Data Security and Protection with Microsoft Purview

radio_button_uncheckedshort_text 1. Introduction: from the perimeter to the data

For decades, information protection was mainly associated with the place where it was stored. Files remained on internal servers, private networks, and physical cabinets. With the internet, mobile devices, cloud collaboration, and remote work, data began to circulate through email, SaaS applications, endpoints, and partner organizations. The old perimeter no longer kept up with the content.

The modern response is a data-centered strategy: discover what exists, recognize sensitivity, apply persistent protection, control risky movements, and investigate exposures. Microsoft Purview brings together capabilities to carry out this cycle across Microsoft 365 services, endpoints, hybrid environments, and selected integrations.

For the reader, this knowledge helps to distinguish tools that look similar but solve different problems. For society, classification controls, exposure minimization, and responsible research reduce leaks of personal, financial, medical, and intellectual information. The challenge is not only to prevent sharing: it is to allow legitimate collaboration without losing visibility and control.

radio_button_uncheckedshort_text 2. Microsoft Purview portal and conceptual architecture

The Microsoft Purview portal offers a unified experience for data security, governance, risk, and compliance solutions. It centralizes navigation, functions, reporting, policies, and investigations, although each solution maintains its own concepts, permissions, and licensing requirements.

2.1 The three verbs of Information Protection

2.2 Complementary solutions

Information Protection classifies and protects. DLP controls actions and destinations. Insider Risk Management correlates behavioral signals. Adaptive Protection adjusts controls based on risk. DSPM consolidates posture and exposure. Data Security Investigations supports incident analysis and impacted data. None of these capabilities, on their own, represents the entire strategy.

Key point for the SC-900

The exam tests the purpose of the solutions. Memorizing the name is insufficient: identify which question each resource answers.

radio_button_uncheckedshort_text 3. Data discovery and classification

Classifying data means associating content with a category that represents its meaning, sensitivity, or processing obligation. This classification can be detected automatically, applied by people, recommended by policies, or imported from integrations. The result guides protection, DLP, retention, investigation, and reporting.

3.1 Classification is not the same as a label

A classification mechanism recognizes content features, such as a card number, contract, or offensive language. A sensitivity label is a persistent mark chosen or applied to the item and can enforce protection. Content can be classified without receiving a label, and a label can be applied manually even when no automatic detector found a match.

3.2 Trust, quantity, and proximity

Classification rules evaluate evidence. A single number may not be enough; nearby words, format, checksum, and number of occurrences increase confidence. Setting confidence levels helps balance false positives and false negatives.

radio_button_uncheckedshort_text 4. Types of confidential information

sensitive information types, or SITs, identify patterns associated with sensitive data. Microsoft provides built-in types for personal, financial, health information, and identifiers from various countries. Administrators can also create custom types or adjust the existing ones.

4.1 Exact Data Match

Exact Data Match increases accuracy when the organization needs to detect values that truly belong to a known database, such as customer identifiers. Instead of blocking any sequence with a similar format, the policy seeks a match with data prepared and protected by the organization.

4.2 Digital printing of documents

Document fingerprinting creates a type of information from a form or standard template. It is useful when many documents share the same structure, such as regulatory forms, contracts, or intellectual property templates.

radio_button_uncheckedshort_text 5. Trainable classifiers

Trainable classifiers identify categories by the overall meaning of the content, and not just by fixed sequences. Microsoft provides built-in classifiers, and organizations can train custom classifiers using sets of positive and negative examples selected by people.

5.1 Training process

• Collect representative items that belong to the desired category.
• Collect similar items that do not belong to the category.
• Train the model and test the ability to distinguish the groups.
• Review false positives and false negatives before use in production.
• Apply the classifier in compatible scenarios, such as labeling, retention, or specific policies.

5.2 When to use

They are suitable for contracts, resumes, legal documents, communications, or content whose meaning depends on context. An SIT is better for structured patterns; a classifier is more useful for categories without a simple textual signature.

radio_button_uncheckedshort_text 6. Content Explorer and Activity Explorer

Classification creates value when administrators can turn detections into visibility. The two explorers offer distinct and complementary perspectives on the data assets.

