🗺️ Course Module Map

🏠 Module 1: Purview Portal Overview & Compliance Manager

The Microsoft Purview portal at purview.microsoft.com (formerly the Microsoft 365 Compliance Center at compliance.microsoft.com) consolidates all data governance, risk, and compliance capabilities into a unified interface. The Compliance Manager dashboard is the starting point — it provides a scored assessment of your organisation’s compliance posture against regulatory frameworks.

Compliance Manager Key Concepts

🔒 Module 2: Information Protection — Sensitivity Labels

Sensitivity labels are the core building block of Microsoft Purview Information Protection. They allow organisations to classify and protect content based on its sensitivity — applying encryption, visual markings (header, footer, watermark), and usage restrictions that travel with the content wherever it goes.

Sensitivity Label Hierarchy & Scope

Connect-IPPSSession -UserPrincipalName admin@contoso.com

# Get all existing sensitivity labels (sorted by priority)
Get-Label | Select-Object Name,DisplayName,Priority,IsParent,ContentType | Sort-Object Priority | Format-Table -AutoSize

# Create a parent label (container only)
New-Label -Name "Contoso-Confidential" `
  -DisplayName "Confidential" `
  -Tooltip "Sensitive content limited to authorised personnel"

# Create a sub-label with encryption + header marking
New-Label -Name "Contoso-Confidential-Internal" `
  -DisplayName "Confidential \ Internal Only" `
  -ParentId (Get-Label -Identity "Contoso-Confidential").Guid `
  -EncryptionEnabled $true `
  -EncryptionProtectionType Template `
  -ApplyContentMarkingHeaderEnabled $true `
  -ContentMarkingHeaderText "CONFIDENTIAL - Internal Use Only" `
  -ContentMarkingHeaderFontColor "#FF0000"

# Get all label policies
Get-LabelPolicy | Select-Object Name,Labels,ExchangeLocation,SharePointLocation | Format-Table -AutoSize

# Publish labels to all users via policy
New-LabelPolicy -Name "Contoso IP Policy" `
  -Labels @("Contoso-Confidential","Contoso-Confidential-Internal") `
  -ExchangeLocation All `
  -SharePointLocation All `
  -OneDriveLocation All

🚫 Module 3: Data Loss Prevention (DLP)

Data Loss Prevention policies detect and protect sensitive information — credit card numbers, Social Security numbers, NHS numbers, IBAN codes, health records — from being shared inappropriately via email, Teams, SharePoint, OneDrive, or endpoint devices. DLP policies use Sensitive Information Types (SITs) as detection patterns, either built-in (350+ included) or custom.

DLP Policy Scope & Locations

Connect-IPPSSession -UserPrincipalName admin@contoso.com

# Get all DLP compliance policies
Get-DlpCompliancePolicy | Select-Object Name,Mode,Enabled,ExchangeLocation,TeamsLocation | Format-Table -AutoSize

# Create a DLP policy in simulation mode first
New-DlpCompliancePolicy -Name "Financial Data Protection" `
  -ExchangeLocation All `
  -TeamsLocation All `
  -Mode TestWithNotifications   # Start in simulation

# Add a rule to detect UK bank account numbers
New-DlpComplianceRule -Name "Block sharing UK bank accounts" `
  -Policy "Financial Data Protection" `
  -ContentContainsSensitiveInformation @{Name="UK Bank Account Number";MinCount=1} `
  -NotifyUser Owner,LastModifier `
  -BlockAccess $true `
  -BlockAccessScope All

# List all built-in Sensitive Information Types
Get-DlpSensitiveInformationType | Select-Object Name,Publisher,Category | Sort-Object Category,Name | Format-Table -AutoSize

# Promote policy from simulation to enforcement
Set-DlpCompliancePolicy -Identity "Financial Data Protection" -Mode Enable
Write-Host "DLP policy enabled in enforcement mode."

