Microsoft Purview - Simply Explained

1
00:00:00,000 --> 00:00:07,000
Most people think protecting data is about building a strong wall around it, lock down the network, block the bad guys, and you are safe.

2
00:00:07,000 --> 00:00:11,000
Here's the thing, that wall does nothing once your data is inside and moving around.

3
00:00:11,000 --> 00:00:20,000
An employee with legitimate access can take a customer list and email it to their personal account, and the firewall just waves it through because the request came from a trusted user.

4
00:00:20,000 --> 00:00:25,000
Microsoft Perview gets mentioned everywhere these days, but what actually is it? It's not a single tool.

5
00:00:25,000 --> 00:00:36,000
It's a family of solutions all focused on one thing, protecting your data, not just your infrastructure. There are three pillars to understand, data governance, knowing what data you have, data security and protecting it.

6
00:00:36,000 --> 00:00:46,000
The data compliance, proving you follow the rules, by the end of this episode you'll see how these three pieces fit together and where to start, but to understand why Perview exists you have to understand the problem it solves.

7
00:00:46,000 --> 00:00:50,000
The real problem, why infrastructure security isn't enough?

8
00:00:50,000 --> 00:01:00,000
Most companies assume that if the network is locked down, the data is safe. 20 years ago, when everything lived inside a physical office, that was a fair assumption. It just isn't true anymore.

9
00:01:00,000 --> 00:01:08,000
Data lives everywhere now. Cloud apps, personal devices, email attachments, shared drives, team chat messages, scattered across environments you don't fully control.

10
00:01:08,000 --> 00:01:16,000
And once a user has legitimate access, once they're authenticated and inside the building, infrastructure security can't control what they do with that data.

11
00:01:16,000 --> 00:01:26,000
Consider this example, an employee downloads a customer list to a personal USB drive. The firewall didn't stop it and the intrusion detection system didn't catch it because the data wasn't intercepted.

12
00:01:26,000 --> 00:01:29,000
It was accessed by someone who had permission to see it.

13
00:01:29,000 --> 00:01:35,000
The security tools were looking for an attack from the outside, but the threat came from the inside. This is the fundamental shift.

14
00:01:35,000 --> 00:01:47,000
Protection needs to move from the infrastructure layer to the data layer itself. Instead of just guarding the building, you need to guard the files inside it. That's exactly what Perview does. It applies policies directly to the data, not just the system holding it.

15
00:01:47,000 --> 00:01:55,000
Think of it this way. Building security guards the door by checking IDs and making sure only the right people get in. But once they're in, building security doesn't follow them around.

16
00:01:55,000 --> 00:02:03,000
Perview is different. It puts a lock on the filing cabinet itself, meaning even if someone is inside the building, they can't open the cabinet unless they're supposed to.

17
00:02:03,000 --> 00:02:08,000
Perview is about locking the filing cabinet, but before you can lock it, you need to know what's inside.

18
00:02:08,000 --> 00:02:15,000
Pillar 1. Data governance. Know what you have. Knowing what data you actually own is the first step in any data protection strategy.

19
00:02:15,000 --> 00:02:21,000
That sounds obvious, but most organizations have no idea what's sitting in their sharepoint sites, file shares, or databases.

20
00:02:21,000 --> 00:02:30,000
They've got years of accumulated content like old project files, duplicate documents, and spreadsheets with customer information. Nobody remembers creating.

21
00:02:30,000 --> 00:02:39,000
Perview's data map solves this. It scans your entire environment across Azure, multi-cloud, and on-premises, and captures metadata about everything it finds.

22
00:02:39,000 --> 00:02:46,000
It answers questions like what kind of data it is, where it's stored, who owns it, and how sensitive it is. The data map builds a complete picture of your data estate.

23
00:02:46,000 --> 00:02:49,000
From there all that metadata gets organized into the unified catalog.

24
00:02:49,000 --> 00:02:56,000
Think of it like a library with a card catalog. Before the catalog existed, you had to walk through every aisle hoping to find what you needed.

25
00:02:56,000 --> 00:03:07,000
But with the catalog, you search once and know exactly which shelf holds which book. You can organize data into governance domains like finance, HR, and research and development, so business users can find what they need without asking IT.

