Microsoft Purview Data Governance Reviews

We use Microsoft Purview to protect sensitive transactional data. We can control organizational policies such as who can monitor the system and how data is shared between managed apps and enrolled devices. We create the data loss prevention policy.

Purview can deliver data protection across multi-cloud and multi-platform environments. For example, we can set up a multitenant environment across different vendors and control Purview through Azure. Our enterprise licensing allows us to extend the connectors and tokens to other vendors. Once the connectors are active, they streamline the same functionalities and policies across the data on the other clouds.

Purview can connect to iOS, Mac, Android devices, and other SaaS apps, provided that we have created enrollment profiles for the other devices in Microsoft Azure. We can then monitor those devices from a central Microsoft location.

Microsoft Purview's natively integrated compliance across Azure Dynamics 365 and Office 365 is important because all escalation auto breaches from Microsoft or our data loss prevention policy will be highlighted to our program manager and portfolio manager. Therefore, we must treat this as a service-level agreement breach. The most important thing is to ensure that we are alerted whenever sensitive data is sent across 18 servers, Microsoft Office 365, or by people using their hybrid environment to connect to Office 365.

It is important that Purview was built taking into account the critical regulations from around the world because one of the accounts I support is a financial institution from the UK with offices in Europe. As a result, we have new regulations to comply with. We had a different region-wide DLP setup for the UK and Europe, but we needed to ensure that it was within the new Purview system and that data could not move out of it. To achieve this, we have people in Europe working on certain governance and risk portfolios that we have created using Microsoft Azure and Purview. We also share this information with our audit team, which comes in from outside to verify it every quarter.

We have an in-house process for handling policy violations. Purview's DLP for remediating policy violations helps us. For certain categories of transactional and social ethics violations, we capture data on any copying of sensitive data. This is because sensitive data should not be shared. We capture this data using our exchange server. It is difficult to share sensitive data, but we can capture it. We then share this data with our ombudsman team. The ombudsman team will review the data, including the timestamps and users involved, and determine what action to take. In rare cases, the person responsible for the violation may be removed from the team or organization.

Awareness of mobile device monitoring must be shared across the organization, especially with end users who may not be aware that their actions are being monitored. Training should be provided to all users of enrolled devices, regardless of whether they use Intune or another endpoint server. There are three sets of training, End-user training, Admin training, and Global provider user training.

Over the past two years, we have improved our relationship with external auditors. In the first year, it was challenging to implement DLP policies. However, in the second and third years, we have had fewer than ten violations. These violations were typically due to users accidentally accessing sensitive data without their knowledge. We have been able to significantly reduce our policy violations in the past three years using Microsoft Purview.

Purview has helped us reduce the number of solutions we need to interact with each other. We used to have a lot of L1 tickets that came in earlier, where there was a policy change or configuration change being done. And then we didn't have a proper change process or control over the data that had been accessed, because it was in a shared model. This led to SharePoint violations. Now that this has been reduced, we have proper version control, and anyone accessing these resources must check IAM. As a result, those L1 tickets, which were more than a thousand in the first year, have been reduced to less than a hundred or so, in terms of SharePoint access violations. So, this is one area where we have seen a significant drop because the IAM and the user's profile now determine whether they have read and write access.

Our visibility into our estate has improved significantly with Purview. We started a pilot project, and the project manager who owns this portfolio is already running the show, even before the policy is set for the organization itself. This level of visibility was tested in a small pilot project, and now the project manager has full visibility.

Microsoft Purview allows us to demonstrate our compliance in real time. On the default dashboard, we can see the number of phones that have violated the DLP policy that we created. We can then determine which standard was breached, such as ISO or BIS. We use Purview for weekly compliance calls with the client as well.

Purview helped streamline our meetings with compliance regulators by making it easier to share data with them.

Microsoft Purview has helped us reduce our time to action on insider threats. Before Purview, we manually managed our insider threat detection process using a weekly Excel report with a macro. This meant that if a breach occurred on Monday, we would not review the report until the following Monday, resulting in a one-week time to action. With Purview, we can now take action as soon as Purview detects the violation.

Purview has saved our admin teams 99 percent of their time spent investigating violations. In terms of cost savings, Purview is included with our E5 license. The savings are significant.

Purview helps us maintain compliance. It gives us full control over our data, and when there is a violation, we can follow our established procedures to decide whether to call the ombudsman or if the process setup is sufficient.

Purview helps mitigate risk and allows us to govern the information being shared among apps and devices. Purview can restrict access from even the smallest threats, such as a mobile device trying to access and manage apps.

I would like to have AI functionality on the dashboard to help me analyze and report on the data that we capture using Purview on a daily basis.

I have been using Microsoft Purview for three years.

Purview is stable and always available because it is a SaaS service, which means we don't have to worry about the infrastructure.

Purview is scalable depending on the number of transactions we want to monitor per day. 

Whenever we had an issue with Purview during the test phase of setting up DLP, we would call Microsoft Premium Support. They responded immediately and assigned a support engineer to our case right away. The support engineer would escalate the issue to their internal product group team, who would update Purview on the backend with a patch. The product group team would then let us know that our feedback on the product had been accepted and that they had worked on a solution, which would be released within the next week or quarter along with other updates. Overall, we were very pleased with their support.

Before Microsoft Purview, we used a feature in Intune called data analytics to record what users access and the transactions they perform. However, this data was not meaningful, and there was no way to filter it to identify breaches. As a result, we had to manually review all of the transactions for all users in the organization to see if any were violations.

Microsoft Purview is able to capture breaches because we use tags to properly understand the data and identify violations. For example, we can tag all transactions involving credit card numbers. When we run the ETL tool, it uses the tags to identify transactions that may be violations.

Initially, deployment will occur once the data is confirmed by the ETL team and properly ingested. This process typically takes a few weeks, depending on the volume of data. Once the initial deployment is complete, we will design and test the DLP and UAT systems. This process typically takes two weeks to a month.

Once it is deployed to production, any future changes or updates must be approved by a cabinet review board, and we must have a rollback plan in case anything affects production.

We have eight engineers who work at different levels to ensure that the data is furnished correctly, regardless of whether it is structured or unstructured, how it is being populated, or where the data loss prevention process runs daily. We also have a couple of managers and a scrum leader, as well as a portfolio manager.

When we implemented Purview, we were able to reduce our staff by 60 percent. We no longer need compliance officers to manually check spreadsheets for changes or breaches. In addition to the staff reduction, we have SLAs that require us to pay penalties to our clients if there is a violation. With Purview, the number of SLA breaches has been significantly reduced, saving our organization over one million dollars.

Microsoft Purview requires a Microsoft 365 license and is included with an E5 license. The license is expensive, but it is worth the cost because of all the tools it includes.

I would rate Microsoft Purview nine out of ten.

Purview is a cloud-based SaaS product. We keep our sensitive data on-premises, but we export a de-identified version (.NET) to the cloud in order to review reports for violations.

I recommend Microsoft Purview, especially for organizations that are already using Azure. Purview can be used to extend their risk governance capabilities in a seamless manner. There are other solutions available, but Purview is flexible and offers hybrid, cloud, and on-premises options with connectors for other vendors.

Our primary use cases involve sensitivity labels and data loss prevention. Within data governance, our focus is on ensuring the security of data that leaves our locations and that only authorized people view it.

The data protection feature is vital as it controls who can access data when it moves out of our protected boundary. Additionally, it helps us meet federal regulations by ensuring that sensitive data does not get out into the world where we don't want it to be.