📅 Module 4: Data Lifecycle Management — Retention Policies

Retention policies in Microsoft Purview ensure that content is kept for a minimum period (for compliance), deleted at end of life (to reduce storage and legal liability), or both. Retention policies are container-level — applied to entire workloads (all Exchange mailboxes, all SharePoint sites). Retention labels are item-level — applied to specific emails, files, or Teams messages.

Retention Policy vs Retention Label

Connect-IPPSSession -UserPrincipalName admin@contoso.com

# Get all retention compliance policies
Get-RetentionCompliancePolicy | Select-Object Name,Enabled,RetentionDays,ExchangeLocation,SharePointLocation | Format-Table -AutoSize

# Create a 7-year retention policy for all Exchange mailboxes
New-RetentionCompliancePolicy -Name "Financial Records - 7 Year Retention" `
  -ExchangeLocation All

# Add rule: retain 7 years then delete
New-RetentionComplianceRule -Name "Retain 7 years then delete" `
  -Policy "Financial Records - 7 Year Retention" `
  -RetentionDuration 2555 `
  -RetentionDurationDisplayHint Years `
  -RetentionComplianceAction KeepAndDelete

# Create a retention label for contract documents
New-ComplianceTag -Name "Contract - 5 Year Retention" `
  -RetentionAction KeepAndDelete `
  -RetentionDuration 1825 `
  -RetentionDurationDisplayHint Years `
  -RetentionType CreationAgeInDays

# Auto-apply the label based on keyword search
New-RetentionCompliancePolicy -Name "Auto-Apply Contract Label" `
  -SharePointLocation All -OneDriveLocation All

New-RetentionComplianceRule -Name "Auto-apply to contracts" `
  -Policy "Auto-Apply Contract Label" `
  -ApplyComplianceTag "Contract - 5 Year Retention" `
  -ContentMatchQuery "kind:document AND (contract OR agreement OR NDA)"

📄 Module 5: Records Management

Records Management in Purview adds formal records declaration capabilities on top of retention labels. A record is a labelled item that is locked — its contents cannot be modified or deleted until the retention period expires and a disposition review is completed. A regulatory record is even more restrictive — it cannot be unlocked even by a global administrator.

Records vs Regulatory Records

Connect-IPPSSession -UserPrincipalName admin@contoso.com

# Get all record and regulatory record labels
Get-ComplianceTag | Where-Object {$_.IsRecordLabel -eq $true -or $_.Regulatory -eq $true} |
  Select-Object Name,RetentionAction,RetentionDuration,IsRecordLabel,Regulatory |
  Format-Table -AutoSize

# Create a record label with disposition review
New-ComplianceTag -Name "Legal Hold - 7 Year Record" `
  -IsRecordLabel $true `
  -RetentionAction KeepAndDelete `
  -RetentionDuration 2555 `
  -RetentionDurationDisplayHint Years `
  -RetentionType CreationAgeInDays `
  -ReviewerEmail @("legalteam@contoso.com")

# Export full file plan to CSV for records team review
Get-ComplianceTag |
  Select-Object Name,RetentionAction,RetentionDuration,IsRecordLabel |
  Export-Csv -Path "FilePlanExport.csv" -NoTypeInformation
Write-Host "File plan exported."

🔎 Module 6: eDiscovery Standard

eDiscovery Standard enables legal and compliance teams to search for, hold, and export content from Exchange, SharePoint, OneDrive, Teams, and Viva Engage for legal investigations, litigation, and regulatory requests. Standard eDiscovery includes Content Search (standalone), eDiscovery cases (scoped investigations with hold tracking), and basic export capabilities.