26
00:03:07,000 --> 00:03:16,000
A financial analyst can browse the finance domain and see all the approved data sets, complete with descriptions and owners, data lineage shows, where data came from, and how it changed over time.

27
00:03:16,000 --> 00:03:20,000
If you're preparing for an audit and someone asks, where did this number come from?

28
00:03:20,000 --> 00:03:33,000
Lineage traces it back through every transformation, and that's critical when regulators want proof that your reports are accurate. The business glossary adds plain English descriptions so analysts can understand what a data set means, without tracking down the person who created it three years ago.

29
00:03:33,000 --> 00:03:43,000
Instead of seeing a table called Custod 223 V2 Final, they see customer orders 2023 Final version. Simple change, huge difference. Why does this matter?

30
00:03:43,000 --> 00:03:58,000
You can't protect data, you don't know, exists. If you don't know, there's a SharePoint site with customer social security numbers, you can't lock it down, and governance is the foundation everything else builds on. Once you know what data you have and where it lives, the next question is obvious. How do you protect the sensitive stuff?

31
00:03:58,000 --> 00:04:01,000
Pillar 2, data security, sensitivity labels.

32
00:04:01,000 --> 00:04:05,000
Governance tells you what data exists and security tells you what to do with it.

33
00:04:05,000 --> 00:04:26,000
The core tool for that is something called sensitivity labels. Think of sensitivity labels as digital tags that classify data based on how sensitive it is. Common ones you'll see are public, internal, confidential, and highly confidential. But you're not stuck with those. You can create custom labels that match your organization's needs. Maybe you want a label called HR data or financial results or client confidential.

34
00:04:26,000 --> 00:04:41,000
You decide, here's the thing about labels, they travel with the data, if a document is marked confidential and someone attaches it to an email, the label stays attached. It doesn't matter if the document is downloaded, copied to one drive or shared through teams, that label follows it everywhere.

35
00:04:41,000 --> 00:04:47,000
It's not a sticker on the filing cabinet, it's a watermark embedded in the paper itself. Labels can trigger automatic actions.

36
00:04:47,000 --> 00:04:57,000
You can encrypt the documents so only authorized people can open it. Access restrictions can block editing or printing and you can add headers, photos, or watermarks that say confidential right across the page.

37
00:04:57,000 --> 00:05:05,000
The label tells the system what to do and the system does it automatically. Labels get applied in three ways. Manual means the user chooses the label themselves.

38
00:05:05,000 --> 00:05:17,000
Automatic means purview detects sensitive content like a credit card number and applies the label on its own. Policy recommendation means the system suggests a label and the user confirms it. That middle option is where things get interesting.

39
00:05:17,000 --> 00:05:29,000
Here's an example, a document contains a credit card number. Purview's classification engine recognizes that pattern and before the document is even saved, auto applies the highly confidential label and encrypts it with no human intervention needed.

40
00:05:29,000 --> 00:05:39,000
The data is protected from the moment it's created, but labels don't just apply to individual files. They also apply to containers like SharePoint sites, Teams channels, and Microsoft 365 groups.

41
00:05:39,000 --> 00:05:48,000
That means you can say any team site labeled confidential blocks external sharing by default. You set the rule once and every site with that label inherits the protection.

42
00:05:48,000 --> 00:05:55,000
You don't have to configure each one individually, so labels tell you what something is. They classify it, market, and apply protection automatically.

43
00:05:55,000 --> 00:06:08,000
But what if someone tries to send that label data somewhere they shouldn't? Data loss prevention blocking the leaks labels classify DLP data loss prevention takes action. This is where the system stops being passive and starts blocking things in real time.

44
00:06:08,000 --> 00:06:16,000
DLP policies scan email documents chat messages and cloud apps for sensitive information. When it finds something risky, it can block the action entirely.

45
00:06:16,000 --> 00:06:25,000
Show a policy tip that warns the user, notifying administrator or just log the event for later review. You decide which response fits the situation. Let me give you a real example.

46
00:06:25,000 --> 00:06:36,000
An employee tries to email a spreadsheet with social security numbers to their personal Gmail account. DLP detects the sensitive data, recognizes the external recipient and blocks the message before it leaves your organization.

47
00:06:36,000 --> 00:06:41,000
The user gets a warning that says this message contains sensitive information and was not delivered.