We are currently in the rollout phase, so I am not entirely sure about specific areas of improvement. However, there are some problems with DLP rules, and it would be great if the security around DLP could be expanded.

I've used Microsoft Purview Data Governance for about a year.

We are in the rollout phase, so I don't know much about its stability yet.

The scalability is probably solid.

I rate Microsoft support seven out of 10. The support could be better, particularly with consulting.

Neutral

The initial testing has been fairly smooth. There's a learning curve. We're still figuring out the product's limitations. 

We did everything in-house for the deployment.

On a scale of one to ten, I would rate the overall solution as an eight.

Our data landscape includes cloud-based resources, Software-as-a-Service applications, and on-premises deployments. To ensure consistent governance across this entire environment, we leverage Microsoft Purview for unified data management.

Since our environment houses data for multiple tenants, it's crucial that Microsoft Purview can effectively manage and access information across various cloud platforms.

Microsoft Purview's strength lies in its ability to connect to a wide range of devices, iOS, Mac, Android, and SaaS apps, allowing it to build a full data map across our entire cloud infrastructure. This cloud-based approach enables automatic data classification and updates, ensuring all our information, on-premises included, is consistently categorized and readily accessible.

Microsoft Purview's data connector platform for supporting ingestion from non-Microsoft data sources is important for our environment.

The natively integrated compliance across Azure, Dynamic 365, and Office 365 is important. This centralized approach ensures consistent data governance and security policies across our entire cloud environment.

It was designed with compliance in mind, considering important regulations from around the world. This global perspective helps identify and address data security threats more effectively.

To ensure our data development adheres to security policies, we utilize Microsoft Purview's data loss prevention features, which aid in efficiently resolving any policy violations that may occur.

Leveraging the logs generated by Microsoft Purview, we can educate our users on best practices for handling sensitive data.

We can use Microsoft Purview for MacOS endpoints.

It has helped our organization protect its data and helps reduce the number of solutions we need to interact with.

Microsoft Purview's data visibility has enhanced our technical understanding of our data landscape, improving data recovery efforts. Additionally, the compliance portal streamlines access to information needed for audits.

AI and automation have significantly enhanced our ability to detect risks, allowing for both faster identification and more precise analysis of potential threats.

Microsoft Purview enables us to show compliance in real time. This is a great tool that helps us focus on the compliance reports.

It helps reduce the time to action on insider threats by six hours per day.

Microsoft Purview has saved us 30 percent of our time to focus on other projects.

Microsoft Purview has positively affected our ability to stay on top of compliance.

Microsoft Purview stands out for its automatic data recovery system, which prioritizes critical data for the fastest restoration.

Microsoft Purview's Data Loss Prevention for Mac endpoints hasn't met our expectations, and we believe there's room for improvement.

Microsoft Purview's compliance processes for handling various Mac and iOS devices could be significantly improved.

I have been using Microsoft Purview for two years.

Microsoft Purview is stable.

Microsoft Purview is scalable.

The technical support is great.

Positive

I would rate Microsoft Purview nine out of ten.

We have 200 users of Microsoft Purview in our organization including two admins.

No maintenance is required.

I recommend Microsoft Purview to others.

As a Microsoft partner, we specialize in selling Microsoft products to our clients. Microsoft Purview serves as a typical data cataloging tool within our data governance projects.

Microsoft Purview offers comprehensive data protection capabilities across multi-cloud and multi-platform environments, including AWS and Google Cloud Platform. When discussing data protection, it's essential to recognize the different facets of Purview solutions. Firstly, there's the data catalog side, which focuses on organizing and managing data assets. Secondly, there's the risk and compliance aspect, which encompasses solutions like data loss prevention, insider risk management, and information protection for data security. Additionally, there are risk and compliance management features such as data lifecycle management, e-discovery, audits, and communication compliance. Microsoft Purview has been working towards integrating these three aspects—data security, data governance, and risk and compliance—into a unified interface which would provide a seamless experience for users to manage all aspects of data protection efficiently.

The ability for Purview to connect with iOS, Mac, and Android devices, as well as data from various SaaS applications, is of utmost importance. Customers prioritize this capability because they aim to safeguard their data regardless of its location—whether on mobile devices, in the cloud, or on computers.

It serves as a connection platform that supports the integration of data from non-Microsoft sources. While its capabilities for connecting with non-Microsoft data sources are continuously improving, there are still some limitations. Presently, Purview can connect with other cloud vendors such as Google Cloud, Amazon, and IBM.

Ensuring native integration of compliance across Azure, Dynamics, and Office 365 is a top priority for Purview. The aim is to consolidate all compliance functionalities into a unified interface, although currently, they remain separate. The ultimate goal is to streamline compliance processes by centralizing them within a single portal.

We use Purview for data loss prevention.

It hasn't yet streamlined the integration of solutions we interact with, as they remain separate. However, once the unification of data governance, data security, and risk compliance functionalities into one portal is fully implemented, it will likely reduce the need for multiple interactions. Currently, we're still navigating through different interfaces and portals to achieve our goals. So, as of now, the solutions remain separate, but there's potential for improvement in the future.

Purview has enhanced our visibility into our data estate, especially through the democratization of data via the data catalog. By surfacing our data assets and making them accessible throughout the organization, we've achieved better visibility overall. However, it's crucial to note that successful data governance requires more than just technology—it also involves having the right teams, processes, and policies in place. Therefore, by ensuring that all three components of data governance are aligned and well-managed, leveraging Purview's data catalog can significantly improve visibility into our assets.

There are AI components utilized for classification purposes, particularly in identifying names, such as people's first names and locations like cities. Additionally, there's deeper integration with MDM partners like Profisee and Tamr, who leverage Azure OpenAI for this purpose. However, even without these third-party vendors, within the data catalog or data map, classification relies on machine learning to identify and surface sensitive information effectively. AI has a significant impact on the quality of insights in Purview. It automatically classifies sensitive assets during scanning, which effectively reduces manual effort and ensures thorough coverage of sensitive information within the data catalog.

The ability to demonstrate compliance in real-time is facilitated by a dedicated solution known as Compliance Manager. This specific Purview solution falls under the category of risk and compliance, providing the necessary tools to showcase compliance status effectively.

Purview, particularly the Compliance Manager, has assisted us in enhancing compliance with regulatory requirements. With Purview Compliance Manager, it identifies areas where compliance may be lacking and provides actionable steps to achieve compliance. This tool facilitates easier discussions with compliance stakeholders and ensures alignment on necessary actions.

It has contributed to reducing the time required to address insider threats through its integration with Microsoft Defender for Endpoint. This integration includes a specific feature known as Insider Risk Management, which enables proactive detection of and alerts for suspicious or malicious activities.

It has helped save both time and money. One particular feature is called Data Sharing. Its primary aim is to minimize data duplication. This feature allows users to share data internally and externally without physically moving the data itself. Instead of creating additional copies of data as attachments or sending them via email, users can share data directly from its existing location. This reduces the need for storing multiple copies of the same data, ultimately saving storage space and associated costs.

It has enhanced our ability to maintain compliance by integrating Purview with Microsoft Sentinel. This integration enables the creation and sending of alerts, allowing us to proactively address sensitive information as it enters our data catalog.

