AB900 Module 3

Protect and govern MS data

can you help me learn all of this new knowledge? please teach me like you are helping me understand
everything, from a fundamental level all the way to advance, each knowledge should build on like a
system-design thinking, not rigid memorization.

Introduction
This module examines data protection and governance in Microsoft 365. It provides a
foundational understanding of the key concepts, technologies, and terminology that
shape how organizations manage and safeguard their information in today’s digital
landscape.

This module is designed to help you build knowledge about:

 The challenges and risks associated with managing large volumes of organizational
data, including compliance requirements and the potential for data leaks or misuse.
 The role of Microsoft Purview as a unified solution for data governance, information
protection, and compliance management across Microsoft 365 and beyond.
 Core concepts such as data discovery and classification, sensitivity labels, information
protection, data lifecycle management, insider risk management, and communications
compliance.
 How Microsoft Purview integrates with other Microsoft 365 services to support secure
collaboration, regulatory compliance, and responsible data stewardship.
 The importance of data governance for maintaining accuracy, consistency, and
security throughout the lifecycle of organizational data.

Throughout this module, you explore what these concepts mean, why they matter,
and how they fit together within the Microsoft 365 ecosystem. By the end, you should
have a solid foundation for understanding the principles and tools that underpin
effective data protection and governance.

Introduction to Microsoft
Purview and data governance
In today’s data-driven organizations, the volume, velocity, and variety of information
being generated, stored, and shared is exploding. Emails, documents, chat messages,
logs, customer data, employee records, and other digital assets flow across local
networks, cloud services, and non-Microsoft apps. While this data can be an invaluable
asset, it also introduces significant risk, whether from data leaks, noncompliance with
regulations like GDPR or HIPAA, or internal misuse of sensitive information.

For IT professionals and administrators, the challenge is clear: How do you keep this
data secure, compliant, and manageable while still enabling users to collaborate
effectively? This challenge is where Microsoft Purview enters the picture. Purview is
Microsoft’s unified solution for data governance, information protection, and
compliance management across Microsoft 365 and beyond. With Purview,
administrators can automatically:
 Discover sensitive data
 Classify it based on risk or compliance needs
 Apply labels and protection settings
 Control the entire lifecycle of data, from creation to deletion
The goal of this training unit is to provide you with an understanding of what Microsoft
Purview offers, and how its data governance features ensure that an organization’s
data is accurate, consistent, secure, and appropriately managed across its lifecycle.

What is Microsoft Purview?

Microsoft Purview is a cloud-based data governance and compliance platform. It
provides a centralized suite of tools to help organizations manage their data across
Microsoft 365 and other cloud or hybrid environments. It was designed in response to
growing business needs for visibility, control, and accountability over sensitive and
regulated data. At its core, Microsoft Purview unifies features that were once
fragmented across different Microsoft services and presents them through a single,
integrated portal. Microsoft Purview’s features fall into three primary categories: data
security, data governance, and risk and compliance, as shown in the following
diagram.

Some of the key features of Microsoft Purview include:

 Information Protection. Information Protection in Microsoft Purview empowers

organizations to classify, label, and encrypt sensitive data across emails,
documents, and collaboration platforms. Sensitivity labels, applied manually or
automatically, ensure that confidential information is consistently protected, with
controls that travel with the data wherever it goes. These labels can enforce
encryption, restrict access, and apply visual markings, helping organizations meet
regulatory requirements and reduce the risk of data leaks. Beyond labeling,
Information Protection integrates with Microsoft Office and other productivity
tools, allowing administrators to monitor how sensitive data is accessed and
shared. Policy enforcement is seamless, and detailed reporting enables
compliance audits and proactive risk management. Purview combines automated
protection with user-driven controls, which helps organizations foster a culture of
security and accountability.

 Data Loss Prevention (DLP). Data Loss Prevention (DLP) in Purview helps
prevent the accidental or intentional sharing of sensitive information by scanning
content for predefined patterns like credit card numbers or personal identifiers.
DLP policies can block risky actions, notify users, and alert administrators,
ensuring that sensitive data isn't leaked or mishandled across Microsoft 365
workloads. DLP is highly customizable, allowing organizations to define what
constitutes sensitive data and specify the actions to take when such data is
found. Policy tips educate users about compliance requirements, while robust
reporting and analytics help administrators track incidents and refine policies. DLP
works in concert with other Purview features to provide a comprehensive
approach to data governance.

 Insider Risk Management. Insider Risk Management monitors user activities for
unusual or risky behavior. It uses behavioral analytics to detect and mitigate
internal threats, such as data leaks or policy violations. Administrators can
configure risk indicators and automated workflows to investigate and remediate
incidents, helping organizations proactively address potential risks from within.
This feature supports collaboration between IT, HR, and legal teams, ensuring
investigations are handled appropriately and in compliance with privacy
 regulations. Detailed audit trails and case management tools enable both
proactive risk mitigation and post-incident analysis, helping organizations protect
their most valuable data assets.

 Communications Compliance. Communications Compliance monitors and

manages communications across email, Teams, and Yammer to ensure
adherence to regulatory and organizational policies. Purview scans messages for
inappropriate language, sensitive topics, or policy violations, flagging content for
review and enabling organizations to maintain a safe, compliant, and respectful
workplace. Administrators can define custom policies, set up automated
workflows for escalation, and generate compliance reports to analyze trends and
identify areas for improvement. Integration with other Purview features ensures a
unified approach to data governance, reducing legal and reputational risks.

 DSPM for AI (Data Security Posture Management). DSPM for AI in Purview

provides visibility and control over sensitive data used by artificial intelligence
systems, helping organizations discover, classify, and secure data flows in AI
workloads. DSPM assesses risks and enforces policies, which ensures that AI
initiatives are both innovative and compliant with data protection requirements.
Ongoing monitoring and auditing allow organizations to track how data is used by
AI systems over time, generate reports, and adjust policies as needed. DSPM
integrates with other Purview features to support responsible AI development
while protecting sensitive data.

 Data Lifecycle Management (DLM). Data Lifecycle Management automates

the retention, archiving, and deletion of data based on business, legal, or
regulatory requirements. Through retention labels and policies, Purview ensures
that information is kept only as long as necessary. Doing so reduces risk, saves
storage costs, and supports compliance and eDiscovery needs. Administrators can
configure rules to apply across Microsoft 365 workloads, track when and how
retention labels are applied, and audit changes for compliance. DLM works
alongside other Purview capabilities to streamline data management and
maintain a strong governance posture.

At its core, data governance is about ensuring that data is accurate, consistent,
secure, and appropriately managed across its lifecycle. Doing so involves both
technical tools and organizational policies. In regulated industries, data governance is
critical for compliance with standards like GDPR, HIPAA, SOX, and ISO 27001. But even
in less-regulated environments, good governance helps reduce risk, improve decision-
making, and streamline operations.

Microsoft Purview operationalizes data governance through a combination of

classification, labeling, protection, retention, auditing, and policy enforcement. It
provides granular control over who can access what data, under what conditions, and
for how long. It also provides visibility into how data is used, such as when a document
is shared externally, or when an unauthorized user accesses a sensitive file. As an
admin, your role is to define the policies that align with business and legal
requirements, then use Purview to implement and monitor them.
 The remainder of this unit focuses on three major data governance capabilities within
Microsoft Purview:

 Data discovery and classification. Identifying and tagging sensitive information.

 Sensitivity labels and information protection. Enforcing access and usage
controls.
 Data lifecycle management. Controlling retention and deletion based on rules or
events.

Data discovery and classification

Data discovery and classification are foundational capabilities in Purview that enable
you to understand what kind of data exists in your environment, where it resides, and
how sensitive it is. Without visibility into your data landscape, it’s impossible to apply
meaningful protection or retention policies. Data discovery involves scanning data
sources (like SharePoint, Exchange, Teams, and so on) to identify sensitive or
regulated content. Classification involves assigning categories or labels to that data
based on its contents.

Purview uses a combination of pattern recognition, AI-based machine learning, and

metadata inspection to classify data. For example, it can detect when a file contains a
credit card number based on Luhn validation patterns, or it can recognize when a
document contains resume information based on a classifier trained with sample
resumes. Classification can happen in the following ways:

 Manually, by user selection

 Automatically, based on policy rules
 Through a trainable classifier that is AI trained on specific document types

By automatically classifying data, you create a powerful foundation for labeling,

protection, and compliance reporting. For example, if Purview classifies a file as
containing personal data, you can automatically apply a retention label or block the
file from being emailed externally. Classification is also important for auditing
purposes, as it helps you understand where risk lies within your organization.