48
00:06:41,000 --> 00:06:56,000
The action is blocked and it becomes a learning moment. No leak, no breach. DLP works across exchange, SharePoint, OneDrive, Teams, and even Windows endpoints. It doesn't matter where the data is or how someone tries to move it. If it contains sensitive information, the policy catches it.

49
00:06:56,000 --> 00:07:03,000
One thing worth knowing, you can run DLP policies in simulation mode first. That means you test what would be blocked without actually blocking anything.

50
00:07:03,000 --> 00:07:16,000
You get a report showing how many items would have been caught, what types of data triggered the policy and which users were involved. Then you adjust before turning enforcement on. It's a safe way to learn, without disrupting anyone's work. Best practice is to start small.

51
00:07:16,000 --> 00:07:23,000
Pick one type of sensitive data, credit card numbers, for example, and apply DLP to a small group of users. See what happens.

52
00:07:23,000 --> 00:07:42,000
Educate users with policy tips that explain why something was blocked. Then gradually expand enforcement as people get used to it. Those policy tips are powerful, by the way. Instead of just saying blocked, they tell the user, "This document contains sensitive data. Are you sure you want to send it? It gives them a chance to reconsider without feeling like the system is punishing them."

53
00:07:42,000 --> 00:07:52,000
Most people don't mean to leak data. They're just moving fast. So now we know our data. We're protecting it with labels and blocking leaks with DLP. But what happens when an auditor shows up asking for proof?

54
00:07:52,000 --> 00:08:12,000
Data compliance. Proof you follow the rules. Compliance is about proving your secure, not just being secure. You can have the best protections in the world. But if a regulator shows up and asks for evidence, you need more than good intentions. You need documentation, audit, trails, and a defensible process. That's where Perview's Compliance Manager comes in. It gives you a score based on how well you meet regulatory requirements.

55
00:08:12,000 --> 00:08:41,000
Imagine a credit score, but for compliance, the higher your score, the better your posture, and it changes as you take actions that improve it. Compliance Manager comes with built-in assessments for the major regulations you've probably heard of. GDPR for data privacy in Europe, HIPAA for healthcare information in the United States, ISO 27001 for information security management, FINRA for financial services, FedRAMP for government cloud services. And many more. Over 320 templates in total. If there's a regulation that applies to your industry, there's probably an assessment for it.

56
00:08:41,000 --> 00:08:50,000
Each assessment breaks down the regulation into controls. Every control is further broken down into improvement actions with step-by-step guidance. It tells you exactly what you need to do.

57
00:08:50,000 --> 00:09:02,000
Enable audit logging, configure sensitivity labels, set up retention policies. You're not guessing what compliance looks like. The system tells you you assign these improvement actions to people in your organization. The IT admin gets the technical tasks.

58
00:09:02,000 --> 00:09:18,000
The compliance officer gets the policy documentation. The legal team gets the data subject request workflows. Everyone knows what they're responsible for, and you can track progress in real time. No more spreadsheets passed around by email. When someone completes an action, they upload evidence directly into compliance manager.

59
00:09:18,000 --> 00:09:29,000
That evidence can be screenshots showing a policy is configured correctly. It can be policy documents you've written. It can be audit logs pulled from the system. Everything lives in one place, organized by control, ready for the next audit.

60
00:09:29,000 --> 00:09:41,000
Here's the smart part. Compliance manager automatically scans your Microsoft 365 environment for some controls. If you've configured sensitivity labels, it detects that and gives you credit automatically. If you've enabled audit logging, it sees that too.

61
00:09:41,000 --> 00:09:54,000
You don't have to manually prove every single thing. The system checks itself. Audit logs in purview record every activity across your environment. Who accessed what document? When did they access it? From where? What did they do with it? Every action is logged in searchable.

62
00:09:54,000 --> 00:10:04,000
When an auditor asks, who saw this file and when? You have the answer in seconds, not days. He discovers he gives legal teams the ability to search across all your data. Email documents.

63
00:10:04,000 --> 00:10:18,000
Teams messages, sharepoint sites, and place holds on content relevant to investigations or lawsuits. If there's a legal dispute, you can preserve every piece of related data and produce it as evidence. No scrambling to find files, no worrying that someone deleted something important.

