Four months after Microsoft folded the Microsoft 365 compliance center and Azure Purview into one brand — Microsoft Purview — we've now run enough August engagements against that name to see the actual damage, and it isn't technical. It's semantic. A state agency asked us to "turn on Purview" and meant eDiscovery holds for an open records request. Three weeks later a regional manufacturer asked us to "turn on Purview" and meant a data catalog for their Synapse workspace. Same word, two unrelated products, two different portals and billing models, and nobody had noticed until we asked which one they meant.
That confusion is the real news here, more than any single feature under the new name. The compliance suite — sensitivity labels, data loss prevention, retention, eDiscovery, Communication Compliance, Insider Risk Management — got renamed and reskinned into a shared portal. Azure Purview, the data map and catalog product for a SQL, Synapse, and Data Lake estate, got folded under the identical three-word brand with none of its plumbing touched. If your own IT team can't tell you which product they mean by "Purview," that's the first thing to fix, and it costs nothing.
What follows is our configuration order for the half of that name that touches every mailbox, site, and Teams chat in a Microsoft 365 tenant — sensitivity labels, DLP, retention, eDiscovery — after four months of client work against the rebrand. Not a portal tour. An order of operations for a tenant with real data, a mix of E3 and E5 seats, and a business that still has to function while the screws tighten.
Two Portals, One Brand Name
The Microsoft 365 compliance center became the Microsoft Purview compliance portal. Same URL, same sign-in, mostly the same navigation with new labels on the tin: Purview Data Loss Prevention, Purview Information Protection, Purview Insider Risk Management, Purview Communication Compliance, Purview Records Management, Purview Compliance Manager. Buried in that same wave, eDiscovery got a genuinely useful cleanup — Core eDiscovery became eDiscovery (Standard) and Advanced eDiscovery became eDiscovery (Premium) — clearer names for the same feature boundary that existed before.
Azure Purview is a different animal wearing the same jacket. It shipped as its own product in late 2021, well before this rebrand, as a data map and catalog for structured and semi-structured data across Azure SQL, Synapse, Data Lake Storage, on-prem SQL, and Power BI. It lives in its own portal, gets deployed as an Azure resource into a subscription, and bills as Azure consumption, not Microsoft 365 licensing. When a client's data team and compliance team both say "we're doing Purview this year," we now ask them to finish that sentence before we write a statement of work. It changes the team, the budget line, and the deliverable entirely.
Sensitivity Labels Are the Keystone
Almost everything downstream depends on labels existing first. DLP rules can reference a label as a condition. Retention can key off a label instead of a blunt workload-wide policy. Insider Risk Management's better detections trigger on movement of highly-labeled content, not just any file. Container labels restrict who can even create a Team or site at a given sensitivity tier. Skip labeling and build DLP or retention first, and you're building policy on content nobody has classified — which is most of what we find when we inherit someone else's compliance rollout.
Keep the taxonomy small. Four to six parent labels — Public, General, Confidential, Highly Confidential is a reasonable starting shape — with a handful of sublabels scoped to real business units, not an org chart reproduced as a label list. We've inherited tenants with thirty-label taxonomies that nobody could recite, and adoption was exactly what you'd expect: zero, because users default to whatever's fastest.
Decide deliberately between mandatory labeling — better hygiene, bigger week-one helpdesk queue — and a default label with light-touch nudging, which adopts slower but steadier. We usually start with a default label and add mandatory labeling only for a defined high-risk population once the taxonomy has survived contact with real users.
Container labels on Microsoft 365 Groups, Teams, and sites need Azure AD Premium P1 — already included in most Microsoft 365 Business Premium, E3, and E5 bundles — plus explicit enablement:
Connect-SPOService -Url https://contoso-admin.sharepoint.com
Set-SPOTenant -EnableAIPIntegration $true
Connect-AzureAD
$template = Get-AzureADDirectorySettingTemplate | Where-Object DisplayName -eq "Group.Unified"
$setting = $template.CreateDirectorySetting()
$setting["EnableMIPLabels"] = "True"
New-AzureADDirectorySetting -DirectorySetting $setting
Worth flagging in every one of these engagements: the classic Azure Information Protection add-in for Office is on its way out, and we've stopped recommending it for new deployments in favor of the built-in labeling experience in the Office apps. If a client is still running it because "that's what we set up in 2019," the migration belongs on this quarter's list, not next year's.
DLP Without Breaking Work
The failure mode we see most often: someone reads the feature list, turns on block-and-notify across Exchange, SharePoint, and OneDrive day one, and by Thursday accounts receivable can't email invoices because invoice numbers pattern-match the built-in credit card number type closely enough to trip the rule. DLP gets a bad reputation for a year after that, and the next attempt starts from user distrust one bad rollout earned.
