Most people think protecting data is about building a strong wall around it, lock down the network, block the bad guys, and you are safe.
Here's the thing, that wall does nothing once your data is inside and moving around.
An employee with legitimate access can take a customer list and email it to their personal account, and the firewall just waves it through because the request came from a trusted user.
Microsoft Perview gets mentioned everywhere these days, but what actually is it? It's not a single tool.
It's a family of solutions all focused on one thing, protecting your data, not just your infrastructure. There are three pillars to understand, data governance, knowing what data you have, data security and protecting it.
The data compliance, proving you follow the rules, by the end of this episode you'll see how these three pieces fit together and where to start, but to understand why Perview exists you have to understand the problem it solves.
The real problem, why infrastructure security isn't enough?
Most companies assume that if the network is locked down, the data is safe. 20 years ago, when everything lived inside a physical office, that was a fair assumption. It just isn't true anymore.
Data lives everywhere now. Cloud apps, personal devices, email attachments, shared drives, team chat messages, scattered across environments you don't fully control.
And once a user has legitimate access, once they're authenticated and inside the building, infrastructure security can't control what they do with that data.
Consider this example, an employee downloads a customer list to a personal USB drive. The firewall didn't stop it and the intrusion detection system didn't catch it because the data wasn't intercepted.
It was accessed by someone who had permission to see it.
The security tools were looking for an attack from the outside, but the threat came from the inside. This is the fundamental shift.
Protection needs to move from the infrastructure layer to the data layer itself. Instead of just guarding the building, you need to guard the files inside it. That's exactly what Perview does. It applies policies directly to the data, not just the system holding it.
Think of it this way. Building security guards the door by checking IDs and making sure only the right people get in. But once they're in, building security doesn't follow them around.
Perview is different. It puts a lock on the filing cabinet itself, meaning even if someone is inside the building, they can't open the cabinet unless they're supposed to.
Perview is about locking the filing cabinet, but before you can lock it, you need to know what's inside.
Pillar 1. Data governance. Know what you have. Knowing what data you actually own is the first step in any data protection strategy.
That sounds obvious, but most organizations have no idea what's sitting in their sharepoint sites, file shares, or databases.
They've got years of accumulated content like old project files, duplicate documents, and spreadsheets with customer information. Nobody remembers creating.
Perview's data map solves this. It scans your entire environment across Azure, multi-cloud, and on-premises, and captures metadata about everything it finds.
It answers questions like what kind of data it is, where it's stored, who owns it, and how sensitive it is. The data map builds a complete picture of your data estate.
From there all that metadata gets organized into the unified catalog.
Think of it like a library with a card catalog. Before the catalog existed, you had to walk through every aisle hoping to find what you needed.
But with the catalog, you search once and know exactly which shelf holds which book. You can organize data into governance domains like finance, HR, and research and development, so business users can find what they need without asking IT.
A financial analyst can browse the finance domain and see all the approved data sets, complete with descriptions and owners, data lineage shows, where data came from, and how it changed over time.
If you're preparing for an audit and someone asks, where did this number come from?
Lineage traces it back through every transformation, and that's critical when regulators want proof that your reports are accurate. The business glossary adds plain English descriptions so analysts can understand what a data set means, without tracking down the person who created it three years ago.
Instead of seeing a table called Custod 223 V2 Final, they see customer orders 2023 Final version. Simple change, huge difference. Why does this matter?
You can't protect data, you don't know, exists. If you don't know, there's a SharePoint site with customer social security numbers, you can't lock it down, and governance is the foundation everything else builds on. Once you know what data you have and where it lives, the next question is obvious. How do you protect the sensitive stuff?
Pillar 2, data security, sensitivity labels.
Governance tells you what data exists and security tells you what to do with it.
The core tool for that is something called sensitivity labels. Think of sensitivity labels as digital tags that classify data based on how sensitive it is. Common ones you'll see are public, internal, confidential, and highly confidential. But you're not stuck with those. You can create custom labels that match your organization's needs. Maybe you want a label called HR data or financial results or client confidential.