It is designed to seamlessly connect to various data sources, which is particularly beneficial for our customers who primarily use Microsoft technologies. These sources include Azure Data Lake Storage Gen2, Synapse Workspace, and other platforms that Purview natively supports. Data cataloging is a fundamental feature of Purview, allowing users to organize and manage their data assets effectively. It also offers powerful lineage capabilities, enabling users to trace data from its source systems to the reporting layer. While there are some limitations in supporting end-to-end lineage for certain assets, Purview excels in automating lineage for supported assets such as Azure Data Factory and Synapse pipelines. Another valuable feature of Purview is its glossary terms functionality. Recently, we completed a project for a customer who was migrating their data dictionary from SharePoint to Purview's data catalog. This migration allowed them to seamlessly connect glossary terms to their ingested data assets, enhancing their data management and governance capabilities significantly.

Data quality has been a highly requested feature among customers. While it was initially scheduled for release in December last year, I anticipate that this feature will be available soon this year.

I suppose that with the integration of all three solutions—data security, data governance, and risk and compliance—there will be a clearer direction regarding changes on the people side of things. Like any other changes, this integration will necessitate new responsibilities, processes, and policies. It's essential to outline the expected changes on the people side, such as identifying impacted personas and defining their new responsibilities.

I have been working with it for three years.

I've encountered some slight lag, although Microsoft boasts a 99.9% SLA guaranteeing availability. This means there's an estimated downtime of around eight hours per year, but overall, disruptions are minimal.

Scalability has become more streamlined with recent updates. Previously, selecting a data map capacity was necessary when creating the data catalog, but now scalability has been improved. This means reduced overhead and eliminates the need for manual adjustment, making it easier to manage.

I've reached out to tech support numerous times. Interacting with them is always a positive experience because they consistently offer prompt assistance and valuable insights. It's particularly beneficial when dealing with new features or issues that many clients may not have encountered yet. They consistently deliver the assistance I need promptly and effectively. In cases where immediate answers are not available, I escalate the issue until I connect with the right individuals who can provide the necessary assistance. I would rate it ten out of ten.

Positive

Before transitioning to Purview, I was using the older version, which was Data Catalog.

The initial setup of Purview is straightforward, requiring just a few clicks to create an Azure account on the Purview portal. However, the complexity arises in setting it up properly, especially considering the Cloud Adoption Framework and the Analytics framework. While the setup can initially be simple, achieving scalability requires certain skills and responsibilities within the organization to ensure it's done properly. Scaling the architecture involves creating new data landing zones or subscriptions for different data workloads, such as Azure Machine Learning Workspace for data science teams while maintaining organizational governance and best practices. We are the ones responsible for assisting people in implementing Purview.

Typically, it requires at least two individuals from our team to deploy Purview, though sometimes up to three, depending on their skill sets. One essential role is a data governance lead responsible for overseeing tasks related to the data catalog, such as setting up the collection hierarchy and defining data domains. On the Azure infrastructure side, either a versatile solution architect or an Azure architect is needed to define the data management landing zone and data landing zone. This individual may also take on the role of a DevOps engineer to manage CI/CD processes for resource deployment and integration. Additionally, a data engineer is required to facilitate the movement of data assets from sources to the data warehouse. Lastly, a fabric administrator assists with necessary tenant settings. However, at a minimum, a solution architect and a data governance lead are essential, with the solution architect often taking on multiple roles.

The return on investment involves significant effort initially, but as organizations mature in their data governance practices, they begin to reap the benefits. These benefits include improved data quality, enhanced visibility of data assets, and increased compliance.

Currently, the licensing differs for the governance side compared to the risk and compliance side. On the governance side, the charges are based on the usage of Purview, including the data map, data catalog, and scanning and classification jobs. However, on the risk and compliance side, it's based on licensing, specifically the E5 license, to access the risk and security compliance features. As of now, the pricing structures remain separate. Improvements in providing clearer information on any pricing changes as these three solutions are unified would be beneficial.

The data quality is a top priority for clients and customers, and while it's expected to be available soon, there are a couple of reasons why there's a slight drawback. Firstly, the rebranding and renaming have confused customers. Although the move towards unifying everything into a single portal is a positive step, it has led to some customer confusion. Providing clearer guidance and communication about these changes and their associated responsibilities will be essential moving forward. Additionally, recent changes in features, such as the replacement of classification with sensitive information types in Compliance Manager, have shifted certain responsibilities from data governance leads to compliance or security teams. While this change impacts customers already using classification rules, it signifies a broader shift in responsibilities. Furthermore, the integration of Purview into Fabric is another aspect that requires better communication, likely due to upcoming changes and features. It's expected that after the unification of tools and features in the unified portal, there will be more emphasis on Fabric integration. Currently, details about this integration have been limited, but this is likely to change with upcoming releases. Overall, I would rate it seven out of ten.

I am a system integrator for Microsoft Purview. I have assessed some customers who already have Microsoft Purview because of their E5 license. However, they are not aware of Purview's capabilities. Purview is a relatively new product that provides an end-to-end data security lifecycle solution. It allows us to review our data with a data governance solution, classify it, protect it, and prevent data breaches. I have worked on almost all aspects of Purview.

We have assessed some customers and provided them with use cases such as using Purview to protect confidential data recovery. This allows them to manage their own workflow for vendors on a contractual basis. We have multiple use cases for Purview.

Purview's natively integrated compliance across Azure Dynamics and Office 365 is important. Microsoft has the advantage of being able to connect other solutions in its suite more easily, and this makes Purview a very good choice. With the exception of OCR in Teams, Purview works very smoothly. If we want to protect something in an email, Purview will prompt us immediately if we have configured it to do so. This is very convenient, and Purview does not use more system resources than expected. Another advantage of using Purview is that it is Microsoft's own product, so Microsoft can customize it to its own needs and ensure that it does not impact system performance.

It is important that Purview was built taking into account critical regulations from around the world. Purview is important because businesses are increasingly operating globally, and data is moving between different regions and countries. Purview is up to date with respect to different regional, national, and state privacy laws. I have found Purview to be a great solution, but it is not yet operating as well as it could. Microsoft is working hard to address this issue, and they are publishing new privacy acts to Purview on a regular basis.

How we use Purview data loss protection to educate users on how to handle sensitive data is we deploy Purview in the organization, categorize the data by region or department, perform data flow analysis to understand how the data is used and shared, classify the data as low, medium, or high risk based on the daily digital annual loss, We protect the data using Microsoft DLP, We publish videos on SharePoint to educate users about data classification and labeling, and we enable users to self-educate by providing them with access to documentation and training resources.

Purview is valuable because it is the only end-to-end data lifecycle management solution that provides data governance, classification, and protection.

Purview helps to reduce the number of solutions we need to interact with.

The reduction of the number of solutions we now need to interact with has simplified our data governance. 

I am satisfied with the visibility that Purview provides. Even without configuring anything, we can see many insights, but we do not get the exact details unless we configure Purview accordingly.

It provides a real-time compliance score for all our devices connected with Identity Access Management and Defender.

Purview helps us save time by publishing the policies quickly and collecting information in real time.

Purview helps us stay compliant. I have not encountered another solution that provides end-to-end licensing.

One of the valuable features of Microsoft Purview Information Protection, formerly known as Azure Information Protection or Microsoft Information Protection is data classification and data governance. MIP provides a unified labeling client that allows users to apply sensitivity labels to documents and emails in Microsoft Office files without the need for extra plugins or agents. MIP also provides strong information rights management settings, such as the ability to specify who has access to content and at what time.