Every new policy starts in test mode against real traffic before it ever blocks anything:
Connect-IPPSSession -UserPrincipalName admin@contoso.com
New-DlpCompliancePolicy -Name "Finance - Card Data (Pilot)" `
-ExchangeLocation "AR-Team@contoso.com" `
-SharePointLocation "https://contoso.sharepoint.com/sites/AR" `
-Mode TestWithNotifications
New-DlpComplianceRule -Name "Notify-CardNumber-External" `
-Policy "Finance - Card Data (Pilot)" `
-ContentContainsSensitiveInformation @{Name="Credit Card Number"; minCount="1"} `
-NotifyUser Owner `
-GenerateIncidentReport SiteAdmin
Two to three weeks minimum in TestWithNotifications, reading the actual incident reports before anyone flips a rule to Enable. For identifiers you control — employee numbers, policy numbers, account formats — exact data match beats the built-in regex-based sensitive information types on false positives, at the cost of maintaining a refreshed data table. For messy unstructured content — resumes, source code, harassing language — trainable classifiers beat hand-written regex, but they need seed data and a training period; the portal wizard makes this look same-day, and it isn't.
Endpoint DLP earns its onboarding cost fastest on laptops that leave the building. It requires device onboarding through the same channel as Defender for Endpoint, Windows 10 version 1809 or later, and either full E5 or the Information Protection and Governance add-on. We prioritize that population — sales, field service, executives — well before fixed desktops.
Retention Is Not Deletion
Retention policies apply broadly to a workload — a mailbox, a site, a whole tenant — either "keep everything here for at least this long" or "delete anything older than this unless something else says otherwise." Retention labels apply to individual items and can trigger disposition review, or fire off event-based retention such as "three years after the termination event for this employee." Confusing the two is how a CFO ends up believing something was deleted when a broader policy quietly preserved it, or believing something was safe when nothing was actually retaining it.
The principle to memorize and repeat to stakeholders: the longest retention period wins across overlapping policies and labels, and a hold — litigation hold, an eDiscovery hold, a retention policy set to retain — always wins over any instruction to delete. Nothing you configure in Purview deletes something that another rule says to keep. That's a feature when legal needs it and a surprise when finance doesn't expect a "temporary" mailbox export to survive for years.
Preservation Lock turns a retention policy immutable — not even a tenant admin can shorten or remove it afterward. Treat it as a one-way door: we require written legal sign-off first, because "just lock this down" requests rarely consider that the same tenant might need to shorten that window years later for a reason nobody's thought of yet.
Adaptive scopes — dynamic membership based on attributes such as department — cut the maintenance tax static scopes create every time someone changes teams. We default to them for any retention policy tied to an org attribute rather than a fixed list that's wrong within a quarter.
The Corners Nobody Configures
Insider Risk Management and Communication Compliance are the two capabilities we see licensed and then left almost entirely unconfigured. Insider Risk ships with templates — data theft by a departing employee, data leaks, security policy violations — but the departing-employee template is only as good as its signal. Without the HR connector feeding resignation and termination dates in, that template has no idea until after they're gone. We ask about the HR connector in the first meeting now, because it's the piece that turns this from a checkbox into an actual control.
Communication Compliance — the current name for what used to ship as supervision policies — monitors Teams, Exchange, and Yammer content against policies for harassment, regulatory language, or inappropriate sharing of sensitive data. Detection is half the job; the reviewer workflow is the other half, and it fails quietly when the assigned reviewer is a shared mailbox nobody opens. Name a real person, give them time on their calendar for review, or don't bother enabling the policy.
Both require Microsoft 365 E5 or the matching standalone add-on, which is usually where these conversations move from a technical scope to a budget one.
The E5 Wall
Licensing gates more of this suite than most tenants realize going in:
| Capability | E3 | E5 or add-on |
|---|---|---|
| Manual sensitivity labels | Included | — |
| Service-side auto-labeling | Not included | Required |
| Core DLP (Exchange, SharePoint, OneDrive, Teams) | Limited policy set | Full policy set |
| Endpoint DLP | Not included | Required |
| eDiscovery (Standard) | Included | — |
| eDiscovery (Premium) | Not included | Required |
| Insider Risk Management | Not included | Required |
| Communication Compliance | Not included | Required |
| Audit log retention beyond 90 days | Not included | Required |
For an E3 tenant, we rarely recommend a blanket E5 uplift as the opening move. Microsoft sells these as standalone add-ons — Information Protection and Governance, Insider Risk Management, eDiscovery and Audit — licensable for a defined subset of users: security, legal, HR, whichever population a pilot needs. Prove the control works and produces numbers leadership cares about on that small cohort before the full E5 uplift conversation happens with finance. Walking in with a license price sheet instead of pilot evidence is how these budget conversations stall for a year.
If you're facing this
If "Purview" got turned on in your tenant because a licensing conversation happened before a configuration one, we can help sort out which product someone actually meant and build the label taxonomy, DLP rollout order, and retention map that make the rest of it worth having. Bring your E3/E5 mix and whatever DLP incident reports are currently being ignored — that's usually where the real backlog already is.