The following sections examine the key types of classification in Microsoft Purview.

Sensitive information types

Purview includes a large library of predefined sensitive information types, such as:

 Credit card numbers

 Social Security numbers
 Health Insurance Claim Numbers
 U.S. or international passport numbers

These information types are recognized using regex patterns, checksums, keyword
evidence, and confidence scoring. For example, consider the scenario where a
spreadsheet uploaded to OneDrive contains a column labeled "SSN" with values like
123-45-6789. Purview detects the pattern, checks the formatting, and matches it
against the "U.S. Social Security Number" SIT. This triggers a classification tag.

Trainable classifiers

Trainable classifiers are machine learning-based models that you train with examples
of documents that fall into a specific category. Microsoft includes several built-in
classifiers, such as:

 Resumes
 Source code
 Healthcare templates

You can also build custom classifiers by uploading at least 50 sample documents.
Purview learns the characteristics of those documents and applies classification when
it sees new documents with similar structure or content. For example, consider the
scenario in which your HR department stores job applicant resumes. You train a
classifier on 50 resumes. Once trained, Purview begins to identify resumes across
SharePoint and Outlook, even if the term "resume" isn’t explicitly mentioned.

Exact data match (EDM)

EDM is a way to help Microsoft Purview find and protect specific pieces of sensitive
information, such as Social Security numbers, employee IDs, or customer account
numbers. Instead of looking for patterns or keywords, EDM checks if the data exactly
matches entries in a secure list that your organization provides. For example, if you
upload a list of employee IDs, EDM can scan emails, documents, and other content to
find those exact IDs and apply protection rules. This process helps reduce mistakes
and makes sure only the right data is flagged. EDM is especially useful when you need
high accuracy and want to avoid false alarms.

EDM-based sensitive information types can be integrated into data loss prevention
(DLP) policies, auto-labeling, eDiscovery, and other compliance solutions across
Microsoft 365. The EDM workflow involves defining a schema, creating a rule package,
hashing and uploading the source data, and validating the classifier, all of which can
be managed through the Microsoft Purview portal or PowerShell.

For example, consider the scenario in which your HR team uploads a CSV of all
employee ID numbers. You configure a policy to detect when any of those IDs appear
in a document or email. This process ensures highly accurate detection without false
positives, since EDM only triggers if the exact value is found.

EDM offers greater precision than pattern-based tools like regular expressions (regex)
in scenarios where identifying specific, known sensitive data is critical. While regex is
useful for detecting general patterns in text, EDM reduces false positives by matching
against a secure, predefined dataset.

For example, if you wanted to find Social Security numbers in a document, you could
use a regex pattern like \d{3}-\d{2}-\d{4} to match any text that looks like an SSN.
However, regex only looks at the format of the data, not whether the value is actually
valid or sensitive. In doing so, it can sometimes flag false positives, such as a random
number that happens to match the pattern but isn’t a real SSN. In contrast, EDM only
triggers when the content matches a specific value from a secure list your
organization provides, making it much more accurate.

Sensitivity labels and Information protection

Sensitivity labels are at the core of Microsoft Purview’s information protection
capabilities. These labels allow you to classify and protect data based on its sensitivity
level. Once a label is applied, it can enforce encryption, restrict access, add visual
markings (like headers/watermarks), and control external sharing. Sensitivity labels
travel with the data, meaning that even if a document is downloaded and emailed
outside the organization, the label’s protection still applies.

Labels can be applied in several ways: users can apply them manually, the system can
apply them automatically based on content detection, or labels can be recommended
to users as suggestions. For example, if a user types a credit card number into an
Excel file, a label can automatically apply, or a policy tip can prompt the user to apply
the correct label. Administrators can also enforce mandatory labeling, ensuring that
no document is saved without an appropriate label.
 Once a label is applied, the protection settings are embedded into the file’s metadata.
Microsoft Office applications like Word, Excel, and Outlook have built-in support for
Purview labels, so protections are enforced at the application level, including when
offline.

Label components and behavior include:

 Encryption settings. Labels can enforce encryption that restricts who can open
a document and what they can do (read, edit, print, copy). Encryption is enforced
using Azure Rights Management. For example, a label called “Confidential – HR
Only” encrypts documents so that only members of the “HR” security group can
open them. Even if the document is downloaded to a USB drive and opened on a
home PC, it remains encrypted and inaccessible to unauthorized users.

 Content markings. Labels can apply visual markings to documents and emails,
such as headers, footers, and watermarks. The purpose of the markings is to alert
users to the sensitivity of the content. For example, a document labeled “Top
Secret” includes a red header saying “CONFIDENTIAL – INTERNAL USE ONLY” and
a diagonal watermark across each page. These markings remind users to treat
the content carefully.

 Access restrictions and sharing controls. Labels can control whether content
can be, shared externally, copied or printed, and accessed by unmanaged
devices. For example, a sensitivity label applied to a financial report might block
external sharing via OneDrive and prevent users from printing the file at home.

 Label policies. Sensitivity labels are deployed to users through label policies.
These policies determine:

 Which labels are available to which users or groups

 Whether labeling is optional or mandatory
 Whether users can override automatic labeling
 Whether justification is required for changing labels

For example, you create a policy for the Legal department that includes four labels:
Public, Internal, Confidential, Legal Only. You make labeling mandatory and require
users to justify any change from a more restrictive label to a less restrictive one.


Data lifecycle management
Data lifecycle management (DLM) is the process of controlling how long data is
retained, how it’s stored, and when it’s deleted or archived. In Microsoft Purview, this
functionality allows organizations to automatically enforce data retention policies and
 deletion rules based on regulatory, legal, or business requirements. The goal is to
ensure that information is retained for as long as it's needed, and no longer. This goal
is vital not only for compliance, such as GDPRs “right to be forgotten,” but also for
reducing data risk, saving storage costs, and simplifying eDiscovery processes.

Without proper DLM, organizations often accumulate large volumes of outdated or

redundant data, making it harder to manage and protect sensitive content. Keeping
everything "just in case" is no longer viable from a legal or operational standpoint.
Microsoft Purview provides centralized tools to automatically retain, archive, or delete
content across Microsoft 365 workloads, including Exchange, SharePoint, OneDrive,
Microsoft Teams, Yammer, and more.

The following sections examine the key components of data lifecycle management.

Retention labels

Retention labels define the retention behavior for specific content. A retention label
might instruct the system to retain content for a fixed period, to delete content after a
specified number of days, or to retain and then delete content after a defined period.

For example, consider the scenario in which you create a retention label called “7-Year
Legal Hold” that retains any content it's applied to for exactly seven years. During this
time, even if a user tries to delete the file or email, Purview preserves it in the
background. After seven years, the content is automatically deleted unless it's subject
to a legal hold.

Users can manually apply retention labels (for example, through the ribbon in Outlook
or SharePoint), or the system can automatically apply labels based on conditions such
as:

 Content type (email, document, Teams message)

 Keywords or sensitive data types
 Metadata (for example, “Document Type = Contract”)

Labels offer fine-grained control and support auditing, so you can track when and how
a label was applied or changed.

Retention policies

Retention policies are broader than labels. These policies are typically used to apply
rules across locations or content types without needing to label each item individually.

For example, consider the scenario in which you configure a retention policy to delete
all Teams chat messages older than 90 days across the organization. This policy
applies regardless of whether a label is present and doesn't require user interaction.

Retention policies are useful for scenarios where:

 You want to apply uniform rules to all users or content types.

 You’re dealing with legacy or unlabeled content.
 You want to ensure a baseline data hygiene standard.

Unlike retention labels, retention policies are location-based, meaning you select the
target services (such as SharePoint, Exchange) and let Purview manage content
across them.

Auto-apply rules
 Purview allows retention labels to be automatically applied based on content
conditions. These rules use the same classification engines as sensitivity labeling,
including:

 Keywords or phrases, such as "contract” and “termination”

 Sensitive information types, such as SSNs and credit card numbers
 Trainable classifiers, such as resumes and non-disclosure agreements

For example, consider the scenario in which you create a rule that applies a 5-year
retention label to any document containing credit card numbers. This process ensures
that financial data is retained only as long as legally necessary and then deleted to
minimize exposure.

Automatically applied rules remove reliance on users to apply the correct label, which
improves consistency and compliance.