You decide, here's the thing about labels, they travel with the data, if a document is marked confidential and someone attaches it to an email, the label stays attached. It doesn't matter if the document is downloaded, copied to one drive or shared through teams, that label follows it everywhere.
It's not a sticker on the filing cabinet, it's a watermark embedded in the paper itself. Labels can trigger automatic actions.
You can encrypt the documents so only authorized people can open it. Access restrictions can block editing or printing and you can add headers, photos, or watermarks that say confidential right across the page.
The label tells the system what to do and the system does it automatically. Labels get applied in three ways. Manual means the user chooses the label themselves.
Automatic means purview detects sensitive content like a credit card number and applies the label on its own. Policy recommendation means the system suggests a label and the user confirms it. That middle option is where things get interesting.
Here's an example, a document contains a credit card number. Purview's classification engine recognizes that pattern and before the document is even saved, auto applies the highly confidential label and encrypts it with no human intervention needed.
The data is protected from the moment it's created, but labels don't just apply to individual files. They also apply to containers like SharePoint sites, Teams channels, and Microsoft 365 groups.
That means you can say any team site labeled confidential blocks external sharing by default. You set the rule once and every site with that label inherits the protection.
You don't have to configure each one individually, so labels tell you what something is. They classify it, market, and apply protection automatically.
But what if someone tries to send that label data somewhere they shouldn't? Data loss prevention blocking the leaks labels classify DLP data loss prevention takes action. This is where the system stops being passive and starts blocking things in real time.
DLP policies scan email documents chat messages and cloud apps for sensitive information. When it finds something risky, it can block the action entirely.
Show a policy tip that warns the user, notifying administrator or just log the event for later review. You decide which response fits the situation. Let me give you a real example.
An employee tries to email a spreadsheet with social security numbers to their personal Gmail account. DLP detects the sensitive data, recognizes the external recipient and blocks the message before it leaves your organization.
The user gets a warning that says this message contains sensitive information and was not delivered.
The action is blocked and it becomes a learning moment. No leak, no breach. DLP works across exchange, SharePoint, OneDrive, Teams, and even Windows endpoints. It doesn't matter where the data is or how someone tries to move it. If it contains sensitive information, the policy catches it.
One thing worth knowing, you can run DLP policies in simulation mode first. That means you test what would be blocked without actually blocking anything.
You get a report showing how many items would have been caught, what types of data triggered the policy and which users were involved. Then you adjust before turning enforcement on. It's a safe way to learn, without disrupting anyone's work. Best practice is to start small.
Pick one type of sensitive data, credit card numbers, for example, and apply DLP to a small group of users. See what happens.
Educate users with policy tips that explain why something was blocked. Then gradually expand enforcement as people get used to it. Those policy tips are powerful, by the way. Instead of just saying blocked, they tell the user, "This document contains sensitive data. Are you sure you want to send it? It gives them a chance to reconsider without feeling like the system is punishing them."
Most people don't mean to leak data. They're just moving fast. So now we know our data. We're protecting it with labels and blocking leaks with DLP. But what happens when an auditor shows up asking for proof?
Data compliance. Proof you follow the rules. Compliance is about proving your secure, not just being secure. You can have the best protections in the world. But if a regulator shows up and asks for evidence, you need more than good intentions. You need documentation, audit, trails, and a defensible process. That's where Perview's Compliance Manager comes in. It gives you a score based on how well you meet regulatory requirements.
Imagine a credit score, but for compliance, the higher your score, the better your posture, and it changes as you take actions that improve it. Compliance Manager comes with built-in assessments for the major regulations you've probably heard of. GDPR for data privacy in Europe, HIPAA for healthcare information in the United States, ISO 27001 for information security management, FINRA for financial services, FedRAMP for government cloud services. And many more. Over 320 templates in total. If there's a regulation that applies to your industry, there's probably an assessment for it.
