Microsoft Purview data protection review
A Microsoft Purview data protection review is an independent assessment of how your Microsoft 365 tenant is configured to classify, protect, and retain information. It examines sensitivity labels and how they are published, data loss prevention (DLP) policies, and retention policies and retention labels, and compares each with Microsoft’s published guidance.
What Microsoft recommends for labels, DLP, and retention
Microsoft’s public documentation on Microsoft Learn sets out how to plan and configure sensitivity labels, data loss prevention, and retention. The review compares your tenant’s configuration with the recommendations below, each quoted from its source page.
Enable sensitivity labels for files in SharePoint and OneDrive
What the review checks: Whether EnableAIPIntegration is True, in each geo-location for Multi-Geo tenants, and EnableSensitivityLabelforPDF where PDF support is wanted. Any “Turn on now” prompt for Office online files in the Microsoft Purview portal is noted as supporting evidence.
“Until you enable this feature, these services can't process encrypted files, which means that coauthoring, eDiscovery, data loss prevention, search, and other collaborative features won't work for these files.”
Enable sensitivity labels for files in SharePoint and OneDrive, Microsoft Learn Where possible, keep to 5x5: up to five parent labels, each with up to five sublabels
What the review checks: The number of top-level labels (parent labels or label groups) and the sublabels under each, compared with 5x5, and whether label names are intuitive rather than mixing terms such as Confidential, Restricted, and Internal.
“Keep the list of labels to 5x5 whenever possible, that is: up to five parent labels and up to five child labels under a parent.”
Step 1: Start with default labeling, Microsoft Learn Consider a default label to set a base level of protection for all content
What the review checks: The default label each label publishing policy sets for documents, emails and meeting invites, new groups and sites, and Power BI content, and which users and groups each policy is scoped to.
“Consider using a default label to set a base level of protection settings that you want applied to all your content.”
Learn about sensitivity labels, Microsoft Learn Usually avoid a default label for documents that applies encryption
What the review checks: For each label policy, the label set as the default for documents, and whether that label’s protection settings apply encryption (access control).
“It's usually not a good idea to select a label that applies encryption as a default label to documents.”
Learn about sensitivity labels, Microsoft Learn If labeling is mandatory, also set a corresponding default label
What the review checks: Whether each policy requires users to apply a label to documents, emails, meetings, groups and sites, or Power BI, and where it does, whether a default label is also set for the same item type.
“unless you also set a corresponding default label, mandatory labeling can frustrate your users with the frequent prompts.”
Learn about sensitivity labels, Microsoft Learn Run auto-labeling policies in simulation before turning them on
What the review checks: Each auto-labeling policy’s mode, simulation or on, whether simulation results were reviewed before it was turned on, and, where the tenant still uses parent labels rather than label groups, whether a parent label is selected, since a parent label can’t be applied.
“run the policy in simulation before you turn it on to help ensure correct labeling.”
Automatically apply a sensitivity label to Microsoft 365 data, Microsoft Learn Licensing: The Microsoft Purview service description lists client and service-side automatic sensitivity labeling under plans such as Microsoft 365 E5.
Apply DLP to labeled content, blocking Anyone links and external sharing where applicable
What the review checks: DLP policies for SharePoint, OneDrive, and Exchange that use sensitivity labels as conditions, especially for labels used as defaults, and whether their actions restrict external sharing and Anyone with the link access.
“Turn on DLP on labeled content, blocking anyone with link and external where applicable.”
Step 1: Start with default labeling, Microsoft Learn Licensing: The Microsoft Purview service description lists DLP for Exchange Online, SharePoint, and OneDrive under plans including Microsoft 365 Business Premium, Microsoft 365 E3, and Microsoft 365 E5.
Involve stakeholders beyond IT when planning data loss prevention
What the review checks: Whether each DLP policy has a named business owner and a documented process for reviewing matches and remediating them, who receives DLP alerts and incident reports, and whether policy names and descriptions state a business purpose.
“Your IT department can't develop a broad ranging plan on their own without negative consequences.”
Plan for data loss prevention (DLP), Microsoft Learn Going forward, use Microsoft 365 retention policies and labels instead of older features
What the review checks: Older features still in use, such as Exchange MRM retention tags, Litigation Hold, and SharePoint document deletion policies, compared with current retention policies. MRM archive policies and folder-level policies applied by an admin are noted separately, since Microsoft 365 retention policies don’t currently support them.
“we recommend that going forward, you use Microsoft 365 retention policies and retention labels to benefit from a single solution to manage both retention and deletion of content across multiple workloads in Microsoft 365.”
Learn about retention policies and retention labels, Microsoft Learn Licensing: The Microsoft Purview service description lists organization-wide and location-wide retention policies under plans including Microsoft 365 Business Premium, Microsoft 365 E3, and Microsoft 365 E5.
Find which workloads need a retention policy, and whether exceptions need retention labels
What the review checks: Which locations each retention policy covers and its retain or delete settings, workloads with no policy, and whether each retention label maps to a documented exception or record requirement.
“identify the workloads that need a retention policy and whether you need to create retention labels for exceptions”
Get started with data lifecycle management, Microsoft Learn Licensing: The Microsoft Purview service description lists creating and publishing retention labels under plans including Microsoft 365 Business Premium and Microsoft 365 E3, and auto-applied retention labels and adaptive scopes under plans such as Microsoft 365 E5.