Identify and respond to data

risks with Microsoft Purview
Modern IT environments are becoming increasingly complex, and with that complexity
comes new challenges in data protection. The shift to hybrid and remote work models,
widespread use of cloud storage solutions, and the growing role of AI in workplace
tools (such as Microsoft 365 Copilot) created an ecosystem where data is more fluid
and accessible than ever before. As users collaborate across time zones and devices,
the traditional concept of a “secure perimeter” no longer applies. Sensitive
information now flows freely between managed and unmanaged devices, internal
systems and external partners, and even across AI-generated content and automation
tools.

These dynamics introduce new types of data risk, ranging from malicious insiders
deliberately moving sensitive data from within the organization to external locations,
to well-meaning employees accidentally sharing sensitive files through personal
accounts or generative AI platforms. Traditional security controls, such as firewalls and
static access policies, are no longer sufficient to address these evolving risks. Manual
audits are time-consuming, reactive, and often too late to prevent actual damage.
Organizations require modern tools that deliver real-time, contextual insights into how
data is used, moved, and shared across cloud, endpoint, and user interaction layers.

Within the Microsoft 365 ecosystem, Microsoft Purview provides this functionality. It
provides a unified platform for managing compliance, data protection, and insider risk.
It includes powerful tools such as Insider Risk Management, Data Loss Prevention
(DLP), Communication Compliance, and Activity Explorer. These tools work together to
provide visibility and control across Microsoft 365 workloads, devices, and AI services
like Copilot. With Purview, you can monitor for risks, define data protection policies,
and take targeted action when necessary. Doing so protects your organization’s most
valuable asset—its data.

Identify governance risks in Microsoft 365 and Copilot

Governance risks emerge when sensitive information is accessed, shared, or used in
ways that contradict company policy or regulatory obligations. Microsoft Purview
enables you to detect these risks by analyzing signals across the Microsoft 365
environment, including apps like SharePoint, OneDrive, Teams, and even newer tools
like Microsoft Copilot. The platform provides early indicators of risk through policy
alerts, anomaly detection, and real-time telemetry.
These indicators allow admins to spot deviations from expected behavior, such as
users attempting to export data, misuse of AI assistants, or unapproved data
transfers. For instance, if your organization has a policy that prohibits highly
confidential files from being shared externally, Purview can flag any violations,
including violations initiated by AI tools. Since Purview surfaces these insights in a
centralized dashboard, admins can quickly identify and respond to threats that might
otherwise go unnoticed until a full-blown incident occurs.

This centralized dashboard is also useful for tracking behavior across AI integrations,
such as Copilot. AI tools increase productivity, but they also create new vectors for
data exposure. If Copilot inadvertently pulls information from sensitive sources while
generating content, and that content is shared externally, it could constitute a data
leak.

Microsoft Purview includes the following tools to monitor and manage these
interactions as part of your overall data governance strategy:

 Monitoring risk signals. Microsoft Purview gathers and organizes data about
potentially risky actions happening throughout the Microsoft 365 environment. It
then provides admins with a comprehensive view of potential security and
compliance issues within the Microsoft Purview portal. These risk signals might
include policy violations, suspicious user behavior, and unauthorized data access
or movement. For example, if users start uploading sensitive files to unmanaged
storage like Dropbox or Google Drive and those uploads fail due to policy blocks,
the portal logs these failed attempts. A sudden spike in such blocked actions
might indicate users are either unaware of policy restrictions or attempting to
bypass them deliberately. Monitoring these signals over time helps administrators
detect early signs of misbehavior or misconfiguration before they result in data
loss.

 Identifying potential data exfiltration attempts. Data exfiltration refers to

the unauthorized movement of sensitive data from within an organization to
external locations. Purview surfaces these activities through behavioral analytics,
such as detecting mass downloads from SharePoint or OneDrive, or transfers to
personal USB drives. If a user downloads hundreds of documents labeled
"Confidential" within a short timeframe, this behavior can be flagged as
anomalous based on policy thresholds. These insights help security teams
intervene early, potentially stopping insider threats or account compromises in
progress. Whether intentional or accidental, such events are treated as high risk
due to the volume and sensitivity of the data involved.

 Spotting policy violations by Copilot. As part of the Microsoft 365 experience,

Copilot interacts with user content to generate summaries, answer questions, or
assist with document creation. If users prompt Copilot to access or summarize
data labeled as “Highly Confidential,” it can inadvertently surface restricted
content in unauthorized contexts. Microsoft Purview enables organizations to
configure Data Loss Prevention (DLP) policies that restrict Copilot from processing
or displaying certain labeled documents. If a user tries to use Copilot in a way that
violates these policies, Purview logs the activity and can issue warnings or block
the action entirely. This capability ensures that AI-enhanced productivity tools
operate within established data governance boundaries.
 Detecting sudden spikes in sensitive data access. Unusual spikes in access
to sensitive data can be early indicators of account compromise or insider threats.
Microsoft Purview continuously monitors baseline user behavior and flags
deviations that exceed expected norms. For instance, if a user who typically
accesses a handful of confidential files per week suddenly opens dozens in a
single day, especially during nonworking hours or from an unfamiliar device, this
behavior is highlighted for further review. These detections are enhanced when
correlated with geographic location, device ID, and access type, enabling more
nuanced analysis. Timely visibility into these spikes helps admins determine
whether the activity is legitimate, mistaken, or malicious.

Insider Risk Management

Insider threats are some of the most difficult to detect because they originate from
users who already have legitimate access to your systems. Insider Risk Management
in Microsoft Purview helps address this challenge by analyzing user activity in the
context of defined thresholds, HR signals, and behavioral baselines. It works by
combining machine learning, user activity data, and security signals to flag anomalies
that could indicate potential misuse.

This feature doesn’t just look at what users are doing—it evaluates why the behavior
might be suspicious. It considers factors like working hours, travel locations, role
changes, and HR context (such as resignation notices or performance concerns).
When properly configured, Insider Risk Management provides a nuanced, context-
aware system for identifying and responding to potential internal threats.

Admins can create policies that focus on specific scenarios, such as high-volume file
transfers, access to sensitive data during unusual hours, or sending confidential
documents to personal email accounts. Alerts are surfaced in a dashboard that
enables reviewers to view activity logs, assess severity, and take appropriate actions,
such as notifying HR, restricting access, or launching a full investigation.

 Detecting mass file downloads. Mass downloads of sensitive files can signal
preparatory steps for data theft or accidental mismanagement by users. Insider
Risk Management in Purview lets admins define policies that watch for such
behavior, such as downloading more than 50 files marked as "Confidential" in 24
hours. When the system detects this threshold has been exceeded, it
automatically generates an alert and logs the event, including the file names,
locations, and user information. Admins can then review these actions in context
—whether they occurred during an offboarding process, a role change, or were
simply misuse of access. These rules are especially valuable for identifying risky
behavior before it escalates to actual data loss.

 Flagging data shared to personal email. Sharing internal documents to

personal or external email accounts often violates corporate policy, as it bypasses
formal controls and data residency requirements. Microsoft Purview detects when
sensitive content is sent to domains like [Link], [Link], or other
unmanaged addresses. When the system detects this type of activity, it flags the
incident and can automatically notify the user, block the message, or escalate to
compliance teams. This response is particularly useful when combined with DLP
and Information Protection labels, which provide classification context for the
 shared content. Admins can then investigate further, determine intent, and take
corrective action as needed.

 Identifying abnormal behavior involving working hours or travel context.

Abnormal access patterns—such as sign-ins at 3 a.m. or from IP addresses outside
the employee’s usual location—can be signs of suspicious behavior. Purview
begins by using behavioral baselining to understand what’s “normal” for a user in
terms of access time, location, and data volume. When a deviation is detected,
such as someone accessing files during leave or while allegedly out of the
country/region, Purview flags the event for follow-up. These anomalies become
more meaningful when combined with HR data, such as approved travel or leave
schedules, allowing for more targeted reviews and fewer false positives.

 Applying thresholds and HR integrations. Purview becomes even more

powerful when you integrate it with HR systems to bring in contextual signals,
such as employee resignation notices, role changes, or disciplinary actions. You
can set behavioral thresholds—like large data transfers or unusual downloads—
and have them act as triggers when HR signals are also present. For example, if
an employee submits a resignation and is suddenly exporting customer lists to a
personal device, the combination of those two signals elevates the risk score and
justifies further investigation. These proactive policies help organizations monitor
for insider threats during high-risk transition periods like terminations or team
transfers.