Microsoft Purview's ability to deliver data protection across multi-cloud and multi-platform environments is important, but there are some limitations. For example, if we have our own cloud solution, Purview cannot currently protect it. However, we can integrate Purview with other OEMs, such as Forcepoint, McAfee, or Symantec, to provide DLP functionality for our CASB. Additionally, Purview cannot protect cloud platforms that are part of a shared domain, such as our own website, unless they are part of the public domain. Purview needs to add DLP support.

One of the things I would like to recommend is that Purview doesn't have the option to push policies or updates in real-time. Instead, it is based on the last five-bit communication. We cannot make any changes to this. It is based on the device when it is communicating with the server. If I want to do this forcefully from the server, if I want to send a wake-up call to all or selected agents throughout the organization, Purview does not have this capability in the GUI.

The reporting functionality needs to be improved. I have found that the solution is not satisfactory for reporting. We have to use Power BI to generate the overall profit, but this requires a lot of configuration. In another solution, we can easily achieve the same reporting functionality.

Purview does not have OCR functionality or network web. Therefore, OCR functionality is not included. OCR is available for Teams, but it does not work as expected. For example, it does not work well for systems that deliver to the recipient database, which could cause problems if it does not match our rules.

Purview has limitations connecting to Android devices and SaaS devices.

While Purview's data connector platform can ingest information from non-Microsoft data sources, it is slow to do so and the information may become outdated.

I would rate Purview's data loss prevention for remediating violations a six out of ten. The reason is that Purview does not have an option for endpoint discarding. In contrast, Forcepoint and Trellix are more mature DLP solutions that offer endpoint discarding. This allows us to scan endpoints for sensitive data, take a replica of that data, and store it in a safe location. We can also encrypt the data on the endpoint. Microsoft Purview DLP does not offer this functionality. It is only available for Teams and email.

I have been using Microsoft Purview for one and a half years.

Some features of Purview are stable, while others are not. MIP is very stable. DLP is constantly being updated, so some of its options may be unstable. The only stable portion of DLP is the database checking management.

Purview is in the cloud, so it is scalable. However, Microsoft sometimes makes it confusing by adding add-on features that we are forced to add and which will cost us to move. For example, there are options for endpoints four and six, but to use these, we have to add block storage, which will cost more. We should only have the option to configure everything in one console. This is because humans sometimes need to go to the Azure team and ask for access if they do not have Azure. Alternatively, the Azure admin team has to do this on their behalf. This is something that Microsoft can think about.

The customer support is the worst. When we were raising the case, the support was literally asking us how to resolve the issue. So I was really confused about what kind of support this was. We were seeking support, and apparently so were they. One of the customer support people had just provided us with dates but was not working on resolving the issue. I don't know why.

Negative

I have also used McAfee, Symantec, and Forcepoint for our data security. These solutions all offer endpoint discarding, which Purview does not. This gives us the option to replicate and save a copy in another place. Endpoint discarding is granular, and we can save reports in real time and connect to endpoints in real-time. We can also bypass the endpoint, which we cannot do with Purview. McAfee does not have to be built in, while Symantec does. 

The pros of Purview are utilization and performance. It is a lightweight solution that does not impact system utilization. This is important. Microsoft is a one-stop shop for data classification and DLP, so we may not need to worry about integrating with different vendors. We have MIP, and then DLP if we have exposure from DLP. Of course, it is possible to integrate with the help of APIs, but there is a risk that Microsoft may decide not to integrate with Forcepoint or Symantec in the future. This is something customers should think about. In that case, for customers with an E5 license, Purview would be the best choice because they can utilize all the Microsoft products and save costs. This strategy will also improve their security posture.

The initial setup is straightforward. Just plug in our internet credentials. That's it! No need to worry about the server, its utilization, configuration, or architecture. It's very easy to use, and we don't have to worry about disaster recovery or data centers. In a way, it's really helpful and cost-effective. Microsoft is taking care of everything on a pay-as-you-go basis.

The number of people required for deployment depends on the number of end users and departments. For example, an organization with 15,000 end users, 40 departments, and some generic requirements can deploy the solution using one L3, one L2, and two L1 people.

The fact that our organization continues to use Purview indicates that it provides some sort of return on investment.

We pay $15,000 per end user for the E5 license.

I would rate Microsoft Purview seven out of ten.

According to Gartner, Microsoft DLP is one of the top ten DLP solutions, but the top three are Trellix, Symantec, and Forcepoint. I prefer Forcepoint.

The maintenance is easy to complete.

I highly recommend that an organization use an E5 license if they are going with Microsoft because this will give them everything they need, including technical management, governance, and data management.

We use the solution to defend endpoint workloads and prevent data loss. We also use it for governance.

One of the biggest benefits of the solution is visibility. Previously, we had a myriad of different solutions for compliance and to look at different workloads. Microsoft Purview brings all those things together in a very similar look and feel.

It also enables access management. We can provide an elevated privilege for a limited time. If the user needs privileged access, they can request it on an ad-hoc basis. We have workflows to provide access depending on different approval models. We can do all such things without elevating the risk posture.

The time to onboard is pretty short. It comes with a whole bunch of recommendations for somebody who has a small crew like me. It gives the ability to onboard the product and have a really good baseline to begin with. All I have to do is three or four clicks, and it's off and running. It is one of the greatest removers of barriers to entry. We have to be generalists, being a small shop. It's important for us to begin from a great place. Some other highlights compared to the competition are

• Unified Data Governance & Compliance
• Comprehensive Data Discovery & Cataloging
• Deep Azure Ecosystem Integration
• Data Loss Prevention (DLP) and Insider Risk Management
• Role-Based Insights and Access Control

The tool's Windows PC offerings are far better compared to the granularity on the Mac side. The product must provide better integrations with OS X and iOS. There must be feature parity. The product must also provide better integrations with other ecosystems. I'd love to see Microsoft integrating with Google Workspace, at least in the EDU K-12 space. Most people in the EDU space use Google Workspace and Microsoft. Extending the capabilities of Purview would be phenomenal. to summarize, 

• Limited functionality on macOS (e.g., sensitivity labels not fully supported in all Office apps)
• Inconsistent feature parity across platforms (Windows vs. macOS vs. web)
• UI complexity and steep learning curve for new users

.

I have been using the solution for five years.

The tool is stable.

The tool is scalable.

The support must be improved. Unfortunately, a lot of times, it's a hit or miss. With the breadth of their customer base, much of it must be diverted to third-party consultants. I almost dread it when I see an email from a third-party vendor. When you're an insider, you have much better access to resources than a consultant.

Positive

We were using Barracuda DLP for email filtering and file sharing. We switched to Microsoft Purview to bring it all under one umbrella.

The initial setup was straightforward.

I have a few friends in the industry who've done this. We did a proof of concept, began small, looked at the pros and cons, and expanded it.

The product saves us time and effort. We can easily access Microsoft Exchange or Microsoft 365 and see the violations. It has easier and fewer workflows. Otherwise, we would have had to go into individual users' file systems and look for violations.

The solution is extremely affordable for the K-12 space.

We evaluated solutions for individual silos, but we did not evaluate a cohesive unit like Microsoft Purview. Microsoft is extremely affordable for the K-12 space. It was a no-brainer to onboard Purview to peer across different workloads.

Barracuda Email Security was pretty good. The problem was that it was a single solution. It doesn't extend across our data estate. Purview has a vast and rich ecosystem.

