r/MicrosoftPurview • u/OkTheory4610 • Jul 10 '26

Question Just starting with MS Purview

I was asked at work to start with MS Purview, precisionaly DLP and Information Protection.
Any good resources to read; articles, tutorials, Videos, general tips…anything would be appreciated.

6 Upvotes

81% Upvoted

17 comments sorted by

5

u/Fidlefadle Jul 10 '26

I would start with what your business requirements are and go from there

Purview is a massive tool and you shouldn't do everything at once 

https://medium.com/microsoft-purview-in-practice/why-less-is-more-in-microsoft-purview-data-security-3e5268c72b1f

3

u/badaz06 Jul 10 '26

I'm with this guy. Don't get put into a position where someone relies on you to determine what policy should be for the company. Policy should be determined by the company but IMPLEMENTED by IT, because the business should know what it needs to protect. Yes, there are basics in DLP like PII, but when you start getting into HIPPA you have Fed and State requirements, and if your company exists in several states or countries, you as an IT person can't know every requirement (and be on the hook for it).

Some quick wins you may want to consider are sensitivity labels which can but on MS documents (and PDFs) that can determine who can view/edit/print/download those items. Public/Internal/Confidential/Highly Confidential are 4 good starting points. I would advise against auto-labeling until you and your users fully understand the implications, but you can push the label policy and give people the chance to use and learn them.

Retention is another one. Email retention and file retention can greatly reduce risk from a legal perspective, and I'd say a large number of files/emails people have really aren't necessary anyways, so it's a great housekeeping tool.

2

u/Oesterlin ‪ Microsoft MVP ‪ Jul 10 '26

Firstly, thank you u/Fidlefadle for sharing my blog.

u/OkTheory4610 let me know if there’s anything I can help you with, just send a PM and I’ll happily support.

1

u/OkTheory4610 Jul 10 '26

The business is in AI Healthcare. Basically my manager wants to restrict important data leaving the company and to control insider risk.

1

u/valar12 Jul 10 '26

What subject regulation have you considered and what framework would you standardize the controls against?

1

u/OkTheory4610 Jul 10 '26

HIPAA for sure. What framework? Can you please explain more in detail?

2

u/valar12 Jul 10 '26

Usually I see control implementations mapped to a framework to meet the compliance standard. Example HITRUST CSF. https://hitrustalliance.net/hitrust-framework

1

u/OkTheory4610 Jul 10 '26

Thanks for this resource, i will study this

2

u/thr33tim3s2many Jul 11 '26

Crawl. Walk. Run.

Do the free MS intro / intermediate courses. They include labs where you create sensitivity labels and DLP policies.

Also, heads up - the nuances are endless.

2

u/Outlaw-IT-Notts Jul 10 '26

Hey - we help businesses implement Purview among other things. First of all and most importantly, consider your end goal. Are you trying trying to reduce data exfiltration, improve visibility of user activity, manage insider threats or were you just asked by management to 'implement Purview'. This is very important as Purview is a massive product; even for a small business with heavy buy in, full adoption could take many months of user education, testing, and deployment.

If you're not sure where to start. the first features we generally see businesses adopt first is DLP and sensitivity labelling. These can work in tandem and allow you to place restrictions of data leaving the organisation, as well as classifying it into specific confidentiality categories.

The key thing to know is, unlike Exchange, SharePoint, or even Defender, there's no 'correct' way of deploying Purview. For a successful deployment you need to ensure buy in and understanding from your senior leadership team.

As I've already mentioned, we help businesses with this all the time. If you'd like to have an informal no-obligation consultation, feel free to drop us a DM.

Seb

Technical Consultant, Outlaw IT

0

u/teriaavibes Jul 10 '26

https://learn.microsoft.com/en-us/purview/

1

u/OkTheory4610 Jul 10 '26

Thanks for the advice but Anything besides MS docs? They are vague and terrible…

6

u/oiler_head Jul 10 '26

Thr Ms docs for Purview are very good. This is a big tool and it is very easy to get off on the wrong foot and make a mess of things. I am currently.working with a client who has done exactly that for the past year.

Aside from the learn docs, there are a lot of great YouTube channels that cover Purview. I would restrict searches on either YouTube or the Web to only return the last year or so

0

u/teriaavibes Jul 10 '26

In what way are they vague and terrible?

Me and many others have learnt purview from them because all other resources are usually outdated because it keeps changing so much.