Data loss prevention (DLP)

DLP is one of the most foundational tools in Microsoft Purview for enforcing data
security policies. It uses policies that enable organizations to detect, block, or audit
the movement of sensitive data based on content inspection and contextual rules.
These policies apply to a wide range of activities, such as copying data to USB drives,
emailing documents, uploading to cloud storage, or interacting with AI tools like
Copilot.

Microsoft Purview DLP policies use classification rules, sensitivity labels, and pattern
matching to inspect data. This process includes built-in sensitive information types
such as credit card numbers, Social Security numbers, or government-regulated data.
Admins can also create custom patterns using regular expressions or dictionaries.
Policies are enforced in Microsoft 365 apps (like Outlook, Teams, SharePoint), on
devices (through Defender for Endpoint), and through session controls in Microsoft
Defender for Cloud Apps.

A key benefit of Purview DLP is that it supports flexible actions. You can allow actions
with user justification, block them entirely, or allow and log for review. Doing so
ensures that security doesn’t come at the cost of business productivity. DLP also
integrates deeply with alerts, incident management, and audit logs, so admins can
respond quickly when risky behavior is detected. Microsoft Purview DLP incorporates
the following tools:

 DLP policies. Microsoft Purview DLP policies enable you to take precise actions
when sensitive data is handled in potentially risky ways. For example, you can
configure a policy to block uploading of “Confidential” documents to non-Microsoft
 cloud services like Dropbox or Google Drive. Alternatively, users might be
permitted to proceed after providing a business justification—such as “vendor
collaboration”—which is then logged for audit purposes. This just-in-time decision-
making enables organizations to protect sensitive data while giving employees a
way to justify legitimate needs without being unnecessarily blocked. All actions
and exceptions are recorded to ensure compliance visibility.

 Device-level enforcement in Defender for Endpoint. Purview DLP integrates

with Microsoft Defender for Endpoint to enforce policies at the device level,
offering protection even outside the cloud. Onboarded devices running Windows
10+, Windows 11, or supported versions of macOS can block or log local actions
such as copying files to USB drives, printing sensitive documents, or using
clipboard tools to move data into unmanaged applications. For instance, if a user
tries to paste content from a confidential report into an unauthorized web form,
the system can block the paste and log the attempt. This device-level control is
critical for hybrid and remote environments where traditional network controls are
ineffective.

 Alerts trigger automated or manual investigations. When a DLP rule is

triggered, such as an attempt to email a sensitive spreadsheet externally, Purview
generates an alert with full details: who triggered it, when, where, what data was
involved, and which rule was violated. These alerts appear in the Microsoft
Purview portal and can also be routed to Microsoft Defender XDR, Microsoft
Sentinel, or other Security Information and Event Management (SIEM) tools.
Depending on the severity, alerts can trigger automated workflows through Logic
Apps or Power Automate, or be handled manually by compliance staff. This
flexible response framework enables organizations to scale their incident handling
based on volume and risk level.

Communication Compliance
Communication Compliance in Microsoft Purview helps you monitor user
communications—such as emails, Teams messages, Yammer posts, and even Copilot
chat prompts—for content that violates corporate policies or regulatory requirements.
This feature is particularly useful for detecting harassment, abusive language, insider
trading, data leaks, and other types of inappropriate or risky communication behavior.

Purview uses a combination of pattern-based detection (like regular expressions for

keywords) and machine learning classifiers that are trained on real-world examples.
These models can detect context-sensitive violations, such as discussions that
resemble market manipulation or sharing of sensitive terms in inappropriate settings.
Communication policies are customizable by user group, communication channel,
keyword, language, and more.

The review process involves a dedicated dashboard for compliance analysts. They can
assess flagged messages, tag false positives, escalate high-severity messages, or
notify HR or legal teams. For organizations in regulated industries like financial
services or healthcare, Communication Compliance provides a critical layer of
oversight that helps meet audit and legal discovery obligations.
 Using pattern-based and machine learning classifiers. Communication
Compliance in Microsoft Purview uses both traditional pattern matching (such as
regex and keyword dictionaries) and machine learning classifiers to detect
inappropriate or risky content in messages. This type of content often includes
signs of harassment, regulatory violations, and insider trading conversations. For
instance, a classifier might flag an email chain where an employee discusses
“delaying the announcement until after earnings,” which could be interpreted as
an attempt to manipulate market timing. The combination of structured patterns
and adaptive classifiers allows for broader and more accurate detection.

 Reviewer dashboard. All flagged messages are presented in the

Communication Compliance reviewer dashboard, where authorized analysts can
see message details, including sender, recipients, content snippets, and policy
matches. From here, reviewers can dismiss the event, send user notifications,
escalate to HR or legal, or tag it for future policy training. For example, if a
message contains borderline language but no policy breach, the reviewer might
provide feedback to the user without formal action. This human-in-the-loop
process allows for context-aware decisions and supports policy tuning.

 Industry-specific custom policies. Organizations can configure Communication

Compliance to align with industry regulations, such as FINRA for financial services
or HIPAA for healthcare. Custom policies might focus on detecting “material
nonpublic information” (MNPI), drug-related language, or prohibited political
statements depending on the industry’s regulatory framework. These policies can
also include thresholds for risk scores or match confidence, ensuring that only
high-confidence events are escalated. Over time, organizations can fine tune
these policies to help reduce alert fatigue and improve enforcement accuracy.

Activity Explorer
Activity Explorer in Microsoft Purview is a centralized investigation and visualization
tool. It helps compliance and security analysts understand user actions and correlate
them with policy matches, risk events, or data sensitivity classifications. It acts like a
forensic timeline of what users did with sensitive data across emails, file shares,
downloads, labeling, policy violations, and more. Rather than jumping between
multiple logs or dashboards, Activity Explorer provides a consolidated view of user
behavior. This design makes it easier to investigate incidents or identify risky
patterns.

Unlike alert-focused dashboards, which only surface predefined risks, Activity Explorer
gives you full visibility into user and data activity, even when it doesn’t trigger a policy
violation. Doing so enables more proactive exploration, such as identifying unusual
data movement before it escalates into an incident. Whether you're trying to
determine the root cause of a DLP alert, investigate insider behavior, or audit data
flows, Activity Explorer serves as your starting point.

The Activity Explorer interface is highly interactive. You can filter events by date, user,
file name, sensitivity label, activity type (for example, “Shared externally” or “Labeled
as Confidential”), or specific policy matches. You can also view the activity as a
chronological timeline, helping you connect sequences of behavior that might
otherwise seem unrelated. For example, a document being labeled, then downloaded,
then emailed externally, all within minutes.
 Dashboard for sensitivity labels, sharing, and DLP matches. Activity
Explorer provides a consolidated view of user activity across Microsoft 365,
enabling admins to see how users are interacting with labeled content, sharing
files, and triggering DLP policies. Events are visualized chronologically with
metadata such as file names, users, activity types, and device details. For
instance, you could quickly identify that a user labeled a file as “Highly
Confidential” and then shared it externally, allowing you to correlate the
sequence with policy enforcement and potential data loss.

 Filtering by user, policy, date, or file type. The tool offers powerful filters so
investigators can drill into specific activity types, such as “external file shares by
user X in the last seven days.” It can also search by file type, policy ID, or
classification label. These filters are essential when triaging alerts or following up
on an insider risk signal. Rather than reviewing all logs, admins can isolate the
relevant subset of actions and examine them in detail, making the investigation
process more efficient and targeted.

 Drill-down into sequences and timelines. Activity Explorer organizes actions

into linked timelines, showing visual sequences like: document labeled, then
downloaded to USB, then emailed externally. This visual linkage helps analysts
understand user intent and the path data took through the organization. Each
event includes deep context—timestamp, user identity, device info, label history,
and risk scores—so investigators can reconstruct incidents accurately. These
timelines are critical in incident response, helping teams determine whether an
action was deliberate, accidental, or indicative of compromised credentials.

Examine compliance, AI data

discovery, and eDiscovery
In today’s digital landscape, organizations face increasing pressure to safeguard
sensitive information, comply with regulatory requirements, and manage the risks
associated with rapidly evolving technologies like artificial intelligence. For admins
and IT professionals, understanding how compliance, data discovery, and eDiscovery
intersect is essential for building a secure and resilient environment.

Microsoft Purview offers a unified platform for managing compliance, discovering

sensitive and AI-impacted data, and executing legal holds and investigations. Admins
who use Purview’s advanced capabilities can not only assess their organization’s
compliance posture but also gain visibility into how data is used, shared, and
accessed, especially as AI-driven workflows become more prevalent.