Connect-IPPSSession -UserPrincipalName admin@contoso.com

# Create a content search across all mailboxes and SharePoint
New-ComplianceSearch -Name "Investigation-2026-001" `
  -ExchangeLocation All `
  -SharePointLocation All `
  -ContentMatchQuery "(from:suspect@contoso.com OR to:suspect@contoso.com) AND (contract OR invoice OR payment)"

# Start the search
Start-ComplianceSearch -Identity "Investigation-2026-001"

# Check search status
Get-ComplianceSearch -Identity "Investigation-2026-001" | Select-Object Name,Status,Items,Size

# Create an eDiscovery case and place a hold on a custodian
New-ComplianceCase -Name "Legal Matter 2026-001"

New-CaseHoldPolicy -Name "Custodian Hold - J.Smith" `
  -Case "Legal Matter 2026-001" `
  -ExchangeLocation "john.smith@contoso.com"

New-CaseHoldRule -Name "Hold all content" -Policy "Custodian Hold - J.Smith"

# Get all case holds
Get-CaseHoldPolicy | Select-Object Name,EnabledForCustodian,IsValid,Status | Format-Table -AutoSize

📋 Module 7: eDiscovery Premium

eDiscovery Premium (formerly Advanced eDiscovery) builds on Standard with advanced custodian management, AI-powered review set analytics, near-duplicate detection, email threading, and theme extraction to dramatically reduce the volume of content requiring manual attorney review during large-scale litigation.

eDiscovery Standard vs Premium

📋 Module 8: Audit

The Microsoft Purview Audit solution records user and administrator activity across Microsoft 365 services — providing a tamper-evident log of who did what, when, and from where. Two tiers are available: Audit Standard (included in all M365 plans, 90-day retention) and Audit Premium (M365 E5, 1-year retention, intelligent insights for high-value events).

Audit Standard vs Audit Premium

Connect-IPPSSession -UserPrincipalName admin@contoso.com

# Search audit log for a specific user (last 7 days)
Search-UnifiedAuditLog `
  -StartDate (Get-Date).AddDays(-7) `
  -EndDate (Get-Date) `
  -UserIds "user@contoso.com" `
  -ResultSize 5000 |
  Export-Csv -Path "UserAuditLog.csv" -NoTypeInformation

# Detect bulk file downloads (potential data exfiltration)
Search-UnifiedAuditLog `
  -StartDate (Get-Date).AddDays(-3) -EndDate (Get-Date) `
  -RecordType SharePointFileOperation `
  -Operations FileDownloaded `
  -ResultSize 5000 |
  Group-Object UserIds |
  Where-Object {$_.Count -gt 50} |
  Select-Object Name,Count |
  Sort-Object Count -Descending |
  Format-Table -AutoSize

# Admin role assignment changes (governance audit, last 30 days)
Search-UnifiedAuditLog `
  -StartDate (Get-Date).AddDays(-30) -EndDate (Get-Date) `
  -Operations "Add member to role.","Remove member from role." `
  -ResultSize 5000 |
  Export-Csv -Path "RoleChangesAudit.csv" -NoTypeInformation

💬 Module 9: Communication Compliance

Communication Compliance helps organisations detect, capture, and take remediation action on potentially inappropriate communications — harassment, threats, regulatory disclosures, profanity, and conflicts of interest — in email, Teams messages, Viva Engage, and connected third-party communications like Slack or Bloomberg Chat via data connectors.

Communication Compliance Policy Types

👤 Module 10: Insider Risk Management

Insider Risk Management (IRM) in Microsoft Purview uses machine learning to detect and investigate potentially risky user behaviour — data theft by departing employees, accidental data leaks, security policy violations, and information barriers breaches. It correlates HR signals, audit log activity, and Entra ID activity to build a risk score per user without requiring manual monitoring.