64
00:10:18,000 --> 00:10:43,000
Records management ensures that critical documents are retained for required periods and cannot be deleted early. If regulations say you must keep financial records for seven years, records management enforces that. Users can't delete them. Admins can't bypass the policy. The data stays until the retention period expires and then it's disposed of in a controlled way. Why does all this matter? Regulators don't care what tools you have. They don't care that you bought purview. They care that you can show a defensible process.

65
00:10:43,000 --> 00:10:54,000
You want to see that you identified risks, implemented controls, monitored compliance, and have evidence for every step. Compliance manager gives you that evidence in a format auditor's recognize. But here's something new that changes the picture.

66
00:10:54,000 --> 00:11:08,000
AI. AI governance. What changes when co-pilot shows up? Here's the simplest definition. Traditional data protection assumed humans access data. That assumption made sense for decades. A person logs in, searches for a file, opens it, reads it.

67
00:11:08,000 --> 00:11:28,000
The system knows who did what and can track every action. AI changes that calculation entirely. Co-pilot and other AI agents can access massive data estates in seconds. They don't read one file at a time. They scan across thousands of documents, summarize content, and surface information the user might not even know exists. That speed and scale creates a whole new category of risk. Imagine your data is like a filing cabinet.

68
00:11:28,000 --> 00:11:43,000
In the old world, each drawer needed a key. Only the right person could access the right file. Co-pilot is like a smart assistant that can open every drawer at once. If the keys are left in the locks. If your data isn't properly classified, co-pilot might surface sensitive information to someone who shouldn't see it.

69
00:11:43,000 --> 00:11:57,000
Not because the system is broken. Because the data was never labeled, a sharepoint side with customer PII that was set to anyone in the company can access suddenly becomes visible through AI in ways it never was before. The wall was always there. AI just found the door.

70
00:11:57,000 --> 00:12:20,000
So what does Pervue do about it? Pervue extends its existing controls to cover AI interactions. DLP policies now scan AI prompts and responses, not just emails and documents. If someone asks co-pilot a question that returns sensitive data, DLP can block it. Sensitivity labels are enforced on AI generated content. If co-pilot creates a summary of a confidential document, that summary inherits the same label and protection.

71
00:12:20,000 --> 00:12:31,000
Data security posture management for AI monitors, oversharing and misuse in real time. It watches how AI tools are being used, what data they're accessing and whether any policies are being violated.

72
00:12:31,000 --> 00:12:41,000
If someone starts asking co-pilot questions that suggest they are probing for data they shouldn't have, the system flags it. Compliance manager now includes pre-built assessments for AI regulations like the EU AI Act.

73
00:12:41,000 --> 00:12:54,000
If your organization uses AI tools you need to demonstrate compliance with these new rules. The assessment templates are already there, ready to use, the AI hub gives you visibility into which AI apps are being used in your organization and what data they access.

74
00:12:54,000 --> 00:13:02,000
You can see which employees are using co-pilot, which third party AI tools are connected and what kind of data is flowing through them, no blind spots.

75
00:13:02,000 --> 00:13:06,000
Pervue can also retain AI prompts and responses for audit trails.

76
00:13:06,000 --> 00:13:17,000
If a regulator asks what did that employee ask the AI and what did it tell them? You have the record. Prompts, responses, timestamps, user identity, everything preserved for investigation or compliance review.

77
00:13:17,000 --> 00:13:23,000
Think of it this way, the same three pillars we've talked about, governance, security and compliance, still apply to AI.

78
00:13:23,000 --> 00:13:34,000
But the stakes are hired, if your data wasn't locked down before AI will expose every crack. Pervue gives you the tools to fix those cracks before they become breaches. Those three pillars aren't separate projects, they work together in a loop.

79
00:13:34,000 --> 00:13:44,000
How the three pillars connect? So how does it all fit together? Governance finds the data, security protects it, compliance proves you followed the rules, three separate jobs, one connected system.

80
00:13:44,000 --> 00:13:52,000
But here's the thing many people miss, they don't just work in sequence, they reinforce each other. A compliance audit reveals a gap in your data classification.