It is extremely important that Purview delivers data protection across multi-cloud environments. They currently do GCP and AWS, but not necessarily Google Workspace. I'm hoping that it'll be their next natural extension.

It is very important to us that Purview was built taking into account critical regulations from around the world. Since we work in the K-12 space, we deal with minors. It is important to protect their identity and privacy and have their well-being and the nationwide and statewide regulations at the forefront. It's very important for us to be compliant, not just from a compliance perspective, but also to protect the needs of children.

Insider risk is a big challenge. Many people want to share and communicate. There's a balance between communicating and oversharing confidential information. It's reasonable to expect a teacher to know all those nuances. A policy that can oversee and provide guardrails to users is very important. A feedback mechanism for the end user to act on would be very helpful.

We can see across different systems without too much effort. It is very important to us. Purview enables us to show our compliance in real-time. The security score helps me compare myself to other organizations. Being able to identify a gap and fill it is super helpful. As a small organization, our audits are more financial in nature.

More than time and money, the tool has increased accountability within the organization. We can have proactive conversations about data security. The product provides me with a 300% return on investment.

It is critical for us that Purview connects to iOS, Mac, and Android devices. Large organizations can have separate IT sections for different departments. As a smaller organization, our ability to support different needs across different SaaS applications and platforms through Purview is important.

The ability to peer more into heterogeneous environments is an area of growth for the solution. It is a must-have.

Overall, I rate the product a seven out of ten.

We use Microsoft Purview for DLP capabilities and email encryption.

Ensuring data protection across multi-cloud and multi-platform environments through Purview is crucial for us. Currently operating on Azure and AWS, we plan to migrate a portion of our on-premises workloads to the cloud. To achieve this, we will leverage Purview for data loss prevention on our virtual machines and utilize Azure Arc for centralized management of all our platforms.

Purview's ability to connect to a wide range of devices, including iOS, Android, and others, enhances our visibility into BYOD devices deployed across our environments.

As a public organization, we are bound by policies and regulations. To ensure compliance across Azure Dynamics 365 and Office 365, both locally and internationally, we leverage the native compliance capabilities of Purview, which integrates seamlessly with both platforms.

The DLP for remediating policy violations works well. We can easily view the details and conduct investigations from a single dashboard.

We recently started using Purview for DLP on Mac OS devices.

Implementing Purview as our primary data loss prevention solution has yielded significant benefits. Our Microsoft E5 license provides enhanced protection across the organization, offering immense value through its comprehensive features. Consequently, we have been able to streamline our security posture by consolidating third-party solutions and focusing on Purview and other robust Microsoft applications.

Microsoft Purview has streamlined our workflow by consolidating diverse systems into a single, user-friendly dashboard. This one-stop shop simplifies access and management across our organization.

Microsoft Purview enables us to show our compliance in real-time. We are satisfied with the speed at which Purview provides alerts and details to us.

Microsoft Purview has significantly shortened the response time to insider threats by almost 70 percent. It can rapidly block unauthorized user access, leading to a reduction in required manpower.

Microsoft Purview has helped to save money by preventing the loss of data in our environment as well as around 60 percent of our admin user's time.

Purview helps us stay on top of compliance. We no longer have to review incidents manually, improving compliance by 80 percent.

The custom classifications are one of the most valuable features. For instance, if we want to block the transfer of card details, there are many pre-built samples for different countries that we can easily use in Purview, eliminating the need to create our classifications which makes the work easier.

Purview needs to improve its DLP capabilities for removable devices such as external drives and USB devices.

The custom data classification for the African region needs to be improved.

I have been using Microsoft Purview for five years.

Microsoft Purview has been stable, with no incidents involving the Data Loss Prevention functionality. However, there have been a few instances where the admin portal has been unavailable.

Microsoft Purview is extremely scalable.

The support response time can be improved.

Positive

We are currently using Forcepoint and Microsoft Purview, but with our E5 license, we're considering consolidating our security products under one umbrella and one dashboard, potentially phasing out Forcepoint.

The initial deployment took a few hours. Five to six people were involved in the deployment.

I would rate the cost of Microsoft Purview a six out of ten with ten being the most expensive.

I would rate Microsoft Purview an eight out of ten.

We have a complex group-wide tenant that requires us to have different administrative units for each country. We have around 50,000 users worldwide.

Purview does not require any maintenance beyond regular checks in the admin portal to ensure everything is functioning correctly.

We have implemented Microsoft Purview as a comprehensive DLP solution for our clients across Europe, Africa, and the Middle East to protect their data and help them classify, identify, and investigate who and how the data is being accessed.

Microsoft is aiming to build favorable relationships with other cloud solution providers. On our end, if we have both AWS solutions and Microsoft's cloud solution, implementing the Microsoft Purview dashboard can be a good way to collect and classify our data across both platforms. This could be a strong selling point for Microsoft to explore partnerships with AWS and other public cloud players, allowing them to combine and leverage their global development, sales, and services.

Implementing Purview's integrated compliance across Azure Dynamics 365 and Office 365 is relatively straightforward thanks to available connectors and Microsoft's improved user interface.

Microsoft Purview includes a compliance manager, which simplifies meeting various standards and regulations through integration with companies like ISO, ISCE, and other risk solutions. This feature is an add-on for E5 and E3 licenses. It allows us to create assessments that generate reports with specific recommendations for implementing and configuring ISO 27001 or other standards within our Microsoft 365 environment. This makes compliance significantly easier and, according to Microsoft, can reduce the cost of implementing such measures by approximately 40 percent compared to using other solutions for ISO compliance or other critical regulations.

Given my role as a cybersecurity consultant, I previously created a DLP policy based on the client's needs. Since then, I haven't had further contact with the client. However, I'm now working on a new project for them next year. This project involves developing and implementing a DLP solution with a focus on information protection. My responsibilities include monitoring all user activity and reporting on it in a few months. Based on my observations, there's a significant amount of activity requiring governance. This includes areas like DLP policy enforcement, USB blocking, printer control, copy prevention, file transfer via secure FTP, and external user access restrictions. Purview's data loss protection is helpful for remediating policy violations.

I'm developing a short training guide, about four pages or more, on enabling information protection labeling and related topics. Some clients have suggested automation, but I believe the best approach is to guide users through manual labeling. For instance, we could have a "Sensitive" label for data like personal information, ID numbers, passports, names, passwords, and so on. Information protection can be implemented either by defining detection rules beforehand or by using the system's automated detection capabilities. If sensitive information is detected, the system can then recommend applying the "Non-Confidential" label or whichever equivalent label we prefer.

Microsoft has developed and launched Microsoft Defender for Endpoint for Mac. This agent for macOS is the same agent used for data loss prevention in Endpoint. However, if we don't require DLP for Endpoint, we can simply synchronize our Macs with Microsoft Intune. Intune, a combination of Microsoft Entra ID and an MDM solution, is not just for mobile devices; it's a device management platform for all company devices, including PCs, Macs, mobile devices, and servers. It allows us to synchronize settings and policies across all our devices, manage software deployments, and utilize various other features. Therefore, we have two options: either synchronize our Macs with Intune or install the Microsoft Defender for Endpoint agent to implement DLP for Endpoint. DLP for Endpoint is mandatory if we need to detect and control USB devices, printers, and other data transfer peripherals.

Microsoft Purview's primary benefit lies in safeguarding sensitive and confidential data, thereby mitigating the risk of internal data exfiltration.