Admins new to Microsoft Purview can build a comprehensive foundation by exploring

its tools and processes that underpin modern compliance management. Microsoft
Purview Compliance Manager, Data Explorer, DSPM for AI, and eDiscovery are
essential resources for proactively managing risk, supporting governance, and
maintaining trust. These tools enable organizations to assess compliance posture,
locate sensitive and AI-impacted data, and perform content discovery and legal hold
using advanced compliance and discovery capabilities.

Compliance Manager
Compliance Manager is the cornerstone of Microsoft Purview’s compliance capabilities.
It acts as a risk assessment and recommendations engine, helping organizations
navigate complex regulatory landscapes such as GDPR, HIPAA, and ISO 27001. For
admins, using Compliance Manager enables them to evaluate their organization’s
current compliance status, identify gaps, and implement targeted improvements.

At its core, Compliance Manager provides structured assessments tailored to specific

regulations. Each assessment is composed of controls—some managed by Microsoft,
others by the customer—that define the requirements for compliance. Admins can
map these controls to actionable improvement steps, which transforms compliance
from a static checklist into a dynamic, ongoing process. The platform’s governance
features allow you to assign owners and track the status of each action, making
compliance a collaborative effort.

A key feature of Compliance Manager is the Compliance Score, which quantifies how
well your organization meets regulatory requirements. This score is more than just a
number; it’s a strategic tool for prioritizing remediation efforts and demonstrating
progress to stakeholders. For example, if your organization is subject to government
regulations, Compliance Manager might recommend enabling audit logging, deploying
Data Loss Prevention (DLP) policies for personal data, and classifying content in
Exchange. Each recommendation is mapped to an owner and tracked for completion,
turning compliance into a manageable project.

Key features and examples of Compliance Manager include:

 Assessments based on regulations. Compliance Manager offers prebuilt

assessments for major regulations. For instance, a GDPR assessment includes
controls for data protection, breach notification, and subject rights. Admins can
use these assessments to identify which requirements are already met and which
need attention. For example, if audit logging isn’t enabled, the assessment flags it
as a gap and provides guidance on remediation.

 Controls (Microsoft-managed and customer-managed). Each assessment is

divided into controls. Microsoft-managed controls are automatically monitored by
the platform, such as encryption settings or service configurations. Customer-
managed controls require manual verification, like ensuring staff training or
documenting data processing activities. Admins can assign each control to a
responsible party, track progress, and upload evidence of compliance.

 Improvement actions and Compliance Score. Improvement actions are

specific steps recommended by Compliance Manager to close compliance gaps.
These actions might include enabling auditing, assigning sensitivity labels, or
updating privacy notices. The Compliance Score reflects the percentage of
controls that are satisfied, giving admins a clear view of their organization’s
 compliance posture. For example, after implementing DLP for personal data, the
score should increase, signaling improved compliance.

Microsoft Purview Data Explorer

Data Explorer is designed to help admins discover where sensitive data resides across
the organization. In environments where data is scattered across emails, documents,
chats, and cloud storage, visibility is crucial for effective governance. Data Explorer
provides powerful tools to visualize, filter, and analyze sensitive information. These
tools enable admins to understand data exposure and take proactive measures.

The Microsoft Purview platform enables you to search for sensitive info types—such as
credit card numbers, Social Security Numbers (SSNs), and health data—across
multiple locations, including SharePoint, Teams, and OneDrive. By applying filters
based on location, sensitivity label, or content type, admins can quickly pinpoint areas
of concern. This capability is especially valuable before implementing new security
policies, as it reveals potential risks and informs decision-making.

Data Explorer’s visualization features make it easy to see patterns and trends in data
usage. For example, an admin might want to know where all “Confidential – Finance”
documents are stored and whether any are shared externally. Data Explorer can
display the files, their owners, and sharing status, providing a comprehensive view of
data exposure. This insight is essential for protecting sensitive information and
ensuring compliance with internal and external requirements.

Key features and examples of Data Explorer include:

 Discover where sensitive data is stored. Data Explorer scans your

organization’s digital assets to locate sensitive information. For example, it can
identify all documents containing credit card numbers stored in SharePoint and
flag those documents that are also accessible to external users. Doing so helps
admins assess the risk of data leakage and prioritize remediation efforts.

 Visualize sensitive information types. The tool categorizes data by info type,
making it easy to see how much sensitive information exists and where it’s
concentrated. For instance, an admin might discover that health data is primarily
stored in a specific Teams channel, prompting a review of access controls and
sharing policies.

 Filter by location, sensitivity label, and content type. Admins can apply
filters to narrow down search results. If you’re concerned about “Confidential –
Finance” documents, you can filter by sensitivity label and location to see only
relevant files. Data Explorer shows who owns each file, how it’s shared, and
whether it’s at risk of unauthorized access.

Discover and manage AI activity using Data Security

Posture Management
 With the rise of AI-powered tools like Microsoft 365 Copilot and non-Microsoft
generative AI applications, managing your organization’s data security posture has
become more complex than ever. Microsoft Purview Data Security Posture
Management (DSPM) provides a unified experience that helps organizations discover,
monitor, and protect sensitive data across both traditional data environments and AI-
driven workflows.

DSPM extends data security visibility into AI interactions—enabling admins to

understand how AI apps and agents access, process, and generate content using
organizational data. This unified approach helps organizations confidently adopt AI
while maintaining strong security, compliance, and governance practices.

Understand AI activity and data exposure risks

DSPM enables admins to track how AI interacts with sensitive data across the
organization, such as identifying where AI-generated content is stored, how it’s
labeled, and who has access to it. For example, DSPM can surface scenarios where
Microsoft 365 Copilot summarizes legal contracts or generates reports using regulated
data. Admins who monitor these interactions can identify potential risks, such as
oversharing, inappropriate access, and unintended exposure of sensitive information.

DSPM also helps organizations detect and manage shadow AI usage, which is the use
of unapproved AI tools or services outside of IT governance. Shadow AI usage refers to
the unauthorized use of AI technologies—such as generative AI apps, machine
learning tools, or browser extensions—without formal approval or oversight. Similar to
shadow IT, shadow AI introduces risks related to data leakage, compliance violations,
and lack of visibility into how organizational data is being used.

When DSPM identifies these types of patterns, admins can take appropriate action,
such as restricting access, applying policies, or guiding users toward approved tools.

Apply controls to protect sensitive data in AI scenarios

Admins who use DSPM can define and enforce policies that help protect sensitive data
when it’s accessed or processed by AI. For example:

 Restrict access to sensitive content types, such as legal case files or HR records
 Apply encryption or sensitivity labels to AI-generated content
 Adjust access controls based on the sensitivity of the underlying data

If DSPM detects that AI tools are interacting with regulated data in ways that could
introduce risk, it provides recommendations to help admins strengthen protection and
reduce exposure. This approach enables organizations to balance productivity and
protection, which supports AI adoption while maintaining control over sensitive
information.

Key DSPM capabilities for AI-related scenarios

DSPM includes the following built-in capabilities that help organizations secure data
across AI interactions:

 Discover AI-generated content and apply labels. DSPM helps identify files
and messages created using AI tools and ensures they're protected with
appropriate sensitivity labels. For example, a Copilot-generated summary of a
financial report can be automatically labeled “Confidential” and stored securely.
  Detect AI interactions with sensitive data. DSPM provides visibility into how
AI tools access and process sensitive information. For example, if AI is used to
analyze regulated content, DSPM surfaces this activity and recommends actions
such as restricting access or applying other protections.

 Monitor data access patterns and identify shadow AI usage. DSPM tracks
how apps and services interact with organizational data, including both Microsoft
and non-Microsoft AI tools. For example, if an unauthorized app attempts to
access sensitive data, DSPM can flag the activity and guide remediation.

Gain visibility through integrated reporting and analytics

DSPM includes built-in reporting and analytics capabilities that provide centralized
visibility into how sensitive data is accessed, processed, and exposed across AI-driven
workflows. These capabilities are integrated into the DSPM experience and serve as
the foundation for monitoring, investigation, and policy enforcement.

Key reporting features include:

 Activity Explorer views. Provide visibility into AI interactions, including prompts and
responses, along with associated sensitivity labels and policy matches.
 Audit logs. Capture detailed records of user and AI activity, supporting investigation
and compliance scenarios.
 Oversharing assessments. Help identify where sensitive data might be
overexposed and guide remediation efforts.
 Data risk assessment reports. Summarize patterns of sensitive data usage and
user behavior across the organization, including AI-related interactions.