Each assessment breaks down the regulation into controls. Every control is further broken down into improvement actions with step-by-step guidance. It tells you exactly what you need to do.
Enable audit logging, configure sensitivity labels, set up retention policies. You're not guessing what compliance looks like. The system tells you you assign these improvement actions to people in your organization. The IT admin gets the technical tasks.
The compliance officer gets the policy documentation. The legal team gets the data subject request workflows. Everyone knows what they're responsible for, and you can track progress in real time. No more spreadsheets passed around by email. When someone completes an action, they upload evidence directly into compliance manager.
That evidence can be screenshots showing a policy is configured correctly. It can be policy documents you've written. It can be audit logs pulled from the system. Everything lives in one place, organized by control, ready for the next audit.
Here's the smart part. Compliance manager automatically scans your Microsoft 365 environment for some controls. If you've configured sensitivity labels, it detects that and gives you credit automatically. If you've enabled audit logging, it sees that too.
You don't have to manually prove every single thing. The system checks itself. Audit logs in purview record every activity across your environment. Who accessed what document? When did they access it? From where? What did they do with it? Every action is logged in searchable.
When an auditor asks, who saw this file and when? You have the answer in seconds, not days. He discovers he gives legal teams the ability to search across all your data. Email documents.
Teams messages, sharepoint sites, and place holds on content relevant to investigations or lawsuits. If there's a legal dispute, you can preserve every piece of related data and produce it as evidence. No scrambling to find files, no worrying that someone deleted something important.
Records management ensures that critical documents are retained for required periods and cannot be deleted early. If regulations say you must keep financial records for seven years, records management enforces that. Users can't delete them. Admins can't bypass the policy. The data stays until the retention period expires and then it's disposed of in a controlled way. Why does all this matter? Regulators don't care what tools you have. They don't care that you bought purview. They care that you can show a defensible process.
You want to see that you identified risks, implemented controls, monitored compliance, and have evidence for every step. Compliance manager gives you that evidence in a format auditor's recognize. But here's something new that changes the picture.
AI. AI governance. What changes when co-pilot shows up? Here's the simplest definition. Traditional data protection assumed humans access data. That assumption made sense for decades. A person logs in, searches for a file, opens it, reads it.
The system knows who did what and can track every action. AI changes that calculation entirely. Co-pilot and other AI agents can access massive data estates in seconds. They don't read one file at a time. They scan across thousands of documents, summarize content, and surface information the user might not even know exists. That speed and scale creates a whole new category of risk. Imagine your data is like a filing cabinet.
In the old world, each drawer needed a key. Only the right person could access the right file. Co-pilot is like a smart assistant that can open every drawer at once. If the keys are left in the locks. If your data isn't properly classified, co-pilot might surface sensitive information to someone who shouldn't see it.
Not because the system is broken. Because the data was never labeled, a sharepoint side with customer PII that was set to anyone in the company can access suddenly becomes visible through AI in ways it never was before. The wall was always there. AI just found the door.
So what does Pervue do about it? Pervue extends its existing controls to cover AI interactions. DLP policies now scan AI prompts and responses, not just emails and documents. If someone asks co-pilot a question that returns sensitive data, DLP can block it. Sensitivity labels are enforced on AI generated content. If co-pilot creates a summary of a confidential document, that summary inherits the same label and protection.
Data security posture management for AI monitors, oversharing and misuse in real time. It watches how AI tools are being used, what data they're accessing and whether any policies are being violated.
If someone starts asking co-pilot questions that suggest they are probing for data they shouldn't have, the system flags it. Compliance manager now includes pre-built assessments for AI regulations like the EU AI Act.
If your organization uses AI tools you need to demonstrate compliance with these new rules. The assessment templates are already there, ready to use, the AI hub gives you visibility into which AI apps are being used in your organization and what data they access.
