Microsoft Purview: Data Governance and Compliance Tools

Microsoft Purview is Microsoft’s unified data governance platform for discovering, cataloging, classifying, and protecting sensitive data wherever it lives — Azure, on-premises systems, other clouds, or SaaS applications like Microsoft 365. Where Azure Policy governs how Azure resources are configured and resource locks govern whether they can be deleted, Purview governs the data itself: what it is, where it is, who’s allowed to see it, and how long it should stick around. That data-focused scope, and the collection of distinct capabilities under the Purview umbrella, is worth knowing cold for the AZ-900 governance domain — see the full AZ-900 study guide for how this fits into all three exam domains.

The core problem Purview solves

Most organizations don’t keep sensitive data in one tidy place. A hospital network might have patient records split across an on-premises SQL Server, an Azure SQL Database, and a storage bucket in another cloud entirely. Without a unified view, nobody can confidently answer what sensitive data exists, where it lives, and whether it’s protected consistently. Purview exists to answer exactly those questions across a hybrid, multicloud data estate, rather than requiring a separate tool per environment.

The data map and catalog

The Data Map is the foundational layer: it holds metadata about every data source you register and scan, and it captures lineage — a visual trace of how a dataset moved and transformed as it flowed from its original source, through pipelines or ETL processes, into downstream reports or systems. Lineage is built from actual scan and connector metadata, so it reflects what really happened to the data rather than a diagram someone drew and forgot to update.

The Data Catalog sits on top of the map and is what business users actually search and browse to find and understand data assets — what a dataset contains, where it lives, who owns it. It includes a business glossary, a shared vocabulary of standardized terms (like “Donor ID” at a nonprofit) that departments can consistently reference instead of each team inventing its own label.

One detail the exam probes directly: classification isn’t automatic in real time. Purview populates and refreshes what it knows through scans — run manually or on a recurring schedule — against each registered source. Data added after the last scan won’t show up as classified until a new scan runs, whether the source is in Azure, on-premises, or another cloud.

Classifying and protecting content

Sensitivity labels classify content — documents, emails — based on how sensitive it is, using labels like “Confidential” or “Public,” and they can trigger real protective actions such as encryption or watermarking once applied. Labels can be applied manually by a user or automatically when Purview detects a matching sensitive information type.

Data Loss Prevention (DLP) policies scan outbound communications across channels like Exchange, Teams, SharePoint, and OneDrive for sensitive information types — a Social Security number, a credit card number — and can automatically block, warn, or flag content before it reaches an external recipient. This is the mechanism for stopping a specific kind of data from leaving the organization, as opposed to sensitivity labels, which classify and protect content more broadly.

Governance and risk capabilities

Several more Purview capabilities address distinct governance problems, and the exam expects you to match each scenario to the right one rather than treating them interchangeably:

• Compliance Manager assesses an organization’s environment against a regulatory standard — HIPAA, GDPR, ISO 27001 — and produces a compliance score along with specific, recommended improvement actions. It’s the tool for “how are we doing against this regulation, and what should we fix next.”
• Insider Risk Management uses behavioral signals — unusual mass downloads, unusual file access shortly before someone resigns — to flag potentially risky activity by people inside the organization, not external threats.
• Communication Compliance scans internal communications, like email and Teams messages, for content that violates a configured policy, such as sharing proprietary information. It’s closely related to Insider Risk Management but focused on message content rather than behavioral patterns.
• eDiscovery lets a legal or compliance team search across mailboxes and documents for content relevant to litigation or an investigation, then place that content on legal hold so it can’t be altered or deleted while the matter is open.
• Data Lifecycle Management (records management) applies retention labels and policies so content is kept for a defined period and then automatically disposed of — a seven-year retain-then-delete rule on lab notebooks, for instance — without staff manually tracking expiration dates.

Capability	What it’s for
Data Map / Data Catalog	Discover, scan, and catalog data sources; trace lineage
Sensitivity labels	Classify and protect documents/emails (Confidential, Public)
Data Loss Prevention	Block sensitive data from leaving via email, Teams, etc.
Compliance Manager	Score readiness against a named regulation
Insider Risk Management	Detect risky behavior by people inside the org
Communication Compliance	Scan internal messages for policy violations
eDiscovery	Search, hold, and export content for legal matters
Data Lifecycle Management	Automatic retention and disposition on a schedule

Where Purview stops and other governance tools start

It’s easy to blur Purview with Azure’s other governance features, but each one covers different ground. Azure Policy evaluates and enforces the configuration of Azure resources — an allowed region, a required tag — and has no ability to look inside a document or classify data. A resource lock only controls whether a resource can be deleted or modified; it doesn’t scan or catalog anything. And neither one decides who can reach a resource in the first place — that access-control layer belongs to Azure RBAC and Conditional Access, a separate governance mechanism from Purview’s data-focused scanning and classification. Purview’s job starts where those leave off: once a resource exists and holds data, Purview is what tells you what’s inside it, whether it’s protected, and whether the organization is handling it the way regulations require.

How the AZ-900 exam tests this

• A scenario describes needing a single view of sensitive data spread across on-premises, Azure, and another cloud provider. The answer is Purview’s Data Map or Data Catalog — the giveaway phrase is usually “hybrid” or “multicloud” combined with “discover” or “catalog.”
• A scenario describes an employee downloading unusual amounts of data shortly before resigning. That’s Insider Risk Management, distinguished from Communication Compliance (which reviews message content, not behavioral patterns) and from DLP (which blocks specific content leaving, not detects behavior).
• A scenario describes a legal team needing to search mailboxes and preserve content for a dispute. That’s eDiscovery, not Data Lifecycle Management, which handles scheduled retention rather than case-specific search and hold.
• A scenario asks for a scored dashboard against a named regulation like HIPAA or GDPR. That’s Compliance Manager — contrast this with the Azure Policy compliance dashboard, which scores resource configuration, not regulatory posture.
• A scenario wants content retained for a fixed period and then automatically deleted, with no manual tracking. That’s Data Lifecycle Management with retention labels — and a resource lock would actually work against this requirement, since CanNotDelete would block the scheduled deletion.
• A scenario wants credit card numbers or SSNs blocked from outbound email. That’s DLP, not sensitivity labels, which classify content but don’t inspect outbound messages in transit.

Because so many Purview questions hinge on matching a specific scenario keyword — “before resigning,” “legal hold,” “regulatory score,” “retain then delete” — to the one capability built for it, repetition against realistic scenarios pays off more than memorizing a feature list. Practice AZ-900 questions that mix these Purview capabilities together are the fastest way to build that pattern recognition.

For how Purview’s data-focused governance differs from resource-configuration governance, see Azure Policy: Effects, Initiatives, and Compliance Enforcement. For the broader case for why organizations move sensitive workloads to a platform with built-in governance tooling like this, see Security, Compliance, and Governance Benefits of the Cloud.

Quick reference

• Purview provides unified data governance across on-premises, multicloud, and SaaS — not just Azure.
• Data Map holds metadata and lineage; Data Catalog is what business users search, and includes a business glossary.
• Classification depends on scans (manual or scheduled) — it isn’t real-time.
• Sensitivity labels classify and protect content; DLP blocks specific sensitive data from leaving via email/Teams/SharePoint.
• Compliance Manager scores regulatory readiness; Insider Risk Management flags risky behavior; Communication Compliance flags risky message content.
• eDiscovery is for legal search-and-hold; Data Lifecycle Management is for scheduled retention and automatic disposal.
• Purview governs data; Azure Policy governs resource configuration; resource locks govern deletion and modification.