Together, these capabilities enable admins to monitor AI usage, detect risks, and
apply protection controls based on real-time insights, all within a single, unified DSPM
experience.

Content Search and eDiscovery in Microsoft Purview

Legal and compliance investigations often require searching for specific content
across the organization’s digital assets. Microsoft Purview’s Content Search and
eDiscovery tools provide robust capabilities for locating, reviewing, and preserving
information in response to legal requests, audits, or internal investigations. For
admins, effectively using these tools is essential for supporting compliance and
mitigating risk.

Content Search enables admins to search across mailboxes, SharePoint sites,

OneDrive, and Teams using keywords, sender information, dates, and sensitivity
labels. The platform supports both Keyword Query Language (KQL) and graphical user
interface (GUI) filters, making it accessible to users with varying levels of technical
expertise. Results can be exported for review or archiving, ensuring that relevant
information is preserved.

eDiscovery in Microsoft Purview comes in two editions, Standard and Premium.

 eDiscovery (Standard) offers basic search, export, and legal hold features.
 eDiscovery (Premium) adds advanced capabilities such as case management, review
sets, analytics, and redaction.

For example, in a legal case, a compliance officer might use eDiscovery Premium to
place a hold on a departing employee’s mailbox and OneDrive, review conversations
in Teams, and export findings for legal review.

Key features and examples of Content Search and eDiscovery in Microsoft Purview
include:

 Content Search across Microsoft 365. Admins can search for emails,
documents, and chats using keywords, sender/recipient details, and date ranges.
For example, if an investigation requires all communications related to a specific
project, Content Search can quickly locate relevant messages and files across
multiple platforms.

 eDiscovery (Standard and Premium). eDiscovery (Standard) provides

essential tools for searching and exporting content, and placing legal holds to
prevent data deletion. eDiscovery (Premium) enhances these capabilities with
case management, analytics (such as identifying near-duplicate documents and
common themes), and redaction features. In practice, a compliance officer might
use Premium to manage a complex legal case, ensuring all relevant data is
preserved, reviewed, and protected.

 Legal hold and review sets. Legal hold prevents data from being altered or
deleted during an investigation. Review sets allow admins to organize and
analyze collected content, making it easier to identify key evidence. For example,
during a legal dispute, placing a hold on an employee’s mailbox and OneDrive
ensures that all relevant communications and files are available for review.

Explore oversharing and data

access governance in
SharePoint
Oversharing in SharePoint Online is a growing concern for organizations that rely on
cloud-based collaboration. As teams become more distributed and data sharing
becomes essential for productivity, the risk of exposing sensitive information to
unintended audiences increases. For admins, understanding the nuances of data
access governance is critical, not only to protect organizational assets but also to
comply with privacy and regulatory requirements.

The challenge of oversharing often arises from the convenience of modern sharing
features. With just a few selections, users can grant access to documents, folders, or
 entire sites, sometimes without fully considering the implications. While this ease-of-
use drives collaboration, it also opens the door to accidental data leaks, unauthorized
access, and compliance violations. Admins must balance the need for open
communication with the imperative to safeguard sensitive data, making governance a
central part of their role.

This unit is designed to demystify the technical aspects of SharePoint sharing and
governance. It examines how to identify oversharing, use built-in and advanced tools
to monitor and remediate risky sharing, and implement policies that prevent future
incidents.

What is oversharing?
Oversharing occurs when users grant broader access to SharePoint content than is
appropriate or intended. It can happen in several ways, such as.

 Sharing documents with “Everyone” or “Anyone with the link”

 Providing edit access when view-only is sufficient
 Allowing external guest users full site access

For admins, recognizing the signs of oversharing is the first step toward effective
governance.

The risks associated with oversharing are significant. When sensitive or regulated data
is exposed to unauthorized users, organizations face compliance, privacy, and security
threats. These risks are amplified in environments where users are unaware of the
consequences of their sharing actions. For example, a user might share a confidential
financial report with a broad audience, not realizing that external partners or even
anonymous users could access it.

Common oversharing scenarios include:

 Sharing with “Everyone” or “Anyone with the link”. When a document is

shared using these options, it becomes accessible to anyone inside or outside the
organization who obtains the link. For example, a project plan intended for
internal review could be forwarded to external vendors, leading to unintended
disclosure of proprietary information.

 Providing Edit access instead of View-only. Granting Edit permissions allows

recipients to modify content, potentially introducing errors or unauthorized
changes. A marketing brochure shared with Edit rights could be altered by
external partners, resulting in inconsistent messaging or branding.

 Allowing external guest users full site access. External guests might need
access to specific documents, but granting them full site access exposes all site
content. For instance, a guest invited to collaborate on a single file might
inadvertently gain access to HR records stored elsewhere on the site.

Understanding oversharing isn't just about knowing what it is; it’s about recognizing
its impact. Admins must be able to identify oversharing scenarios, educate users on
 secure sharing practices, and implement controls that limit exposure. Users who
become proficient in these skills can help their organizations avoid costly data
breaches and maintain trust with stakeholders.

Tools for identifying and troubleshooting oversharing

Effectively managing oversharing requires robust tools for detection and remediation.
SharePoint and Microsoft 365 provide several options for admins to monitor sharing
activity and address risks. These tools range from built-in reports to advanced
scripting and automation capabilities.

The Microsoft 365 Admin Center and SharePoint Admin Center offer sharing reports
that give visibility into:

 Who shared what

 Who has access
 The status of external sharing

These reports can be filtered by site, folder, or file, allowing admins to pinpoint risky
sharing events. For example, you might discover that a sensitive contract was shared
externally, prompting immediate action to revoke access.

For larger environments or more granular control, PowerShell and Microsoft Graph API
enable admins to audit access at scale. Automated scripts can periodically scan for
documents shared with “Anyone with the link” or those containing sensitive labels like
“Confidential.” Alerts can be set up to notify admins when high-risk sharing occurs,
ensuring timely intervention.

Key tools and techniques to help prevent oversharing include:

 Sharing reports. These reports provide a snapshot of sharing activity across

your SharePoint environment. Admins can review permissions at the site, folder,
or file level, which helps identify who has access to critical documents and
whether external sharing is enabled. For example, a Sharing report might reveal
that a financial spreadsheet was shared with external auditors, allowing you to
verify compliance with company policy.

 PowerShell and Graph API. PowerShell enables admins to audit user access
and external sharing. Microsoft Graph API offers similar capabilities with more
flexibility for automation. For instance, you can run a script to identify all
documents labeled “Confidential” that were shared with external users, enabling
targeted remediation.

 Automated audits and alerts. Automation is essential for maintaining ongoing

oversight. Admins who schedule regular audits and configure alerts can
proactively detect oversharing events. For example, an automated workflow
might scan for files shared with anonymous links and send an alert if sensitive
content is found.

Best practices to prevent oversharing

 Preventing oversharing in SharePoint requires a combination of technical controls,
user education, and process discipline. Sensitivity labels with encryption are a
powerful tool for limiting who can open or download shared files. By setting
organization-wide sharing limits in the SharePoint Admin Center, admins can disable
anonymous links and enforce stricter sharing policies.

User education is equally important. Prompts and tooltips within SharePoint can guide
users toward secure sharing practices, helping them understand the risks and
responsibilities associated with sharing content. Automated alerts can notify admins
when high-risk sharing occurs, enabling rapid responses to potential incidents.

Ultimately, the key to preventing oversharing is a proactive approach. Admins who

combine technical controls with ongoing education and monitoring can create a
culture of security and compliance. Doing so not only protects organizational data but
also empowers users to collaborate confidently and responsibly.

The following best practices combine technical controls and user-focused strategies to
help admins prevent oversharing and maintain secure collaboration in SharePoint
environments:

 Sensitivity labels and encryption. Applying sensitivity labels to documents

ensures that only authorized users can access sensitive content. For example, a
confidential HR report labeled with encryption can only be opened by members of
the HR team, even if the link is shared externally.

 Organization-wide sharing limits. Setting sharing limits at the organizational

level prevents users from creating anonymous links or sharing content with broad
audiences. For instance, disabling anonymous links ensures that only
authenticated users can access shared documents, reducing the risk of accidental
exposure.

