Most organizations can name their sensitive data categories and cannot say where those categories physically sit, who can reach them, or what would happen if a document were shared externally by accident. Purview answers those questions and enforces the answers — which has become considerably more urgent now that AI tools can reach anything a user can reach.
Every organization has a data classification policy. Very few have classification applied to actual documents, enforced by actual controls, with actual evidence. Purview closes that gap, and these are the four symptoms of it being open.
Customer records, contracts, health information and financial data exist across SharePoint, OneDrive, endpoints and third-party services. There is no map, so protection is applied by hope.
Links shared with 'everyone in the organization' because it was quicker, permissions inherited from a site created in 2016, and a growing amount of content reachable by far more people than intended.
Policies configured in blocking mode without tuning generate false positives, users learn to click through, and the control becomes theatre.
The schedule says seven years. In practice nothing is deleted, storage grows, and everything is discoverable in litigation — including material that should have been disposed of years ago.
Where the return shows up: Purview's return is mostly avoided cost, which makes it harder to put in a business case and no less real: breaches that do not happen, regulatory findings not raised, litigation exposure reduced because retention is actually applied, and storage cost falling as content ages out. There is one direct enabler, though, and it has become the most common reason organizations start: an AI deployment that cannot proceed safely until the permission and classification position is understood. If Copilot is on your roadmap, this work is on the critical path whether or not it is in the budget yet.
The solutions that matter most in the deployments we run.
Automatic and manual classification, with labels that carry protection — encryption, watermarking, access restriction — with the document wherever it travels, including outside your tenant.
Policies across Exchange, SharePoint, OneDrive, Teams, endpoints and browsers, run in audit mode first so you learn what people actually do before you start blocking it.
Retention labels and policies applied automatically by location, classification or event, with disposition review so deletion is a decision rather than an accident.
Detection of exfiltration, IP theft and risky behaviour using signals from across Microsoft 365, with pseudonymisation and role-based access so investigation does not become surveillance.
A consolidated view of where sensitive data sits, who can reach it and how exposed it is — now extending beyond Microsoft 365 to third-party cloud platforms.
Visibility and control specifically for AI apps and agents: what they are reaching, what is being sent in prompts, and ready-made policies for AI-specific data risk.
Purview has moved decisively from a compliance toolkit to the control plane for AI adoption. Microsoft's current documentation puts data security posture management — including dedicated coverage for AI apps, agents and their prompts — at the centre of the product, and integrates its signal into Defender XDR. If your AI roadmap is ahead of your data governance, this is where the two meet.
We baseline the current classification and exposure position first — which is itself frequently the most valuable deliverable.
Locations identified across the estate before controls are applied
Overly broad access remediated on high-risk content
Time to identify and produce responsive material
Reduction as retention and disposition are applied
Applied by policy rather than left to individual judgement
Permission and exposure position resolved before Copilot
How to read these: How to read these: the figures above are typical ranges we plan and measure against, not guarantees. In your first engagement we agree the baseline, the target and the measurement method in writing, then report against them.
Microsoft's documentation frames Purview's value around data security, governance and compliance in the following terms.
Where this comes from: Where this comes from: these themes follow Microsoft's Purview documentation on learn.microsoft.com, including data security posture management and DSPM for AI. The numeric ranges above are ours and are planning figures rather than Microsoft benchmarks.
The regulatory driver differs, and so does the configuration.
PHI discovery and labelling, minimum-necessary access enforcement, and access review evidence for HIPAA audits.
Client confidentiality enforced through labels and information barriers, plus retention aligned to matter lifecycle rather than to calendar dates.
Communication supervision, retention against regulatory schedules, and the decision-trail evidence an examiner requests first.
Records retention schedules applied automatically, plus public records request workflow with redaction and defensible disposition.
Student record protection under FERPA, with legitimate educational interest enforced through access rather than asserted in policy.
Intellectual property protection: designs, formulations and process documentation labelled, tracked and protected against exfiltration.
Discovery first, always. Applying controls before you know where the data is produces confident protection of the wrong things.
Finding out where sensitive data actually lives and how exposed it is right now.
Labels, DLP and access controls applied in a sequence that does not break the working day.
Retention, insider risk and the audit trail that makes the whole thing defensible.
Implementation, customization, support and integration — sequenced so controls arrive after visibility rather than before it.
Environment design, tenant and licensing setup, configuration, data migration, testing and go-live — scoped to a fixed price and a fixed date, against outcomes agreed in writing before we start. For Purview that means discovery and audit-mode policy first, enforcement second. Deploying DLP in blocking mode on day one is the fastest way to have the whole programme suspended by an angry business unit.
Where the product stops short of your process, we extend it inside the platform rather than beside it, and we build it as configuration you can maintain wherever that is possible. Classification taxonomies, custom sensitive information types, label policies and retention schedules built around your actual regulatory obligations rather than a generic template.
Managed support after go-live: a named team, agreed response times, release management for Microsoft's update cadence, and a backlog we work through with you. Ongoing policy tuning, false-positive management, disposition review and the reporting your compliance function needs each quarter.
Connecting this platform to the systems you are keeping, with monitored, re-runnable interfaces and a documented contract for every field that moves. Signal into Defender XDR and Sentinel, coverage extended to third-party cloud platforms, and controls applied to Copilot and agent activity.
We run DLP in audit mode for a meaningful period before enforcing anything. The tuning data from that period is what separates a control people work with from a control people work around, and there is no shortcut through it.
Data governance projects fail by starting with policy. We start with what is actually there.
We map where sensitive data sits, who can reach it and how it moves — before proposing any control.
We design a taxonomy simple enough that people use it correctly, and automate what can be automated.
We apply labels and DLP in audit mode, tune against real behaviour, then enforce.
We stand up the reporting and evidence your auditor, regulator or insurer will ask for.
We review posture quarterly, because a data estate that is governed once drifts within a year.
A classification scheme with more than four or five labels will be applied incorrectly, and incorrect classification is worse than none because it produces false confidence. We will argue for fewer labels than you initially want, and we will explain why each time.
This is a product where a bad configuration is worse than no configuration, because it looks like protection.
Knowing where the data is comes first. Organizations that apply controls to an unmapped estate protect the wrong content confidently and discover the gap during an incident.
Every additional label multiplies the chance of misclassification. We optimise for a scheme that survives contact with a busy workforce rather than one that satisfies a policy document.
Purview is the reason a Copilot deployment can proceed safely. Treating them as separate projects is how organizations end up pausing one to fix the other.
Classification, access, endpoint and threat protection designed together — because an attacker does not respect the boundary between your data project and your security project.
Two illustrative engagements showing the shape of the work.
The organization intended to deploy Copilot and treat data governance as a follow-up. A discovery exercise found substantial customer data reachable far more broadly than assumed, including through links shared organization-wide.
The agency had a documented retention schedule and, in practice, deleted nothing. Storage was growing, and every public records request required reviewing material that should have been disposed of years earlier.
Practical pieces on protecting information that is already spread everywhere.
Why Copilot deployments stall on permissions, and what to assess before you commit to a licence count.
Read moreThe relationship between taxonomy complexity and misclassification, with a scheme that tends to survive.
Read moreHow to tune data loss prevention against real behaviour before enforcing anything.
Read moreLet us run a scoped discovery against one workload — a SharePoint site collection, a department's OneDrive, or your email estate. We will show you what sensitive data is there, who can reach it, and what a proportionate set of controls would look like.
Describe the situation in your own words.