81
00:13:52,000 --> 00:13:58,000
Maybe you missed a sharepoint site with unlabeled customer data. That gap feeds back into governance, which updates the data maps can.

82
00:13:58,000 --> 00:14:08,000
Governance finds the new data, security applies protection, compliance checks it off, the loop keeps turning, let me walk you through a real scenario. The data maps scans your environment.

83
00:14:08,000 --> 00:14:19,000
It finds a sharepoint site with customer PI that was never labelled. Nobody knew it was there. Pervue's classification engine detects the sensitive content and auto applies a highly confidential label with encryption.

84
00:14:19,000 --> 00:14:29,000
That label triggers a DLP policy you already configured. Any email forwarding that label to an external address gets blocked automatically. Compliance manages sees that the control is implemented and gives you score credit.

85
00:14:29,000 --> 00:14:39,000
The audit log records the entire process, who found the data when the label was applied, what policy blocked the action. When the next audit comes around you have the full story ready to present.

86
00:14:39,000 --> 00:14:56,000
That's the power of Pervue as a unified platform. It's not three separate tools that happen to share a portal. It's one engine where each part feeds the others. The integration is automatic. Once your governance is in place, once you've scanned your environment and classified your data, security and compliance benefit without extra configuration.

87
00:14:56,000 --> 00:15:02,000
You don't have to rebuild your labels for compliance manager. You don't have to re-scan for DLP. It all shares the same foundation.

88
00:15:02,000 --> 00:15:13,000
Most organizations fail at data protection because they treat these as disconnected initiatives. They have a governance team that doesn't talk to security. A compliance officer who works from a different spreadsheet.

89
00:15:13,000 --> 00:15:23,000
An IT team that implements policies without understanding what the business needs. Pervue forces those conversations to happen by making the dependencies visible. You can't do compliance well without governance.

90
00:15:23,000 --> 00:15:26,000
You can't do security well without knowing what data you're protecting.

91
00:15:26,000 --> 00:15:35,000
So where do you start? Not by turning everything on at once. Start with governance. Find your data, classify it. The rest will follow. That's the knowledge nugget for today. Your first steps.

92
00:15:35,000 --> 00:15:40,000
So let's get started. Open Pervue's data explorer and see what sensitive information already exists in your environment.

93
00:15:40,000 --> 00:15:50,000
You might be surprised at what you find. Credit card numbers sitting in email attachments, social security numbers in old SharePoint sites, medical information in Teams chats you forgot existed.

94
00:15:50,000 --> 00:16:00,000
Don't try to fix everything on day one. Just look, focus on the biggest risks first, financial data, medical records, personal information. Those are the ones that get you in trouble with regulators.

95
00:16:00,000 --> 00:16:04,000
Put your energy there before worrying about that internal memo about the office holiday party.

96
00:16:04,000 --> 00:16:14,000
Next, apply sensitivity labels to that critical content, but don't roll it out to everyone yet. Start with a small group of users. Let them test it, get comfortable with it, and give you feedback.

97
00:16:14,000 --> 00:16:23,000
You'll catch configuration mistakes before they affect the whole company, then set up a DLP policy and test mode. Run it in simulation so you can see what would be blocked without actually blocking anything.

98
00:16:23,000 --> 00:16:34,000
Review the reports, adjust your rules, then turn enforcement on gradually. Use compliance manager as your roadmap. It shows you exactly what needs to happen to meet the regulations your industry follows.

99
00:16:34,000 --> 00:16:39,000
You don't have to figure this out on your own. The assessments tell you what to do in what order and how to prove you did it.

100
00:16:39,000 --> 00:16:48,000
Here's the single most powerful thing you can do right now. Run the data classification scan. Just run it. Knowing what you have changes everything, everything else flows from that one step.

101
00:16:48,000 --> 00:16:55,000
Microsoft purvew isn't one product. It's a system for making sure your data is found, protected, and defensible. Start with governance.

102
00:16:55,000 --> 00:17:05,000
Layer on security. Use compliance to stay honest. The framework works for traditional data and AI alike. Yes, AI too. Because it's built for the world most of us are already living in.

103
00:17:05,000 --> 00:17:12,000
If you gave you the big picture, subscribe to Microsoft Knowledge Nuggets on M365 FM. Drop a comment with what you want to explain next. Thanks for listening.