6.1 Content Explorer

Allows browsing by classified items, labels, information types, classifiers, and locations. Depending on the role and configuration, authorized users can examine metadata or content to validate policies. Access must follow least privilege, segregation of duties, and auditing.

6.2 Activity Explorer

It presents labeling events, label changes or removals, sharing, DLP matches, and other recorded activities. Filters by user, location, activity type, label, and period help identify trends and anomalies.

Privacy and governance

The ability to view sensitive content is powerful. Therefore, permissions, justification, auditing, and periodic review are essential.

radio_button_uncheckedshort_text 7. Sensitivity labels

Sensitivity labels classify and can protect content, containers, and compatible experiences. They act as a persistent mark stored in the item's metadata. An organization can create a taxonomy aligned with the business, such as Public, Internal, Confidential, and Highly Confidential.

7.1 Essential properties

• Customizable for the language and hierarchy of the organization.
• Stored in plain text in the metadata, allowing integration with applications and services.
• Persistent: remain associated with the content when it is moved or copied.
• They can be applied without protection, only for classification and reporting.
• They can control documents, emails, meetings, sites, groups, and other supported containers.

7.2 One item and two different objectives

A document can simultaneously have a sensitivity label and a retention label. The first deals with classification and protection; the second deals with lifecycle, retention, and disposal. Confusing these concepts is a common trap.

radio_button_uncheckedshort_text 8. Publication and enforcement policies

Creating a label does not automatically make it available. A label policy determines which users and groups can see it and which experience settings will be applied.

8.1 Manual, recommended, and automatic application

In manual application, the user decides. In recommendation, the system finds sensitive content and suggests a label. In automatic application, the policy labels when the conditions are met. Automation increases scale, but it requires testing, simulation, and impact review.

8.2 Standard labels do not replace classification

A standard label reduces unclassified content, but it does not understand the context by itself. The organization should combine standards, training, communication, and automation proportional to the risk.

radio_button_uncheckedshort_text 9. Encryption, permissions, and tags

9.1 Identity-based cryptography

A label can encrypt documents and emails and restrict which users or groups can open, edit, copy, print, or forward. Authorization is verified by the protection service; thus, the file can remain protected outside the original repository.

9.2 Permissions set by the administrator or user

The administrator can predefine who will have access, or allow the user to choose recipients when applying the label. The first option standardizes; the second offers flexibility, but requires guidance and governance.

9.3 Headers, footers, and watermarks

Content markings communicate sensitivity visually. Headers and footers can include the label name, owner, or other variables. Watermarks discourage misuse, but do not replace encryption or access controls.

radio_button_uncheckedshort_text 10. Data Loss Prevention

Data Loss Prevention , or DLP, helps to identify and control the use and sharing of sensitive items. A policy combines locations, conditions, exceptions, actions, alerts, and user experience. The goal is not to block indiscriminately, but to apply proportional and observable protection.

10.1 Possible actions

• Audit the occurrence without interfering in the action.
• Show Policy Tip to educate the user at the moment of the activity.
• Send alert to administrators or persons in charge.
• Block sharing or restrict access to the item.
• Allow replacement with justification in authorized scenarios.
• Generate events that feed reports, alerts, and investigations.

10.2 Test mode and gradual deployment

Before imposing blocks, an organization can simulate or test policies to measure impact. This step allows adjusting confidence, quantity, groups, exceptions, and destinations without disrupting legitimate processes.

radio_button_uncheckedshort_text 11. DLP in Exchange, SharePoint, OneDrive, and Teams

11.1 Teams Files

Files shared in Teams are stored in SharePoint or OneDrive; therefore, the protection of these repositories also applies to the files. Chat and channel messages have their own handling and specific licensing requirements.

11.2 DLP and labels

A DLP policy can use information types, classifiers, or labels as a condition. A label can encrypt; DLP can prevent the item from being sent to a prohibited destination. The controls work together.

radio_button_uncheckedshort_text 12. Endpoint DLP

Endpoint DLP extends policies to activities performed on supported and integrated Windows devices. The focus shifts from the repository to the user's local action.