IRM Policy Templates

Connect-IPPSSession -UserPrincipalName admin@contoso.com

# Get all insider risk policies
Get-InsiderRiskPolicy | Select-Object Name,Status,PolicyTemplate,UserCount | Format-Table -AutoSize

# Get insider risk alerts (sorted newest first)
Get-InsiderRiskAlert | Select-Object AlertId,PolicyName,UserId,Severity,Status,AlertCreationDate |
  Sort-Object AlertCreationDate -Descending |
  Format-Table -AutoSize

# Get users currently at Elevated or High risk (Adaptive Protection targets)
Get-InsiderRiskUser | Where-Object {$_.RiskLevel -in @("Elevated","High")} |
  Select-Object UserId,RiskLevel,AlertCount,CaseCount |
  Format-Table -AutoSize

# Get all insider risk cases (escalated alerts requiring investigation)
Get-InsiderRiskCase | Select-Object CaseId,CaseName,UserId,Status,CreatedDate |
  Sort-Object CreatedDate -Descending |
  Format-Table -AutoSize

👥 Module 11: Data Connectors & AI Hub

Data Connectors allow organisations to import third-party data — Bloomberg, Slack, Twitter/X, Zoom, Salesforce, HR systems — into Microsoft 365 where it is subject to the same Purview compliance capabilities (retention, eDiscovery holds, DLP scanning, communication compliance) as native M365 data.

Purview AI Hub (2025–2026)

The Microsoft Purview AI Hub provides data security and governance for AI workloads — particularly Microsoft 365 Copilot and custom AI applications built on Azure OpenAI. It surfaces:

• Sensitive data in Copilot interactions — detect when users submit sensitive content to Copilot prompts
• Overshared files surfaced by Copilot — identify files that Copilot can access (and summarise) but which have overly broad permissions
• DLP protection for Copilot — block sensitive content from entering Copilot prompts via DLP policies
• Data Security Posture Management (DSPM) — continuous assessment of data risk posture — overshared files, unprotected sensitive data, stale access

🎓 Module 12: SC-400 Certification Alignment

The SC-400: Microsoft Information Protection Administrator certification validates your ability to plan, implement, and monitor information protection, DLP, data lifecycle management, and compliance solutions in Microsoft Purview.

💡 Best Practices Summary

• Start sensitivity label deployment with a maximum of 5–7 labels visible to users — more labels cause user fatigue and inconsistent application; complexity can be hidden in sub-labels visible only to specific teams
• Always deploy DLP policies in simulation (TestWithNotifications) mode for at least 2 weeks before enabling enforcement — review the DLP reports to identify false positives and adjust rule thresholds before blocking real business communications
• Configure mandatory justification for label downgrade in label policies — users must provide a reason when reducing a label from Confidential to General; this creates an audit trail and makes classification changes deliberate
• Use Compliance Manager assessments as your governance roadmap — prioritise improvement actions by points value and difficulty; focus first on high-point, low-effort technical controls that directly improve your compliance score
• Implement Adaptive Protection to automatically tighten DLP controls on high-risk users — this provides targeted, dynamic protection without applying restrictive DLP policies to the entire organisation
• Enable Audit Premium for all users who handle sensitive data — the MailItemsAccessed event is essential for detecting and scoping mailbox compromises; without it, you cannot determine what an attacker read during a breach
• Configure auto-labeling policies for email and SharePoint before expecting manual labeling adoption — auto-labeling catches content that users forget or choose not to label, ensuring a consistent baseline of protection
• Use trainable classifiers alongside SITs for content types that are difficult to detect by pattern alone — contracts, financial reports, HR documents — trainable classifiers use ML to understand document intent rather than just pattern-matching

📚 References & Further Reading

• 🔗 Microsoft Purview Documentation — Microsoft Learn
• 🔗 SC-400: Information Protection Administrator Certification — Microsoft Learn
• 🔗 Sensitivity Labels Documentation — Microsoft Learn
• 🔗 Data Loss Prevention Overview — Microsoft Learn
• 🔗 Retention Policies & Labels — Microsoft Learn
• 🔗 Microsoft Purview eDiscovery — Microsoft Learn
• 🔗 Insider Risk Management — Microsoft Learn
• 🔗 Microsoft Purview Portal — purview.microsoft.com