 User education and automated alerts. Educating users about secure sharing
practices is essential for preventing oversharing. Tooltips and prompts within
SharePoint can remind users to check permissions before sharing. Automated
alerts can notify admins when sensitive content is shared externally, enabling
quick remediation.

Data Access Governance (DAG) reports in SharePoint

DAG reports are a powerful feature in SharePoint for identifying high-risk sites and
guiding remediation efforts. For admins, DAG reports are an essential tool for
maintaining compliance and security. These reports provide insights into:

 Sites with sensitive content and excessive sharing

 Sites where owners are inactive
 Sites lacking assigned sensitivity labels

The process of generating and analyzing DAG reports is straightforward. Admins can
access these reports through the SharePoint Admin Center, selecting the report type
that best fits their needs—such as “Sites with external access and sensitivity labels.”
 Once downloaded, the findings can be reviewed to identify sites that require
immediate attention, such as sites with guest access or missing sensitivity labels.

DAG reports aren’t just for detection; they’re a roadmap for remediation. By targeting
sites with the highest risk, admins can take action to:

 Revoke guest access

 Apply stricter sharing settings
 Assign appropriate sensitivity labels

This targeted approach ensures that resources are focused where they’re needed
most, reducing the likelihood of data breaches.

The following key actions illustrate how DAG reports can identify risks and guide
targeted remediation efforts within your SharePoint environment:

 Identifying high-risk sites. DAG reports highlight sites with sensitive content
that are shared excessively or lack proper labeling. For example, a report might
show that a legal team’s SharePoint site contains confidential contracts and is
accessible to external users, prompting a review of sharing settings.

 Inactive site owners. Sites without active owners pose a governance risk, since
there might be no one responsible for managing access. DAG reports can flag
these sites, allowing admins to assign new owners or restrict access until proper
oversight is established.

 Remediation steps. After they analyze DAG findings, admins can take targeted
actions such as revoking guest access, applying sensitivity labels, or disabling
external sharing. For instance, a site used for product development might have
guest access revoked and sensitivity labels applied to all documents.

Advanced governance features in SharePoint

Advanced Management (SAM)
SAM is a paid add-on that provides advanced governance features for SharePoint. It’s
designed for organizations that require:

 Granular control over site access

 Activity monitoring
 Integration with conditional access policies

For admins, SAM offers tools that go beyond native SharePoint capabilities, enabling
proactive management of data access. One of SAM’s key features is restricted site
access, which prevents unauthorized users from accessing sites with sensitive data.
This feature is particularly useful for teams handling confidential information, such as
finance or HR. SAM also includes inactivity alerts, which detect and act on sites that
aren't used for a defined period, helping to reduce the risk of stale or abandoned sites
becoming security liabilities.
Site access reviews are another valuable feature, prompting site owners to
periodically review and confirm permissions. Doing so ensures that access remains
appropriate over time and that outdated permissions are removed. SAM’s integration
with conditional access policies allows admins to require multifactor authentication
(MFA) or block access based on device compliance or location, adding an extra layer
of security.

The following advanced capabilities offered by SharePoint Advanced Management

empower administrators to implement granular governance and strengthen data
protection across SharePoint sites:

 Restricted site access. SAM enables admins to restrict access to sites

containing sensitive data, ensuring that only authorized users and compliant
devices can connect. For example, a finance team’s SharePoint site might be
configured to allow access only from devices managed by Intune, reducing the
risk of data leaks from unmanaged endpoints.

 Inactivity alerts. Sites that aren’t accessed for a specified period can be flagged
for review or automatically restricted. Doing so helps prevent abandoned sites
from becoming targets for unauthorized access. For instance, a project site that
wasn't used in six months might trigger an alert, prompting the admin to archive
or secure the content.

 Site access reviews and conditional access integration. Periodic access

reviews ensure that permissions remain current, while conditional access policies
enforce security requirements like MFA. For example, site owners might receive
prompts to review access lists. Or users might be required to authenticate with
MFA before accessing sensitive sites.

Explore data protection in

Microsoft 365 Copilot
Microsoft 365 Copilot introduces a powerful set of generative AI features that help
users work more efficiently with content stored across Microsoft 365 services like
Word, Excel, Outlook, Teams, SharePoint, and OneDrive. However, with great power
comes increased concern, particularly from IT and security teams who must
understand how data is accessed, secured, and governed. Admins and IT professionals
need clarity on how Copilot functions within the Microsoft 365 ecosystem, especially
regarding data access boundaries and security models.

One of the most common misconceptions—that Copilot “sees everything” or can leak
information between users—isn’t true. Copilot inherits the same access controls and
restrictions as the authenticated user. Its data retrieval mechanisms operate through
Microsoft Graph, which serves as the API layer supporting all Microsoft 365 services.
Admins who understand this architectural design can make informed decisions about
policy enforcement and risk assessment.
This training also demystifies how Microsoft tools like Microsoft Graph, Microsoft
Purview, and Defender for Cloud Apps work together to ensure safe, permissioned,
and auditable access to data through Copilot. By the end of this unit, you should
understand what Copilot can and can’t access, how it obeys security policies, and how
admins can audit and control its behavior. This knowledge is essential for securely
deploying Copilot in any enterprise environment without compromising sensitive data.

How Microsoft 365 Copilot accesses data

Understanding how Microsoft 365 Copilot accesses organizational data is foundational
to managing its security and compliance posture. Many admins are justifiably cautious
when introducing AI into environments with sensitive business information.
Fortunately, Copilot operates within strict boundaries. It doesn’t introduce any new
mechanisms for accessing data. Instead, it uses the existing Microsoft 365
infrastructure that’s already familiar to IT pros. In doing so, it respects the same
authentication, authorization, and auditing principles already in place.

Copilot operates entirely within Microsoft Purview compliance boundaries—your

organization’s data protection framework—so it doesn’t transmit data outside your
tenant or to non-Microsoft services. It accesses data through Microsoft Graph, using
the identity and permissions of the currently signed-in user. In simpler terms: Copilot
is only allowed to see what the user is already allowed to see. It can’t reach
into sensitive HR files, executive folders, or private Teams channels unless the user is
granted access to those locations.

The practical implications of this data security principle are significant. Admins don’t
need to fear that Copilot can leak sensitive content across departments or expose
data between users. If proper permission models are already in place—such as
SharePoint security groups, OneDrive sharing settings, and Purview data governance
policies—then Copilot respects and enforces those same access controls. Admins can
focus on refining existing configurations rather than implementing a separate security
model just for Copilot.

Copilot accesses data across multiple Microsoft 365 services, including:

 Outlook. Copilot can summarize long email threads, draft responses, and help
schedule meetings. However, it can only reference emails and calendar events
the user can access directly.

 Word, Excel, and PowerPoint. Copilot can generate content, summarize

documents, or analyze data based on files stored in OneDrive or SharePoint, as
long as the user has access.

 Teams. It can summarize meetings, surface chat history, or generate recaps, but
again, only from Teams channels or messages the user is authorized to view.
  OneDrive and SharePoint. Copilot can search and retrieve content from cloud
storage repositories the user has permission to access. These repositories include
personal files and shared organizational libraries.

Copilot can’t bypass existing file permissions. If a user can’t open a document
manually, Copilot can’t interact with that content on their behalf. For example, if a
document in SharePoint is restricted to the Finance department, and the user isn’t
part of that department, Copilot can’t summarize, reference, or extract insights from
it. Why? Because it simply doesn't have access to it through the user’s Graph context.

For example, suppose a Marketing team member asks Copilot, “Summarize last
quarter’s finance report.” If that report resides in a SharePoint folder restricted to the
Finance department, Copilot’s response should indicate that no such file can be found.
Why? Because the user can’t access it. This principle is critical for admins to
understand: Copilot can only access information that the user already has permission
to see.

Microsoft Graph and its influence on Copilot

To understand how Copilot retrieves and interacts with data, it’s essential to grasp the
role of Microsoft Graph. Microsoft Graph is the centralized data access layer for the
entire Microsoft 365 ecosystem. Everything from reading your Outlook calendar, to
retrieving SharePoint documents, to identifying Teams chat messages is done through
Graph APIs. For Copilot, Microsoft Graph isn’t optional. Graph is the only way Copilot
accesses and interprets user data. This relationship makes it a critical focus for any IT
admin managing security and permissions.

