Microsoft Purview, configured rather than merely licensed

The Azure assessment starts inside the tenant, because most of what determines feasibility is already there in permissions, content hygiene and licensing.

• Licence entitlement mapped first. What Microsoft 365 E5, Purview add-ons and identity governance licences already cover, since a correct design can still be commercially unacceptable.
• Content hygiene and oversharing. Duplication, stale documents and broad sharing links across the sites in scope, which are the findings that most often surprise a sponsor.
• Existing label taxonomy reviewed. Whether current labels are applied consistently enough to be relied on, or whether a previous project left a taxonomy nobody uses.
• Audit retention against real scenarios. Whether current retention would support a breach assessment or a client dispute, tested against a specific scenario rather than assumed.
• Fabric governance scope confirmed. Which Fabric item types the intended policies genuinely cover, since data loss prevention support is specific rather than universal.
• Residency of metadata and logs. Where scanning metadata and audit records physically sit, because these layers move outside Australian regions more easily than the data does.

Register and scan first, agree the taxonomy with the business second, and only then write policy. Enforcement is the last step, not the first.

• Sources registered and scanned. Classification and lineage metadata held centrally without copying data or replacing the security controls already on the source.
• Catalogue with owners and definitions. Data products published with a named business owner, glossary terms and quality signals, so the catalogue carries accountability.
• Labels applied where content is created. Sensitivity labelling surfaced inside the applications people already use, with automatic labelling used only where classification is reliable.
• Data loss prevention scoped precisely. Policies targeted at the structured Fabric item types genuinely supported, rather than promised across arbitrary content.
• Access via entitlement packages. Data access bundled into access packages with approval and expiry, rather than granted as individual permissions that accumulate.
• Audit consolidated for the long horizon. Tenant audit and access telemetry correlated and retained long enough that a breach assessment is answerable rather than guesswork.

The controls exist in the tenant. The work is applying them deliberately to data, proving they hold, and keeping standing access out of the design.

• One directory for every data decision. Access resolved against the workforce directory with conditional access applied to the analytics estate, so a leaver loses access everywhere at once.
• Elevation instead of standing access. Privileged data and compliance roles moved to approved, time-bound activation so permanent access to sensitive data is the exception.
• Reviews with named reviewers. Recurring access reviews and lifecycle workflows for joiner, mover and leaver events, with completion tracked rather than assumed.
• Protection policies gating access. Labels used not only to mark content but to control who can open it, including gating access to Fabric items where required.
• Insider risk indicators tuned. Ready-made indicators for analytics activity such as report export and bulk data movement, tuned rather than enabled wholesale.
• AI reach decided explicitly. What assistants may read agreed as a governance decision with the excluded set published, before any assistant is enabled on a scope.

The Microsoft estate makes governance visible to every employee, which cuts both ways. A well-tuned policy teaches people; a noisy one trains them to click through.

• Taxonomy built with document authors. Designed with the people who create the content, because a taxonomy written by IT alone produces labels that are never applied.
• Policy tips explained in advance. Staff told what will be flagged and why before enforcement begins, which is the cheapest way to reduce override requests.
• Data owners appointed with time. Named owners per data product who have accepted the commitment, rather than a name entered in a field to complete a migration.
• Reviewers taught the judgement. Access reviewers shown how to decide whether access is still needed, so a review is a decision rather than a bulk approval.
• Naming confusion addressed at handover. Your team briefed on which product surface is current and which documentation is stale, because they will hit the same split we did.
• Evidence assembly rehearsed. The audit or breach evidence process run once before it is needed, which is when the missing retention becomes obvious.

Purview drifts in three ways: new repositories appear unscanned, access accumulates as people move, and Microsoft renames something that was in your documented control set.

• Scan coverage against the estate. New sources and workspaces detected and registered, since unscanned repositories are the gap an audit finds first.
• Override and match rates trended. Rising overrides treated as evidence a policy is mistuned rather than that staff are careless, because a hollow policy is a false control.
• Review completion and quality. Whether reviews ran and whether reviewers decided, with bulk approvals flagged for investigation rather than counted as success.
• Product change assessed. Renames, converged capabilities and retirements evaluated against your documented controls before they invalidate a client-facing statement.
• Audit and scanning cost reported. Retention and classification consumption reported monthly, since both grow with the estate rather than with usage.
• Residency re-verified after change. Checked again whenever a service, region or scanning configuration changes, because this drift is the least visible.