12.1 Restrictions by group and context

Administrators can differentiate applications, domains, browsers, printers, shares, and devices. The policy must reflect real processes; overly broad rules can cause fatigue, manual workarounds, and loss of productivity.

Defense in depth

Endpoint DLP does not replace EDR, antimalware, device control, or identity management. It adds sensitivity context to actions on data.

radio_button_uncheckedshort_text 13. Insider Risk Management

Microsoft Purview Insider Risk Management correlates signals to identify potentially malicious or accidental activities, such as intellectual property being copied before shutdown, unusual sharing, policy violations, or misuse of data. The solution is policy-driven and incorporates privacy controls, such as pseudonymization by default, roles, and auditing.

13.1 Main components

13.2 Risk does not mean blame

An alert indicates activity that deserves analysis, not proof of malicious intent. Investigations must respect privacy, labor laws, proportionality, segregation of duties, and human review.

radio_button_uncheckedshort_text 14. Adaptive Protection

Adaptive Protection connects internal risk to preventive controls. Depending on the factors defined by the organization and the observed signals, users receive adaptive levels, which can change continuously. DLP, lifecycle, or Conditional Access policies can respond to these levels.

14.1 Example of adaptive behavior

A lower-level user may only receive education and auditing. At a moderate level, sending sensitive data may require justification. At a high level, the organization may block exfiltration to personal destinations and apply additional access controls. The exact configuration is defined by the administrators.

14.2 Difference between risk level and alert severity

The adaptive level represents the dynamic condition assigned to the user for the application of controls. The severity of an alert represents the priority of an investigable event. They are related, but they are not the same metric.

radio_button_uncheckedshort_text 15. Data Security Posture Management

Data Security Posture Management, or DSPM , adopts a data-centered view. It helps to discover sensitive information, assess exposure, policy coverage, accesses and movements, and recommend actions to reduce risk. Instead of only looking at infrastructure, it asks where the data resides, who can access it, how it is used, and if it is properly protected.

15.1 Posture is not a single control

DSPM uses signals and insights from Information Protection , DLP, Insider Risk Management , and investigations. It provides a consolidated view, but remediation usually occurs by configuring these underlying solutions.

15.2 Objectives and recommendations

The organization can track data security objectives, trends, coverage gaps, and risky destinations. Recommendations help prioritize labels, DLP policies, access governance, and investigations, according to availability and licensing.

radio_button_uncheckedshort_text 16. Data Security Investigations

Data Security Investigations helps security teams analyze incidents involving exposure of sensitive data, risky users, and breaches. The solution can use generative AI capabilities to locate impacted items, analyze content, summarize findings, and support collaboration between security, privacy, legal, and business.

16.1 Questions answered by an investigation

• Which files, messages, or data were affected?
• What types of sensitive information were present?
• Who accessed or moved the content?
• To which destinations was the data sent?
• What is the potential impact and which actions should be prioritized?
• What evidence needs to be preserved and shared with the responsible teams?

16.2 AI with human validation

AI-generated analyses can accelerate screening and discovery, but do not replace validation. Results need to be confirmed against evidence, permissions, and context. Disciplinary, legal, or communication decisions require human process and governance.

Important distinction

DSPM identifies and prioritizes posture and exposure. Data Security Investigations delves into a concrete case to understand impacted data and support remediation.

radio_button_uncheckedshort_text 17. Integrated practical scenario

A financial services company prepares reports containing client data and strategic projections. The goal is to enable internal collaboration and with an external audit without allowing for sending to personal accounts or misuse by employees in the process of leaving.