Purview does help our customers reduce the number of solutions they interact with. From a cybersecurity engineer and information security expert perspective, consolidating and streamlining technology can be beneficial for IT departments, especially before implementation. Currently, Security Service Edge emerges as a promising solution due to its integration with zero-trust principles and protocols. For example, instead of deploying multiple endpoint detection and response solutions, a single, antivirus-free EDR like CrowdStrike can suffice. Similarly, Microsoft's Defender for Cloud Apps, combined with XDR and other security features, offers a comprehensive solution for Security Operations Centers. My goal is to create a unified MDR solution for clients, allowing for centralized data collection and log analysis. This unified platform, ideally with one or two dashboards, would enable efficient investigation and response, minimizing investigation time and cost. Combining various tools into one interface eliminates the need to jump between dashboards, improving analyst efficiency. Why rely on multiple vendors like CrowdStrike, Proofpoint, Minetest, and MISSP when a single solution can offer comprehensive visibility and data security? Microsoft's Image Security 365, coupled with best practices and anti-phishing strategies, can significantly enhance security. Furthermore, I recommend implementing a DMZ with two firewalls, one internal and one external. This layered security approach, while requiring two vendors, provides redundancy and prevents attackers from exploiting a single firewall and gaining access to the network. However, it's important to remember that cybersecurity solutions are not one-size-fits-all. Each client and scenario requires tailored strategies based on their unique needs and context. Consistency across the industry is crucial, but it's important to acknowledge the lack of standardized approaches in the current landscape.

The Microsoft Purview dashboard is primarily a data security solution, allowing us to implement various layers to safeguard our information. While it can be used for some Endpoint Detection and Response functionalities, its full potential in this area might not be realized without proper configuration and understanding of the underlying processes.

While Purview offers real-time compliance monitoring, it's an add-on feature functioning as a compliance manager. However, due to a lack of clear communication, not all companies fully understand its capabilities. Additionally, it's important to note that while compliance and standards often relate heavily to financial and banking sectors, the scope of regulations has broadened significantly in recent years, extending beyond these specific industries.

Purview helps us stay on top of compliance because Microsoft has tried to build Purview based on the ISC framework.

No single feature stands out as the best because the most effective approach involves combining multiple features. For example, when using information protection, labeling, and classification, a multi-step process is necessary. First, we must classify our data, which requires a thorough understanding of our environment and the nature of the data itself. Once classified, we can apply labels and establish rules governing data sharing through information protection measures. The final step involves implementing and configuring a Data Loss Prevention solution. It's crucial to remember that the goal isn't to find ideal individual features; rather, it's to leverage the synergy of multiple technologies to create a comprehensive and powerful data protection strategy.

I've been working closely with Microsoft support on issues with the Microsoft Purview Information Protection scanner's on-premises services. While it's a solid tool, there's still room for improvement in my opinion. I've submitted numerous recommendations, from solutions to address specific problems to the implementation of new features like bulk scanning across multiple servers, not just individual paths. I've also encountered a high number of false positives in the classifier and made suggestions for resolving them. Microsoft support is currently reviewing my input, and we're collaborating to refine the scanner and minimize false positives. It's important to remember that this is a new technology, and like any newborn business venture, it's prone to growing pains. Errors and mistakes are inevitable along the way, but they're also valuable learning opportunities.

Frequent daily updates from Microsoft can cause interface elements like buttons to appear and disappear, making navigation unpredictable. Additionally, Microsoft also generates new licenses that require investigation to identify each new license.

I have been using Microsoft Purview for one and a half years.

Microsoft Purview is scalable.

Sometimes we have a communication gap or delay but most of the time the technical support is good.

One person can deploy Microsoft Purview.

We implement Purview for our clients.

We are a Microsoft Gold Partner and are currently satisfied with our existing solutions. Therefore, we do not prioritize evaluating other vendors at this time.

I would rate Microsoft Purview a seven out of ten. Purview is a good solution but it takes time to master.

We utilize Microsoft Purview to manage our data classifications, identify sensitive information in our documents for certification protection and data loss prevention, and we anticipate employing insider risk management. While we haven't yet implemented insider risk management, it is part of our strategic plan and compliance assessment.

From an access management standpoint, we have users accessing our data from various mobile devices, including Android, iOS, and iPad, as well as Windows and MacBook computers. Therefore, it is crucial to implement consistent policies and safeguards across all platforms, regardless of the operating system or device type.

We are a heavily Microsoft shop so all Microsoft platforms are important to us and Purview's natively integrated compliance is great.

It is important and useful for us that Purview was built taking into account critical regulations from around the world.

We report on all of our DLP policy violations. We have alerts set up to notify our security team to take action when violations occur.

Microsoft Purview Data Loss Prevention is an effective tool for educating users on how to best handle sensitive data. It can detect and identify various types of sensitive data, although we have observed that not all of the built-in detection mechanisms function flawlessly. Consequently, we have had to modify some of the detection modules. Additionally, certain detection rules specific to New Zealand have not performed as expected. Despite these limitations, the ability to detect sensitive data and utilize prompts to guide users in correctly classifying documents is quite valuable. We intend to expand our use of these features as we progressively deploy Purview across our organization.

We have several Mac OS users in our business, so it is important that Purview can and does extend policies regardless of the platform being used.

Since implementing Purview, the compliance assessment process has been effective. The expansion of country-specific regulations has been a crucial development. In New Zealand, we've utilized built-in privacy act laws and regulations, which have been beneficial. However, I believe the integration of the Copilot tool and advancements in AI will likely bring about continuous changes to the compliance landscape.

With Purview, we can continue using native Microsoft products for scalability, eliminating the need to rely on external vendors. This approach reduces the number of vendors in our environment.

The visibility Purview provides into our estate is useful. We have had a privacy campaign running for the last year and using Purview to essentially see where our data and sensor data are.

Purview enables us to show our compliance in real-time. We would use it to help demonstrate our compliance to regulators.

Purview enables us to save approximately 30 percent of our security team's time by providing visibility into previously obscured areas of our environment. Moreover, Purview is seamlessly integrated into our existing Microsoft licenses, eliminating any additional costs.

Purview helps us stay on top of compliance.

Data authentication enables us to classify documents based on whether they should be restricted for internal consumption or permitted for external sharing. This classification allows us to apply appropriate policies to each document type.

The DLP is also a valuable feature that we use.

The reporting is limited and has room for improvement.

Privacy features should be integrated into the core product rather than offered as optional add-ons, as privacy is not a luxury but a fundamental requirement.

I have been using Microsoft Purview for six months.

I would rate the stability of Purview a nine out of ten.

Purview can meet our scalability needs.

The technical support used to be more reliable and consistently good. Now, while it's still possible to get assistance from a knowledgeable representative, the overall quality of support has declined.

Neutral

We previously used Azure Information Protection and Symantec DLP. We switched to Microsoft Purview because of the cost savings.

Initial deployment is straightforward as we are a Microsoft shop, facilitating seamless integration with the native platform.

The deployment of Purview involved three individuals: one primary engineer and one architect. The initial deployment phase spanned six weeks, followed by an ongoing tuning process to maintain Purview's up-to-date status.

We have seen a return on investment, but it is too early to quantify the exact savings.

Purview is included in our Microsoft E5 licensing. There is no additional cost, but it does require us to maintain an E5 license to continue using Purview.

To fully justify the cost of Purview, it is important to leverage all of its capabilities.