What the review covers in Microsoft Purview
The review reads how labeling, data loss prevention, and retention are configured in your tenant. Each part is covered where it is licensed and included in the agreed scope.
Part of the audit's data protection and governance area.
- Sensitivity label structure
- How many top-level labels (parent labels or label groups) and sublabels exist, whether their names are clear to users, and whether each label has a tooltip.
- Label publishing policies
- Which users and groups each policy targets, the default labels it sets, and whether labeling is mandatory. Also whether users are given a link to current internal guidance.
- Label protection settings
- Which labels apply encryption, and whether any of them is set as the default label for documents.
- Labels in SharePoint, OneDrive, and Microsoft Teams
- Whether sensitivity labels are enabled for files in SharePoint and OneDrive, whether sites and teams carry labels, and whether document libraries have a default sensitivity label.
- Auto-labeling policies
- Each policy’s mode, whether simulation results were reviewed before it was turned on, and which labels it applies.
- Data loss prevention policies
- The locations each policy covers, the conditions it uses, including sensitivity labels, and whether its actions audit, block with warnings, or block, including for external sharing.
- Retention policies and retention labels
- Which workloads each retention policy covers and with what retain or delete settings, which workloads have none, and which older retention features are still in use.
- Ownership of data lifecycle decisions
- Who owns retention and deletion decisions, whether each retention label maps to a documented exception or record requirement, and who reviews DLP matches and receives DLP alerts.
When teams ask for it
- Labels exist, but their behavior is unclear
- Sensitivity labels have been published, but it is not clear which defaults apply, who is required to label, or why users see the prompts they do.
- Moving DLP from auditing to blocking
- Before DLP rules move from auditing matches to blocking, the team wants the current rules, owners, and alert recipients reviewed.
- Retention that built up over time
- Litigation Hold, older Exchange retention tags, and newer retention policies are all in use, and the team wants a clear list of which older features remain alongside current policies.
- Before a Microsoft 365 Copilot rollout
- Establish how sensitive information is currently labeled, protected, and retained, as one input to rollout planning.
- Preparing for a governance or customer review
- Gather evidence of how labeling, DLP, and retention are configured before an internal review, a customer questionnaire, or an audit.
What you receive
Each finding is reported with the configuration evidence behind it, its business context, and a recommended action. Findings are sequenced into a remediation roadmap, so your team knows what to change first.
Questions
What does a Microsoft Purview data protection review cover?
It covers how your tenant classifies, protects, and retains information: sensitivity labels and how they are published, auto-labeling and data loss prevention policies, retention policies and retention labels, and who owns the decisions behind them.
It is one part of the Microsoft 365 tenant audit. Which parts are reviewed depends on your licensing and the agreed scope.
Do we need Microsoft 365 E5 for sensitivity labels and DLP?
Not for every control. The Microsoft Purview service description lists DLP for Exchange Online, SharePoint, and OneDrive, and organization-wide or location-wide retention policies, under plans that include Microsoft 365 Business Premium and Microsoft 365 E3. It lists client and service-side automatic sensitivity labeling, adaptive retention scopes, and auto-applied retention labels under plans such as Microsoft 365 E5.
For sensitivity labels, the page says two things. A feature table lists manual sensitivity labeling under Microsoft 365 Business Premium and Microsoft 365 E3, while the same page states that sensitivity labeling, including automatic or policy-based labeling, requires Microsoft 365 E5 or Microsoft 365 Information Protection and Governance.
No particular license is needed to request the review. Licensing determines which Microsoft Purview controls exist in your tenant, so some are reviewed only where licensed, and findings state where a recommendation depends on a license you may not have.
How is this different from Microsoft Secure Score?
Microsoft Secure Score measures your security posture against Microsoft’s recommended actions, and Microsoft notes that it isn’t an absolute measurement of how likely your system or data could be breached.
This assessment adds business context, reviews how settings interact, backs each finding with evidence, and sequences the remediation. The two are complementary, and Secure Score remains a useful way to track progress.
Do Litigation Hold and retention policies do the same thing?
They are not the same. Microsoft’s retention documentation lists Litigation Hold as an older Exchange Online feature that provides retention only, and describes Microsoft 365 retention policies and retention labels as a single solution to manage both retention and deletion across workloads.
Microsoft says Litigation Hold is still supported, but recommends Microsoft 365 retention or eDiscovery holds, as appropriate. The review lists which older retention features are still in use alongside your retention policies.
What access does the review need, and will it change our policies?
It depends on the agreed scope and assessment method. The roles involved, who grants them, and how long access lasts are agreed before the engagement starts.
Access follows least privilege and is time-bound. Read-oriented roles are preferred wherever the assessment method allows.
Nothing is changed without your agreement. Whether the engagement includes any remediation activity, and who carries it out, is agreed during scoping before work begins.
How much does a Microsoft Purview data protection review cost?
It depends on scope, which is agreed first. Timing and pricing follow from the size and complexity of your tenant, the control areas included, and the deliverables you need.
Scope, timing, and pricing are all confirmed in writing before the engagement starts.
Get a clear view of your tenant’s configuration.
Tell us about your environment and the questions you need answered. We’ll help define an appropriate assessment scope.
Discuss your audit