17.1 Implementation

• A SIT identifies financial information and personal data; a classifier recognizes planning reports.
• The Highly Confidential label applies encryption, header, and watermark.
• The publication policy requires justification to reduce the label.
• DLP allows sharing with the audit domain, but blocks personal email and unauthorized storage.
• Endpoint DLP controls USB, printing, and browser upload.
• Insider Risk Management correlates repeated attempts and termination context.
• Adaptive Protection increases the strictness of DLP for high-risk users.
• DSPM shows exposure and gaps; an investigation analyzes the affected items and destinations.

radio_button_uncheckedshort_text 18. Comparisons and pitfalls of the SC-900

18.1 Recurring traps

• To claim that DLP is just blocking; it also audits, guides, alerts, and allows controlled substitution.
• Confusing a watermark with encryption.
• Confusing Content Explorer with Activity Explorer .
• Confusing sensitivity labels with retention labels.
• Treat insider alert as evidence of malicious action.
• To claim that DSPM replaces protection and prevention policies.
• Ignore licensing, permissions, privacy, and gradual rollout.

radio_button_uncheckedshort_text 19. Quick review for the SC-900 exam

radio_button_uncheckedshort_text 20. Conclusion

Microsoft Purview turns data security into a continuous cycle. The organization starts by discovering and classifying content, applies labels and persistent protection, controls risk movements with DLP, monitors internal behaviors, adapts controls, and investigates exposures. This integration is more important than any isolated feature.

The main takeaway is that sensitive data still requires protection when it moves between device, application, or organization. Labels follow the content; DLP assesses context and destination; Insider Risk adds behavior; DSPM provides posture visibility; investigations deepen the impact. Quality depends on clear taxonomy, testing, least privilege, privacy, and human review.

In my assessment, Microsoft Purview represents a necessary evolution: moving from controls focused solely on infrastructure to governance centered on the value and risk of the data. When implemented with balance, this approach protects people and organizations without hindering legitimate collaboration.

Next step on the trail

In Chapter 16, the focus shifts to compliance, retention, records, audit, Communication Compliance, Information Barriers, and eDiscovery.

radio_button_uncheckedshort_text 21. Review questions

Question 1: Which resource mainly answers the question 'where are the classified items'

of the organization?”

A) Activity Explorer B) Content Explorer C) Adaptive Protection D) Compliance Manager

Commented answer

Correct answer: B. Content Explorer allows you to explore items classified by label, information type, classifier, and location.

Question 2: Which statement correctly describes a sensitivity label ?

A) It is just a visual mark. B) It is used only for retention. C) It is a persistent classification that can apply encryption, permissions, and markings. D) It overrides all DLP policies.

Commented answer

Correct answer: C. The label is associated with the content and can enforce configured protection.

Question 3: What is the main purpose of Adaptive Protection ?

A) Create SOC reports. B) Adjust preventive controls according to internal risk levels. C) Replace human investigation. D) Manage only record retention.

Commented answer

Correct answer: B. Adaptive Protection uses risk levels to apply DLP, lifecycle, or Conditional Access controls according to the configuration.

Question 4: Which solution provides a consolidated view of where sensitive data resides,

how they are exposed and which actions should be prioritized?

A) Data Security Posture Management B) Microsoft Sentinel C) Azure Bastion D) Service Trust Portal

Commented answer

Correct answer: A. DSPM focuses on the posture and exposure of data assets and recommends risk mitigation actions.

radio_button_uncheckedshort_text 22. Essential Glossary

radio_button_uncheckedshort_text Official references consulted

• Microsoft Learn - Study guide for Exam SC-900: Microsoft Security, Compliance, and Identity Fundamentals. Updated in June 2026.
• Microsoft Learn - Protect your sensitive data with Microsoft Purview. Updated in February 2026.
• Microsoft Learn - Learn about sensitivity labels. Updated in April 2026.
• Microsoft Learn - Get started with trainable classifiers.
• Microsoft Learn - Data classification, Content Explorer and Activity Explorer documentation.
• Microsoft Learn - Microsoft Purview Data Loss Prevention and Endpoint DLP documentation.
• Microsoft Learn - Insider Risk Management and Adaptive Protection documentation.
• Microsoft Learn - Data Security Posture Management. Updated in 2026.
• Microsoft Learn - Data Security Investigations. Updated in 2026.

Note about update

Names, licensing, portals, and resource availability may change. For actual deployment, always check the current documentation and requirements.