I would rate Microsoft Purview a seven out of ten. While Purview is gradually improving, its reporting capabilities remain subpar. As we introduce additional products like Copilot and others, there will likely be a need for more robust integration plans that outline how these products will interact and the benefits they will provide.

We only use Microsoft Purview in our Microsoft 365 workload environment.

We are currently evaluating AI products like Copilot and several chatGPT-style tools for potential implementation within our organization. However, we are proceeding cautiously until we have fully implemented Purview to address our concerns regarding potential data loss associated with AI product usage. Once we are satisfied with Purview's effectiveness in mitigating these risks, we will accelerate our evaluation and adoption of AI products.

We have 5,000 users who were using Purview for the software, and we have a two-person support team. Every corporate user in our organization has a license to use the solution.

Purview requires regular maintenance because there is an ongoing need to review components like DLP rules and data classification. This ongoing maintenance ensures that the system continues to function effectively and accurately. Additionally, ongoing tuning helps to minimize false positives and false negatives, ensuring that the system accurately detects potential issues.

Ensure clear communication regarding the desired grouping of data classifications and the functioning of the data loss prevention policy. Understanding these aspects is crucial for effective product utilization. User training and communication are essential around the implementation of the data loss prevention policy as it impacts user behavior. Senior leadership should take the lead in championing this initiative, possibly as part of a broader privacy or border protection campaign. Our involvement in this process can be minimal.

My organization had a large amount of sensitive data stored primarily in SharePoint Online. We also operate in a highly regulated industry. Therefore, we wanted to take advantage of some of the features offered by Microsoft Purview. Initially, we focused on sensitivity and retention labels, but we later expanded to include data loss prevention and benchmarking our data against the built-in regulations offered by Purview.

It is important that Purview delivers data protection across multi-cloud and multi-platform environments. Many organizations have multiple systems, which can be difficult to manage. I know that many of my clients are currently trying to amalgamate their systems and bring them all under one umbrella, but there will always be cases where organizations will not be able to have everything in a single software solution like Microsoft 365. Being able to take advantage of Purview's excellent features and deploy them across not only 365 but also other systems makes it much easier. I think this is one of the reasons why organizations are starting to look at things like Purview: it has the ability to deploy more widely, saving organizations a lot of time and effort and centralizing control.

It is important that Purview can connect to iOS, Mac, and Android devices, as well as other data and SaaS apps. Many organizations issue portable devices to their staff, especially those with a high percentage of hybrid remote workers. These mobile devices have become essential, both personally and professionally. Having governance across multiple devices is a brilliant feature.

Purview's integrated data link compliance is a great feature. The biggest selling point for me is the ability to deploy it from one location; I haven't been able to manage everything in one place before. This makes it much easier for local administrators, and it can also be used across different environments.

The connectors for supporting non-Microsoft data sources are a brilliant feature and a smart move by Microsoft. They allow us to apply our governance policies to data sources such as Twitter and WhatsApp, which are used by many organizations for customer interaction. This is important because it allows us to protect our customers' data, even when they are interacting with us on multiple platforms.

My experience of the critical regulations that Purview was built taking into account is predominantly UK regulations. When I first started at my organization,  part of my role was data protection. So being able to benchmark our data against the GDPR and some of the UK's specific regulations was fantastic. But now I work with multinational clients, so we have offices in various locations in different geographies. So having specific legislation for the areas in which they operate is brilliant. More organizations are spread across different continents and countries. So being able to apply different legislation to different parts of their estate depending on where their offices are operating is a fantastic feature.

We are currently updating our data loss prevention policy internally, and we highly recommend that our clients use Microsoft Purview for DLP as well. I demonstrated Purview to a client a few months ago, and they were incredibly impressed with how effective it can be. I think they were particularly surprised by how quickly it can identify sensitive data. For example, we did a quick test where we uploaded a document that contained a piece of personal information that we had asked the Purview policy to look for. As soon as we uploaded the document to a SharePoint document library, we received an email alert warning us that the sensitive information was present and could be accessed by others. The alert was almost instantaneous. This shows that Purview is a very effective system for protecting data.

Microsoft Purview has enabled us to truly embed a culture of data governance among staff. This has been a major success, not just within our own organization, but also with our partners and clients. Many people talk about the importance of data governance, but Purview has helped us to increase the knowledge base of our users and empower them to take ownership of their data, rather than relying solely on IT professionals or data protection staff. This is a real positive for any business, especially those that work with sensitive information. The automation capabilities of Purview have also been a huge hit with our users. The ability to automatically apply data labels and implement advanced encryption policies has made it much easier for us to protect our data.

In previous years, we have used various methods and systems to try to achieve the same outcome, including spreadsheets and stand-alone systems. We are heavy users of Microsoft 365, so it is our primary system, but we also use other systems. Having one solution that can deploy our core policies and protections across different devices and platforms.

Microsoft Purview's reduction of solutions simplified our data governance. In the past, our data was scattered across different locations, making it difficult to manage and protect. Purview has brought our data together into one place, making it easier for users to access and for us to implement data governance policies. I believe that the more systems we have, the greater the risk of data protection incidents and the more difficult it is to deploy a unified data governance strategy. Reducing the complexity of our IT infrastructure goes hand-in-hand with improving data governance.

Some of the features in Purview have illuminated areas of our data site. In particular, when we have worked with organizations with large volumes of data, it has helped us to identify issues. For example, benchmarking our state against GDPR highlighted aspects of our operations that were not compliant. This was more important than the areas that were compliant, as it helped us to focus our attention on where we needed to make improvements. This helps us to provide assurance to our board.

We are about to launch an internal awareness campaign about AI and how we can use it. Microsoft Purview is on the list of AI solutions we will be considering. We are also about to start using Microsoft Copilot, and some of our staff are already using ChatGPT. We are looking at AI solutions within Microsoft 365 and some of our other systems. This is an area that we are very keen to develop, and it is something that our clients are also interested in. We can explore this in more detail in the coming months.

I've been amazed at how quickly the automation responds, especially when we have a large dataset. It takes that pain away from Teams and acts as a monitor for us. It's saved a huge amount of time, and once it can demonstrate internally or to clients how effectively it does what they expect it to do, that will save more time, but people who are responsible for this information need a lot of reassurance.

Purview enables us to demonstrate our compliance in real-time. We provide live reports to auditors and anyone responsible for information security risk management. We can show them our compliance status in real-time, which is excellent.

Our meetings with compliance regulators are positive when they are familiar with Purview. However, if they are not, we must be able to demonstrate to them how effective the solution is and how it can assist the organization in improving its data governance and data security. This has made the meetings much more positive, as the regulators are more assured that we are being more responsive and effective with the information we hold.

Automation plays a significant role in reducing the time to action on insider threats. We have had procedures in place for identifying, mitigating, and responding to specific risks, both internally and accidentally. However, our previous procedures were very manual, which obviously takes time. Now, in some situations, we can respond almost instantly. Automation has significantly improved our response time. Data breaches, for example, used to take a long time to investigate under our old process. From when a user reported a breach to when we could start investigating, it took hours to complete the necessary paperwork and documentation. But by using automation and some of the features in PurView, we've been able to reduce that time to minutes. In some areas, we've probably been able to reduce investigation time by 50 percent or more.

Time-saving is probably the most important benefit of automation and AI. The more time we can save people, across the board, not just Purview, the better. When we can automate tasks and improve response times, it takes away the need for manual input and frees people to concentrate on more important things. This naturally has a financial benefit. From my role, I've seen that the time savings have been really important. In some areas, we've seen time savings of up to 50 percent. So, when deployed properly, the benefits of automation and AI are huge.

