What Is Microsoft Purview? Data Security and Compliance Guide

Microsoft Purview is a set of tools in Microsoft 365 that help you find, classify, protect and govern your organisation's data and prove you are meeting your compliance obligations. It covers areas such as sensitivity labels, data loss prevention, insider risk, eDiscovery, audit and retention. Which parts you can use depends on your Microsoft 365 licence.

The name has changed over the years, and that causes confusion for buyers and administrators alike. Microsoft Purview now brings together tools once branded as Microsoft 365 compliance, Azure Purview and Azure Information Protection. If you are asking what is Microsoft Purview and where to begin, this guide gives the map.

It covers the main components, how they work together, licensing context and what changes when you introduce Copilot.

What is Microsoft Purview? The portfolio at a glance

Microsoft's own documentation, as at October 2026, organises Purview into three solution areas plus shared capabilities. Microsoft Learn lists them as follows.

Shared capabilities such as sensitivity labels, classifiers, connectors and the data and activity explorers sit across all three. Microsoft marks Data Security Posture Management as a preview feature on that page, so check its status before relying on it.

Information protection and sensitivity labels

Sensitivity labels are the practical starting point. Microsoft describes them as customisable categories, such as Public, General, Confidential and Highly Confidential, stored in the file or email metadata so the label stays with the content wherever it goes.

A label can apply encryption, headers, footers and watermarks. It can also protect containers such as Teams, SharePoint sites and Microsoft 365 Groups. Each item can carry only one label. Administrators publish labels to users through label policies.

Labels matter because other controls build on them. A DLP policy can block external sharing of anything marked Confidential, and a retention policy can treat labelled records differently. Without labels, you are writing rules from scratch for every scenario.

Data loss prevention

Purview Data Loss Prevention (DLP) identifies and monitors sensitive information and can warn or block when someone tries to share it inappropriately. Policies cover Microsoft 365 apps and email, and can extend to devices through endpoint DLP.

A typical first policy looks for UK-relevant sensitive information, such as bank details or national insurance numbers, in email leaving the organisation. Run it in audit mode first. You will see how often legitimate work triggers it and can adjust before blocking anyone.

For regulated firms, this is often where the conversation starts. Our guidance for financial services firms and law firms covers the wider compliance picture.

Insider risk, eDiscovery and compliance tools

• Insider Risk Management: detects and investigates risky activity by people inside the organisation, such as unusual downloads before someone leaves. It has privacy controls, including pseudonymisation and role-based access, and should be introduced with HR and legal input.
• eDiscovery: searches and preserves content, such as mailboxes, Teams chats and documents, for legal or regulatory matters.
• Audit: records and lets you search user and administrator activity.
• Data Lifecycle Management and Records Management: keep or delete content according to policy, which supports both UK GDPR storage limitation and legal retention duties.
• Communication Compliance: detects policy-breaking or risky communications.
• Compliance Manager: assesses your position against regulatory templates and tracks improvement actions.

You do not need every tool. Most small and mid-sized organisations begin with labels, DLP, retention and audit, and add the rest as risks justify it.

Data governance: Data Map and Unified Catalog

The governance tools answer a different question: what data do we have, and who is responsible for it? Microsoft describes the Data Map as a unified view of data services across your estate, and the Unified Catalog as a way to govern data in a federated way.

These suit organisations with data spread across multiple platforms, such as several databases, cloud stores and SaaS applications. For a smaller business with data mostly in Microsoft 365, the security and compliance tools usually deliver value sooner. Governance work also depends on people: someone must own each data domain, agree definitions and decide who can approve access. The software records those decisions but does not make them. If you are moving data between platforms, our data migration services can help you classify and clean it first.

Licensing: what you get with which plan

Licensing is where most projects stall. Microsoft changes packaging periodically, so treat this as context and confirm against the current Microsoft Purview service description before you buy.

• Microsoft 365 Business Premium: Microsoft's documentation lists sensitivity labels, Purview DLP and Purview Message Encryption among the information protection capabilities, with Compliance Manager available for setup guidance.
• Microsoft 365 E3 and E5: Microsoft's service description sets out exactly what each includes. As a rule, the advanced compliance and data security tools, such as insider risk, advanced eDiscovery and extended audit retention, sit at E5 level, and Microsoft describes its add-on as bringing those E5 capabilities to Business Premium.
• Add-ons: Microsoft offers a Purview Suite for Business Premium, aimed at organisations of up to 300 users, which brings E5-level data security, compliance and governance features to Business Premium. Pricing varies by region, agreement and promotion, so get a current quote from your Microsoft partner.

Licences apply per user, so work out who needs advanced features. Applying them to a defined group, such as finance or HR, may cost less than licensing everyone. Our Microsoft 365 support team reviews licence mix as part of tenant health checks.

Purview and Microsoft 365 Copilot

Copilot changes the stakes. Microsoft states that Copilot honours existing access controls, so it will not return data a user cannot already open. The risk is that poor permissions, such as an overshared SharePoint site, become much more visible once people can simply ask a question.

Purview supports Copilot in several ways, according to Microsoft's AI and Purview documentation:

• Sensitivity labels carry through to Copilot responses, and for encrypted labels users need the right usage permissions, including extract, for Copilot to return the content
• Audit captures Copilot prompts and responses in the unified audit log
• eDiscovery can search Copilot activity, and retention policies can retain or delete it
• Insider Risk Management includes a risky AI usage template
• Data Security Posture Management for AI reports on AI activity and sensitive data in prompts

The sensible order is to review permissions, apply labels, then roll out Copilot. A cyber security audit is a good way to find oversharing first.

A sensible order for rolling out Purview

Most failed Purview projects try to do everything at once. A staged approach works better and keeps users onside.

1. Confirm licences. List which users hold which plans and which Purview features those plans include.
2. Turn on audit. You cannot investigate what you did not record, and audit data also tells you how people really use files.
3. Design a small label set. Four or five labels are easier to explain than fifteen. Write a one-line rule for each.
4. Publish labels to a pilot group. Choose a team that handles sensitive data, such as finance, HR or senior management.
5. Add DLP in audit mode. Review matches weekly, tune the policy, then switch to warn and block where it makes sense.
6. Apply retention. Agree retention periods with legal or compliance colleagues first, because deletion cannot be undone.
7. Extend and review. Add insider risk, eDiscovery or governance tools once the basics are working.

The technical work is only half the project. Staff need short, practical guidance on which label to choose and what a DLP warning means. A managed partner can run the pilot, handle user queries and report on results, which is why many UK firms bring in managed IT support for the rollout and the ongoing tuning.

Conclusion: where to start with Microsoft Purview

So, what is Microsoft Purview in practice? It is Microsoft's set of data security, governance and compliance tools, and it works best when introduced in stages. Begin with sensitivity labels, a small number of DLP and retention policies, and audit. Check your licences, then run each policy in audit mode before enforcing it, review the results with the teams affected, and add insider risk, eDiscovery or governance tools where the risk justifies them.

If you want help planning a rollout or checking what your current licences already include, speak to NetMonkeys.

Frequently Asked Questions (FAQs)