Many companies have a classification policy: public, internal, confidential, highly confidential. It sits in the handbook, people were trained on it once, and since then it has been gathering dust. In day to day work, confidential offers end up in the wrong inbox, customer data in private cloud storage and, more recently, in AI assistants.
Microsoft Purview can change that. If you use Microsoft 365, the tools you need are often already in your tenant, they are just not switched on. Over the past months we have supported several Purview projects, including one at a financial services firm regulated by BaFin, the German financial supervisor.
This article explains what Purview does, where the pitfalls are and what a sensible first step looks like.
Why compliance starts with data#
Auditors no longer just ask whether a policy exists. They ask how it is enforced technically. Three regulations are pushing this in particular:
- GDPR. Personal data has to be protected according to the state of the art. If you do not know where that data lives, you can neither protect it nor delete it on time.
- NIS2. The German implementation act has been in force since December 2025. Around 30,000 companies are affected. They have to demonstrate risk management, report incidents and hold senior management accountable.
- DORA. Since January 2025, financial entities have a binding framework for ICT risk management. Part of it is identifying, classifying and adequately protecting information.
On top of that comes a very practical topic: AI. An assistant such as Microsoft 365 Copilot finds everything an employee has access to. Folders that were shared far too widely, and that nobody ever stumbled upon, suddenly turn up with a simple question.
What is Microsoft Purview?#
Purview is Microsoft's umbrella for data security, governance and compliance. It is not a single product but a set of capabilities built right into Microsoft 365. The most important ones at a glance:
| Capability | What it does | Typical question |
|---|---|---|
| Information Protection | Labels documents and emails by sensitivity, optionally with encryption | How confidential is this document? |
| Data Loss Prevention (DLP) | Detects sensitive content and stops it from leaving the company unintentionally | Can this file go outside? |
| Data Lifecycle Management | Handles retention and deletion according to fixed periods | How long do we have to keep this? |
| Audit | Logs access and activity in the tenant | Who opened what, and when? |
| eDiscovery | Searches and preserves content for legal proceedings | What do we need to hand over for this request? |
| Insider Risk Management | Spots unusual behaviour when handling data | Is someone downloading masses of files before leaving? |
| DSPM for AI | Shows which sensitive data ends up in Copilot and other AI tools | What are employees typing into ChatGPT? |
Switching on individual capabilities achieves little. What matters is the order, and that almost always starts with sensitivity labels.
Sensitivity labels: the foundation#
A sensitivity label, usually just called a label, is a marker stored inside the file itself. It travels with the document, even when it is emailed or copied to a USB stick. A label can trigger three things:
- Visible marking through a header, footer or watermark.
- Encryption, so that only authorised people can open the document, wherever it is stored.
- Follow-up rules, because DLP, retention and protection against AI access all build on the label.
Manual or automatic? Employees can apply labels themselves. Relying on that alone is risky. Purview therefore offers two ways to classify automatically:
Client-side, Purview works directly in Word, Excel, Outlook and PowerPoint. If it detects IBANs, ID numbers or health data while someone is typing, it suggests a label or applies one itself.
Service-side, Purview scans content in SharePoint, OneDrive and Exchange in the background, including existing files. Nobody has to open a document for that.
Three pitfalls from real projects#
Too many labels. Business units like a finely graded model with eight or more levels. In practice that overwhelms people, and wrongly applied labels are worse than none. In one recent project we cut the model down to five labels. Our rule of thumb: if an employee cannot decide within three seconds, they will decide wrongly.
Encryption and external partners. Auditors, consultants and service providers often work directly in shared SharePoint areas. Encryption checks the identity every time a file is opened. The protection service cannot always resolve guest accounts and security groups without an email address, and co-authoring breaks. The solution in that case was to encrypt only the highest level at first and to record that decision as a documented risk acceptance with the information security officer.
The policy exists, but nobody lives it. The first Purview analysis often shows what nobody wanted to see before: open sharing links, orphaned guest accounts, confidential data in general Teams channels. That is uncomfortable, but it is an honest starting point. Technology alone is not enough here. Short training sessions and clear examples for each label decide whether the model works in daily life.
Copilot and AI: why Purview comes first#
Microsoft 365 Copilot does not invent new permissions. It uses the existing ones, all of them. A folder that was accidentally open to every employee used to be well hidden. With Copilot, asking for the department's salary data is enough.
Purview helps in several places:
- Labels are respected. Copilot takes the sensitivity labels of the content it accesses into account. Responses show the strictest label of the sources used, so people know how sensitive the result is.
- DSPM for AI shows which sensitive data ends up in Copilot prompts and in external AI services such as ChatGPT or Gemini, and suggests countermeasures.
- DLP can prevent particularly sensitive content from being processed by Copilot at all.
So the order is clear: clean up permissions and introduce labels first, then roll out Copilot. Do it the other way round and a productivity tool becomes a search engine for data nobody was supposed to find.
Licensing: what each plan includes#
Many companies have more Purview in their tenant than they use. Simplified:
| Plan | Included (selection) |
|---|---|
| Microsoft 365 Business Premium | Manual labels with encryption, DLP for Exchange, SharePoint and OneDrive, standard retention, standard audit |
| Microsoft 365 E3 | Essentially the same as Business Premium, without the 300 user limit |
| Microsoft 365 E5 or E5 Compliance add-on | Also automatic labelling, DLP for endpoints and Teams, Insider Risk Management, advanced audit, eDiscovery Premium, AI features in DSPM |
Microsoft adjusts its bundles regularly, so before a project it pays to check which licences you actually have. Often it turns out that nothing needs to be bought to get started.
Rolling out Purview in six steps#
This is how we approach our projects:
- Assessment. What data is there, where is it stored and who has access? Which regulatory requirements apply to the company?
- Define the classification model. Four to five levels, agreed with information security and data protection. This is also where you decide from which level onwards content is encrypted.
- Clean up permissions. Close open shares, review guest accounts, tidy up Teams and SharePoint sites.
- Publish and pilot labels. Manually at first with a pilot group, with a sensible default label for new documents.
- Automate in simulation mode. Automatic labels and DLP rules start in observation only. They are activated once the results are right.
- Operate and review. Evaluate reports, sharpen rules, add new requirements. Purview is not done once it is rolled out, it belongs in day to day operations.
Conclusion#
Whether compliance works is now decided at the level of each individual document. Microsoft Purview provides the tools for that, and many companies already have the licences. Success depends less on the technology than on a lean classification model, clean permissions and a rollout that brings people along.
The foundation should be in place before you start with Copilot at the latest. If you are weighing in-house IT against a service provider, our comparison MSP or in-house IT admin lays out the arguments.
Want to know where your company stands with Purview? Talk to us. We review your licences and your tenant and tell you plainly where getting started makes sense.
Sources#
- Microsoft Learn, Learn about sensitivity labels
- Microsoft Learn, Purview data security and compliance protections for AI and Copilot
- BSI, NIS2 regulated companies (German)
- EUR-Lex, Regulation (EU) 2022/2554 (DORA)