Our ability to oversee compliance using Purview has been a game-changer. We have developed our own in-house compliance and risk management software, which I have been involved in. However, using Purview has been even more impactful. In addition to the automation and time savings, the key thing for us is the educational aspect. Purview helps us to raise awareness and make the organization more data-aware, regardless of role. This enables us to identify issues and, more importantly, rectify them.

The sensitivity and retention options in Purview are excellent. We had an internal document retention schedule, but when we first created it, much of our data was in paper form. As our data became digitized and moved to SharePoint Online, particularly when we migrated away from our on-premises file server, the ability to replicate that retention schedule in Purview and deploy it across all of our SharePoint sites and OneDrive made life so much easier. Purview helped us automate and control our data without having to rely on people to manually tag documents with specific retention periods.

Similarly, our sensitivity labels were scattered throughout SharePoint Online. We wanted to push data governance internally, not just from a technical data management perspective, but also from an education perspective. So, we created a data classification system based on sensitivity and deployed it across our 365 apps, including Outlook, OneDrive, Teams, and SharePoint. This not only allowed us to protect more sensitive data and ensure that it was being handled responsibly, but it also allowed us to use features like prompting users to apply a label to a document before interacting with it. This helped us deploy labels more quickly and also got staff thinking about the data they were working with.

In my experience, particularly in organizations that work with a lot of sensitive data, staff can become complacent over time and desensitized to the importance of looking after that data if they're using it day in and day out. So, having a visual prompt to apply a label and think about the documents they're working with and what that means was a really useful way of promoting data governance across our business.

Some of the menu headings may not be easy to understand for some people. For example, when I first used Purview, I noticed that one of the self-compliance centers had changed its name. Microsoft has done a huge amount of updates, and sometimes it's hard to keep track of what Purview can do. We almost constantly have to explore it.

Maybe Microsoft could have a 365 roadmap where we can look at upcoming features, or some kind of bulletin announcement for Purview users that explains new features and what they can do in simple terms.

We could also look at the menu settings. In my experience of using Purview, we've never used it as an exclusive system for IT professionals or technical staff. We were very keen that other specialists around the business made use of some of these features because we thought that some of what Purview could do was relevant to other departments as well as IT. For example, we have HR managers and financial staff who use it.

I think that some of the terminology in Purview is pitched toward IT and tech professionals, and it may not be immediately understood by other specialists. This is something that could be improved.

I have been using Microsoft Purview for three years.

I haven't seen any issues so far with stability. I know that some policies can take a little bit of time to roll out, depending on how widely they're being deployed. For example, the first sensitivity policy I created took 24-48 hours to start functioning for users. However, this is to be expected in the cloud, as it can take time for changes to filter down. Once the policy became available, I didn't see any issues with it at all.

Microsoft Purview is scalable. When I first deployed it, we deliberately scaled it up by deploying a small number of cache users first, then an individual team, and eventually ramping it up across all of our SharePoint environments, we were able to deploy it widely across Teams, OneDrive, and Outlook as well.

All the interactions I've had with the technical support, they've been really good. So I've got no complaints at all.

Positive

Previously we had processes in place for things like data protection, naming conventions, and so on, but we were very reliant on our IT infrastructure for governance. Purview has allowed us to act more effectively and quickly, and to get more people involved at an administrator level. This has been empowering for some teams, particularly HR, which can now run policies appropriate for them without having to rely on IT. This has been a very positive change for those teams.

Purview was straightforward to deploy, but complex to bring staff up to speed. Like any organization, we have people with varying levels of understanding of these systems and what they are trying to achieve. So, while it was easy for our team members to create and deploy Purview, the education piece took time. For example, we deployed sensitivity and retention labels on a team-by-team basis, training each team and bringing them up to speed before moving on. We found this to be the easiest way to deliver the training internally. Overall, I think Purview is very straightforward from a technical point of view, but the difficulty of bringing staff up to speed will vary depending on the organization.

A core group of eight of us evaluated the various aspects of what Purview could do. We took ownership of the areas that applied to our roles or departments to deploy sensitivity and retention policies. It took us four months. We only took a few days to create the policies and set up the labels. However, we wanted to manage the rollout carefully because training was key to ensuring that staff would get the most out of the system. So, we didn't rush the rollout. However, the actual technical side, the creation itself, only took a few days, or a couple of meetings.

We recommend Purview to clients and don't know if they see an ROI. However, in my previous role at a previous organization, we used Purview internally. I cannot speak to exact figures, but I do know that our creditors regularly reviewed our viability, and data governance, data assurance, and data protection. Being able to demonstrate that we have these tools available to make us more secure as an organization and to protect the sensitive information we hold obviously had an effect on our reputation and viability in the eyes of our creditors and auditors. As a business, I would say that we felt Purview was worth the investment in that particular situation.

To get the full features of Purview, we currently need E5 enterprise licenses, which are expensive. I'm not sure what Microsoft's business model is for this, because we can acquire some of the features of Purview, or we can access it by speaking to our Microsoft partners or vendors. But I think Microsoft is currently pitching Purview primarily to medium to large organizations. I believe there is a real appetite for data governance in smaller businesses as well because all businesses have information that needs to be protected and governed effectively. I have clients who own small businesses who cannot justify the cost of E5 enterprise licenses. Some of them are on business standard or business premium licenses. I think Microsoft should consider reducing the price of Purview or making it more available to more people. Perhaps Microsoft could offer a scaled-down version of Purview. I know there is an appetite for Purview among smaller businesses, but they often have to do a cost-benefit analysis and decide that the additional cost is not justified. It's a shame because they would really benefit from some of the features of Purview.

I would rate Microsoft Purview nine out of ten. Purview is a highly effective and useful feature in Microsoft 365. As a technical system, it is brilliant. However, I am concerned that it may be too expensive for smaller businesses, which is a shame.

The first time I used and rolled out Purview, it was for multiple departments in a medium-sized business. By the end of the rollout, everyone was using it. Internally, we have deployed Purview to two of our geographical locations, but we still have some others to roll it out to. With my clients, the ones who have shown an interest in Purview and are using it tend to be larger businesses that work across geographies. They are deploying Purview to their various office locations in different countries. The speed of deployment depends on the size of the company. We have 150 users.

Purview needs to be reviewed periodically to ensure that the policies are still appropriate and effective. We have tried to automate as much of this process as possible, so from a maintenance point of view, Purview does not require much manual effort. However, we do have a core group of people who regularly review Purview to stay ahead of new features and to determine whether they are appropriate for our organization.

We are currently reviewing some of the new features and redoing many of our policies. In some cases, we are considering switching from manual hard copy or written policies to policies in Purview, either to work alongside their document or to replace it. We will be gearing up for this transition soon.

I would test Purview, explore its features, and seek advice from people who have used it or from Microsoft themselves. This would help me to understand what it can do. I think it is important to avoid keeping Purview as an IT-only tool. Instead, promote its capabilities to a wider audience, including other stakeholders. Once creating and deploying solutions in Purview, I recommend deploying them to a targeted area first and then scaling them up. If a retention policy is suddenly deployed across the entire estate, people may not understand what they are looking at and may resist using it. My advice is to learn about Purview, share the learned knowledge with others, and involve other areas of the business in its deployment. Also, think carefully about how to deploy Purview in a way that minimizes disruption.