Sensitivity labels are the single most load-bearing control in Purview — DLP, Copilot exclusion, encryption and records all lean on them. Get the taxonomy and the coverage right and the rest of the stack works; skip them and it doesn't.

Classification is the layer every downstream control reads — DLP, auto-labeling, retention and DSPM all ask it 'is this sensitive?'. SITs, trainable classifiers and EDM are the three ways it answers, and tuning them is the difference between real coverage and a flood of false positives.

Purview access is role-group RBAC, not tenant-admin all-or-nothing — and the roles are deliberately narrow so an investigator can't also rewrite policy. The trap for automation is that some Security & Compliance cmdlets simply aren't available app-only.

Purview's hard part isn't turning features on — it's that many will configure and even appear to run without the licence they require. The split is roughly E3-baseline vs E5-advanced, and the real risk is per-user entitlement gaps behind a working-looking policy.

DLP is a policy engine that watches for sensitive content leaving, across every location Microsoft 365 touches — and its success is decided less by the rules than by the false-positive tuning that keeps users from routing around it.

Endpoint DLP extends the same policy engine onto the device itself — watching the egress channels the cloud can't see (USB, clipboard, print, personal cloud). Its reach is exactly the set of onboarded, managed devices, and that boundary is the whole coverage story.

A DLP policy that blocks too much trains users to click override reflexively or route around it — so tuning, not authoring, is the real DLP job. The levers are confidence, count, EDM, context conditions and a graduated override model, run as an ongoing program.

Insider Risk Management correlates behavioural signals — downloads, departures, DLP hits, HR events — into risk alerts, deliberately wrapped in privacy controls so it doesn't become surveillance. The design is signal + policy template + a strict analyst/investigator split, and its PowerShell surface is thin by design.

Retention decides what Microsoft 365 keeps and what it deletes — via broad policies and item-level labels — and the rule that trips everyone is that when controls conflict, retention beats deletion. Scopes, precedence and a multi-stage pipeline are the foundations.

Records management is retention labels with legal teeth — marking content as a record locks it against edit/deletion, and disposition review turns end-of-life deletion into a reviewed, audited decision. The file plan is the catalogue that makes it defensible at scale.

The same retention policy behaves differently per workload — because each stores its retained copies somewhere different, and Teams in particular splits messages away from the files. Knowing where the preserved copy lives is what makes eDiscovery and 'why is it still there' make sense.

eDiscovery is the legal-hold and evidence-collection engine — identify custodians, preserve their content, search, review and export. Standard covers holds and collections; premium adds custodian management, review sets and analytics. Getting the custodian-to-location mapping right is the whole discipline.

The unified audit log is the tenant's flight recorder — who did what, where, when, across every workload. Standard vs premium is mostly about how long that record survives and which high-value events you get. The trap is assuming an event is missing when it's merely aged out or not yet ingested.

Content Search is the estate-wide query tool underneath eDiscovery — point it at locations, write a KQL condition, preview and export. It finds; holds preserve. The discipline is scoping completely and exporting with integrity, because an incomplete search reads as a clean bill of health when it isn't.

DSPM is the dashboard the whole Copilot-readiness story keeps citing — data-security posture across the estate AND across AI apps and agents, unified in 2026. What it watches, its honest limits, and how to operate it.

Communication Compliance scans messages across Teams, Exchange and other channels for risky or non-compliant content — harassment, threats, regulatory breaches, leaks — and routes matches to reviewers. Like Insider Risk, it's wrapped in privacy controls and a role split so it doesn't become blanket surveillance.

Information Barriers stop defined groups from communicating or collaborating — ethical walls between, say, advisory and trading. You build segments from directory attributes and write block-or-allow policies; the traps are overlapping segments, conflicting policies, and the multi-workload scope people underestimate.

This is Purview's other half: cataloguing the wider data estate — databases, lakes, warehouses, SaaS — not just M365 content. The Data Map scans and classifies sources into a searchable catalog with lineage. It shares the classification vocabulary with the compliance half but is a separate plane with separate tooling.