The two halves
| Half | The job | Core solutions |
|---|---|---|
| Data security & compliance (the M365-centric half) | Find, classify, protect and govern the LIFECYCLE of sensitive content | Sensitivity labels, DLP, retention, records, eDiscovery, insider risk, communication compliance, DSPM |
| Data governance (the enterprise-data half) | Catalog and govern the wider DATA estate (databases, lakes, sources) | The Data Map / unified catalog, lineage, data quality |
Most Microsoft 365 admins live in the first half; data teams live in the second. This curriculum is foundations-first on the security/compliance half (the one that governs Teams/Exchange/SharePoint content and now AI), with the governance half introduced where it matters.
The shared engine: classification
Both halves depend on knowing WHAT data is sensitive. The classification engine provides that:
- Sensitive information types (SITs) — pattern matchers (credit-card numbers, national IDs, custom regexes) with confidence levels.
- Trainable classifiers — ML models for categories patterns can't catch (résumés, contracts, harassment).
- Exact data match (EDM) — matching against YOUR specific data (your customer list), not generic patterns.
Every downstream control — a DLP rule, an auto-label, a DSPM finding — is only as good as the classification feeding it. Garbage classification in, false positives and missed leaks out. Foundations first means: get classification right before building policies on top.
The AI-era reframe (researched)
Purview repositioned as 'data security and governance for the era of AI' — because Copilot and agents made 'what sensitive data exists and who/what can reach it' the urgent question. DSPM (Data Security Posture Management), including its AI observability, is the posture instrument that ties the halves together (a later concept) — as of May 2026, DSPM and DSPM-for-AI merged into a single GA solution with unified visibility across traditional and AI apps.
What to watch (proofs)
- The engine's coverage: which SITs/classifiers are active and their match volumes (Purview classification/analytics) — the foundation every policy stands on; zero-match or flood means the classification is mis-tuned.
- The two-halves map for your org: which Purview solutions you actually run vs the licence you hold — the gap is either unused entitlement or unmanaged risk.
- Label/coverage baseline: the DSPM/asset-explorer view of labelled vs unlabelled sensitive data by workload — the starting line for everything else.
- serv365's read: the Purview surface serv365 scans (retention, protection alerts, compliance event types) with the honest note that some Purview cmdlets are RBAC-gated app-only — coverage stated precisely, not overclaimed.