Graph acts like a secure gateway, enforcing access control checks at every query.
When Copilot processes a user request—such as “Summarize all recent project
updates”—it does so by querying Microsoft Graph using the user’s OAuth token. This
token enforces authentication and authorization rules based on that user's identity
and role. Graph also adds intelligence to queries, allowing Copilot to filter and rank
results using context, such as document recency, user activity, and relationship
graphs. It isn’t a simple keyword search; rather, it’s a semantic, permission-respecting
retrieval engine.

The term “semantic” refers to the ability of a system such as Microsoft Graph to
interpret the meaning behind words, phrases, and data, rather than just matching
exact keywords. It’s about grasping concepts, relationships, and context. In Graph,
this understanding is achieved through a semantic index, which transforms content
into vectors. These vectors, which are mathematical representations of meaning,
allow the system to:

 Recognize similar ideas even if phrased differently.

 Understand organizational jargon and natural language.
 Retrieve contextually relevant results based on meaning, not just literal matches.

Microsoft Graph builds a semantic index from content across Microsoft 365 apps
(Word, Outlook, Teams, SharePoint, and so on). This index:

 Maps content and signals into a graph structure.

 Uses embeddings to represent documents, emails, meetings, and users in a way that
captures their semantic relationships.
 Enables Copilot and other tools to interpret user prompts more intelligently by refining
search and retrieval based on intent rather than syntax.

For example, if a user searches for “project kickoff,” semantic understanding allows
Microsoft Graph to return documents or emails about “launch meetings” or “initial
planning,” even if those exact words weren’t used.
Admins should understand that optimizing data retrieval through Copilot means
understanding Graph's influence. A poorly organized Teams environment, an
unstructured SharePoint library, or overly permissive sharing configurations can result
in Copilot surfacing irrelevant or excessive data. On the flip side, well-managed
structures and deliberate metadata usage can help Copilot return faster, more
relevant, and more secure responses. Ultimately, Microsoft Graph is the nervous
system of Microsoft 365, and Copilot is just one of many apps that depends on it.

When Copilot receives a user prompt—such as "Summarize my last meeting with the
Engineering team"—it formulates a query against Microsoft Graph. In turn, Graph
takes into account:

 User context tokens. OAuth tokens represent the user identity and
authorization scope. Graph ensures that any request made by Copilot is made "on
behalf of" the user, and is only allowed access to what that user can access
directly.

 Search relevance and semantic understanding. Graph uses deep semantic

understanding and contextual signals to refine query results. For example, if the
prompt references "engineering team," Graph analyzes Teams memberships,
recent chat activity, and calendar invites to interpret what content is relevant.

 Temporal and contextual filters. If the query refers to “last week’s meeting,”
Graph interprets that time window and searches relevant calendar entries,
meeting recordings, notes, and associated chat threads.

Additionally, Graph collects signals from user activity to improve prompt relevance
and performance.

 File activity. Recently accessed or edited files are ranked higher in response.

 Sharing signals. Files shared directly with the user, or shared widely within a
team or org, are prioritized.

 Content insights. Metadata such as document titles, autogenerated content

summaries, and references to people or topics within files improve the quality of
the AI response.

For admins, Copilot’s intelligence depends on how well data is structured, governed,
and shared across the organization. Disorganized or siloed content can reduce the
usefulness of Copilot’s output.
Copilot security and permissions model
Security and access control are at the heart of every IT admin’s responsibilities, and
Copilot doesn’t change that. In fact, Microsoft 365 Copilot doesn’t bypass or
circumvent any security models. Copilot operates under the exact same
permission models as all other Microsoft 365 services. So if your users already
have permissions that limit what they can see in OneDrive, SharePoint, Teams, and
Exchange Online, then Copilot uses those same permissions. It can’t "see" anything
the user can’t already access directly.

The security model includes support for Sensitivity Labels, Data Loss Prevention (DLP)
rules, Information Protection policies, and Conditional Access. Copilot respects all
these policies. If a document is labeled “Highly Confidential” and configured to restrict
sharing outside a group, Copilot obeys those restrictions during its data retrieval and
response generation process. Likewise, if a DLP policy prevents the extraction of
sensitive customer data, Copilot doesn’t violate that policy by surfacing it in a prompt
response.

It’s also important to understand how link-based sharing interacts with Copilot. If a
user has access to a document through an anonymous sharing link (“Anyone with the
link”), and that link is active and the user is authenticated, Copilot can access that
content. But if that link expires or is revoked, Copilot access disappears as well.
Admins should pay close attention to link-based sharing, especially when documents
contain sensitive or regulated content. Regular auditing and access review processes
are essential to keeping your Copilot environment secure.

 Shared file behavior. If a user has access to a file through a link ("Anyone with
the link"), Copilot can access and use that file’s contents. However, if the link
becomes invalid or expires, or if access is revoked, Copilot is no longer be able to
include that file in responses. This design makes it critical to monitor link-based
sharing behavior, especially for sensitive content.

 Purview sensitivity labels and DLP. Admins can define policies in Microsoft
Purview to label sensitive content, enforce encryption, and prevent data leakage.
Copilot respects these labels and doesn’t surface or use labeled content in
responses if policy rules prevent it. For instance, if a document is labeled
“Confidential – Finance Only,” Copilot excludes it from analysis unless the user is
part of the Finance group and the label permits access.

 Microsoft Defender for Cloud Apps and Conditional Access. These tools
allow admins to define granular access conditions, such as restricting access from
unmanaged devices or certain IP ranges. If a conditional access policy blocks a
user from opening SharePoint documents from a personal laptop, then Copilot on
that device similarly can’t process content from those sources.

Admins can use these tools not only to secure access, but to audit and monitor
Copilot's behavior. Defender and Purview can track when Copilot was used, what data
was queried, and whether any policy violations occurred. This process allows for
proactive enforcement of compliance and security standards, especially in regulated
industries.
AI safety and responsible AI principles
With AI systems like Microsoft 365 Copilot, safety and ethical use are as important as
technical security. Microsoft follows a comprehensive Responsible AI framework that
governs how Copilot behaves when processing and generating content. These
principles aren’t just theoretical. In fact, they translate directly into product features
and guardrails that IT admins can depend on to protect users, data, and the
organization’s reputation. Responsible AI is enforced both at the infrastructure level
and within the Copilot application itself.

One of the cornerstones of responsible AI in Copilot is data minimization. Copilot is

designed to fetch only the data necessary to fulfill a specific user request. It doesn’t
indiscriminately crawl through user mailboxes or file systems. This process ensures
that data exposure is minimized by design. Alongside data minimization, transparency
is built in. Users can always see where Copilot got its information from, and every
generated answer includes source references that users can select to validate the
content. This process builds trust and auditability into the user experience.

For example, suppose a user asks Copilot, “What is our Q4 forecast?” If no accessible
document or Excel file contains a Q4 forecast, Copilot doesn’t make one up. Instead, it
responds with a message such as “No forecast data was found in your documents.”
This behavior is intentional and governed by Microsoft’s responsible AI commitments
to prevent incorrect responses or false confidence in generated content.

Microsoft also enforces content filtering, ensuring that inappropriate, unverified, or

harmful content isn’t surfaced. For example, if a file contains offensive language or is
flagged for policy violations, Copilot can be configured to exclude that content. Finally,
every Copilot interaction is logged, allowing admins to audit usage and trace data
access events through Purview or Microsoft 365 audit logs. This process is particularly
important for regulated industries where compliance and oversight are mandatory.

Copilot embraces the following principles, making it a manageable and transparent AI

solution rather than a black box:

 Data minimization. Copilot retrieves only the data necessary to complete a

task. When a user asks Copilot to summarize their meetings from the last week,
the system doesn’t search the entire mailbox or document library. Instead, it
narrows its focus to relevant time ranges, Teams chats, and calendar items. By
doing so, it minimizes exposure of irrelevant or unrelated data.

 Transparency. When Copilot generates a response, it provides links to the

source files and content used to create the answer. Doing so enables users to
verify the response and ensures accountability. For example, a user asking for a
project status summary can navigate through to the exact Excel file or Teams
chat that Copilot used to compile the summary.

 Content filtering. Microsoft uses filters to block the inclusion of harmful,

offensive, or unverified content in Copilot responses. If a document includes
inappropriate language, or if the AI detects a high level of uncertainty, the
 content is either excluded or Copilot warns the user. This process helps avoid
legal or reputational risk.

 Auditability. All Copilot interactions are logged, including prompt history, data
accessed, and AI responses. Admins can view these logs using Microsoft Purview
and Microsoft 365 audit logs. This traceability is vital in highly regulated
environments where demonstrating proper data access controls is a compliance
requirement.