Microsoft Purview and Data Governance

Microsoft Purview is a unified data governance and compliance solution that brings together capabilities for data cataloguing, classification, labelling, and protection across an organisation's entire data estate. It covers on-premises data, Azure data services, Microsoft 365, and even data in other clouds. Purview gives organisations a single pane of glass for understanding where sensitive data lives and ensuring it is protected.

Microsoft Purview was formed by merging the former Azure Purview (data governance) and Microsoft Compliance Manager (compliance management) products into a single unified portal. The result includes two main areas:

• Purview Data Governance — discover and classify data across sources
• Purview Risk & Compliance — sensitivity labels, DLP policies, and insider risk management

The Purview Data Map is the foundation of data governance in Purview. It automatically scans registered data sources — including Azure SQL, Blob Storage, ADLS, on-premises SQL Server, and Power BI — and builds a metadata catalogue of all discovered assets. Each asset is described with its schema, data types, classification labels, and lineage (where the data came from and where it goes).

After registering a data source, you configure a scan — an automated process that connects to the data source, reads the metadata and a sample of data, and applies classification rules to identify sensitive content. Purview includes over 200 built-in classifiers for common sensitive data types like credit card numbers, social security numbers, passport numbers, and healthcare identifiers.

Sensitivity labels are tags applied to documents, emails, and data assets to indicate their sensitivity level. Common labels include Public, General, Confidential, Highly Confidential. Labels are defined in the Purview compliance portal and can be applied manually by users or automatically based on content classification. Once labelled, the label travels with the document and controls what protections are applied.

Data Loss Prevention (DLP) policies in Purview automatically detect and protect sensitive information from being shared inappropriately. For example, a DLP policy can block an email containing a credit card number from being sent to an external address, or prevent a file labelled 'Highly Confidential' from being uploaded to a personal OneDrive. DLP policies apply across Microsoft 365 services, Teams, SharePoint, and Azure services.

Data lineage tracks the journey of data from its origin through transformations to its final destination. In Purview, lineage diagrams show you how data flows through Azure Data Factory pipelines, Azure Synapse Analytics, and other services. This is valuable for compliance (proving data provenance to auditors) and for root-cause analysis (tracing errors back to source data issues).

Insider Risk Management in Purview detects potential data exfiltration by employees using signals from Microsoft 365 activity (downloading large volumes of files, sending sensitive data to personal email, accessing data outside normal hours). It uses machine learning to build risk profiles and generates alerts for security teams to investigate. All analysis respects user privacy through pseudonymisation until an investigation is opened.

The Purview Data Catalog is a searchable inventory of all data assets discovered and registered in the data map. Data engineers, analysts, and compliance officers can search for assets by name, type, classification, or label. Each asset page shows its schema, sample data, classification results, sensitivity label, lineage, and ownership. This enables data democratisation while maintaining governance controls.

eDiscovery in Purview allows legal and compliance teams to search for, preserve, and export content from Microsoft 365 services for legal proceedings. The Audit capability provides a tamper-evident log of user and admin activities across Microsoft 365 and Azure, enabling forensic investigation of security incidents. Both capabilities are essential for regulated industries with strict evidence preservation requirements.

Purview and Azure Policy complement each other: Purview identifies where sensitive data lives and classifies it, while Azure Policy enforces technical controls — for example, denying the creation of storage accounts without encryption, or requiring diagnostic logs to be enabled on all SQL databases. Together they form a governance framework where both data sensitivity and resource configuration are actively managed.

Test your understanding of Microsoft Azure Fundamentals (AZ-900) concepts from this lesson.

In this lesson you learned: Microsoft Purview provides a unified platform for data governance, classification, and compliance; the Data Map auto-discovers and classifies sensitive data across your entire data estate; and DLP policies and sensitivity labels prevent sensitive data from being shared or accessed inappropriately. Next up we explore Microsoft Compliance Manager for assessing and tracking your compliance posture.