You can see which employees are using co-pilot, which third party AI tools are connected and what kind of data is flowing through them, no blind spots.
Pervue can also retain AI prompts and responses for audit trails.
If a regulator asks what did that employee ask the AI and what did it tell them? You have the record. Prompts, responses, timestamps, user identity, everything preserved for investigation or compliance review.
Think of it this way, the same three pillars we've talked about, governance, security and compliance, still apply to AI.
But the stakes are hired, if your data wasn't locked down before AI will expose every crack. Pervue gives you the tools to fix those cracks before they become breaches. Those three pillars aren't separate projects, they work together in a loop.
How the three pillars connect? So how does it all fit together? Governance finds the data, security protects it, compliance proves you followed the rules, three separate jobs, one connected system.
But here's the thing many people miss, they don't just work in sequence, they reinforce each other. A compliance audit reveals a gap in your data classification.
Maybe you missed a sharepoint site with unlabeled customer data. That gap feeds back into governance, which updates the data maps can.
Governance finds the new data, security applies protection, compliance checks it off, the loop keeps turning, let me walk you through a real scenario. The data maps scans your environment.
It finds a sharepoint site with customer PI that was never labelled. Nobody knew it was there. Pervue's classification engine detects the sensitive content and auto applies a highly confidential label with encryption.
That label triggers a DLP policy you already configured. Any email forwarding that label to an external address gets blocked automatically. Compliance manages sees that the control is implemented and gives you score credit.
The audit log records the entire process, who found the data when the label was applied, what policy blocked the action. When the next audit comes around you have the full story ready to present.
That's the power of Pervue as a unified platform. It's not three separate tools that happen to share a portal. It's one engine where each part feeds the others. The integration is automatic. Once your governance is in place, once you've scanned your environment and classified your data, security and compliance benefit without extra configuration.
You don't have to rebuild your labels for compliance manager. You don't have to re-scan for DLP. It all shares the same foundation.
Most organizations fail at data protection because they treat these as disconnected initiatives. They have a governance team that doesn't talk to security. A compliance officer who works from a different spreadsheet.
An IT team that implements policies without understanding what the business needs. Pervue forces those conversations to happen by making the dependencies visible. You can't do compliance well without governance.
You can't do security well without knowing what data you're protecting.
So where do you start? Not by turning everything on at once. Start with governance. Find your data, classify it. The rest will follow. That's the knowledge nugget for today. Your first steps.
So let's get started. Open Pervue's data explorer and see what sensitive information already exists in your environment.
You might be surprised at what you find. Credit card numbers sitting in email attachments, social security numbers in old SharePoint sites, medical information in Teams chats you forgot existed.
Don't try to fix everything on day one. Just look, focus on the biggest risks first, financial data, medical records, personal information. Those are the ones that get you in trouble with regulators.
Put your energy there before worrying about that internal memo about the office holiday party.
Next, apply sensitivity labels to that critical content, but don't roll it out to everyone yet. Start with a small group of users. Let them test it, get comfortable with it, and give you feedback.
You'll catch configuration mistakes before they affect the whole company, then set up a DLP policy and test mode. Run it in simulation so you can see what would be blocked without actually blocking anything.
Review the reports, adjust your rules, then turn enforcement on gradually. Use compliance manager as your roadmap. It shows you exactly what needs to happen to meet the regulations your industry follows.
You don't have to figure this out on your own. The assessments tell you what to do in what order and how to prove you did it.
Here's the single most powerful thing you can do right now. Run the data classification scan. Just run it. Knowing what you have changes everything, everything else flows from that one step.
Microsoft purvew isn't one product. It's a system for making sure your data is found, protected, and defensible. Start with governance.
Layer on security. Use compliance to stay honest. The framework works for traditional data and AI alike. Yes, AI too. Because it's built for the world most of us are already living in.
If you gave you the big picture, subscribe to Microsoft Knowledge Nuggets on M365 FM. Drop a comment with what you want to explain next. Thanks for listening.