Do we already have Microsoft Purview?
Partly. Microsoft 365 E3 and Business Premium include sensitivity labels that staff apply, DLP for email, SharePoint and OneDrive, retention policies, a 180-day audit log and standard eDiscovery. Automatic labelling, DLP for Teams and devices, keeping labelled files out of Copilot, records management, insider risk and longer audit history need E5 or a Purview add-on. We check your tenant first and tell you what you can do with what you already pay for.
Is Microsoft Purview free?
There's no separate bill for the parts that come with your Microsoft 365 plan. The advanced parts need E5 or an add-on licence for each user who benefits. A few features, mostly for data and AI apps outside Microsoft 365, are charged by usage through an Azure subscription. Our implementation work is separate from Microsoft's licences.
Do we need Purview before we turn on Copilot?
You don't need all of it, but you need the basics first. Microsoft's own Copilot deployment guidance starts with fixing oversharing, then setting guardrails, then meeting regulatory requirements. In practice that means finding and fixing your most overshared sites, labelling your most sensitive content, checking that audit is on, and rolling Copilot out in groups.
Will Copilot show our staff files they shouldn't see?
It can. Copilot answers using whatever the signed-in person is allowed to open, so a folder shared with everyone years ago becomes something it can find and summarise on request. The fix is to find the oversharing, tighten access on the worst sites, label sensitive material and add DLP rules that keep labelled files out of Copilot's answers. We do this before a rollout, or alongside one.
Can Purview control AI agents, like ones built in Copilot Studio?
Yes, for Microsoft's agent platforms. Copilot Studio and Microsoft Foundry agents can be covered by sensitivity labels, DLP and insider risk policies, and agents managed through Agent 365 are added to policies the way you'd add a person. Purview's posture dashboard lists the agents in use and flags risky activity, such as an agent opening sensitive files or sharing them outside the organisation. Some agent controls need newer Microsoft licences, so we check that first.
Can Purview stop staff pasting sensitive information into ChatGPT?
On managed Windows computers, yes. Endpoint DLP can warn or block when someone pastes sensitive information, such as card numbers or tax file numbers, into a generative AI website. Some browser and network controls are charged by usage. It works best alongside a clear AI use policy, so staff know which tools they're allowed to use.
Will DLP get in the way of people doing their jobs?
Not when it's set up with care. We run every policy in simulation first and read what it would have blocked, so each rule fits how your people actually work before it blocks anything. We pilot with a small group, then widen, and every warning tells staff why it appeared.
How long does a Purview implementation take?
It depends on your size and scope. Discovery and a data map typically take ~2 to 3 weeks. Labels and DLP for a first group typically follow within ~4 to 10 weeks. Records management and insider risk add phases after that, so a rollout across a whole organisation runs over several months. You get a plan with dates after discovery.
Can Purview replace our records management system?
For many organisations it can manage records inside Microsoft 365. Retention labels apply your disposal schedule, items can be locked as records, and destruction goes through a review that keeps proof. Whether it replaces your current records system depends on your record types, your integrations and how much sits outside Microsoft 365. At the council we work with, Purview's records management runs as legacy records systems are retired. We plan that kind of move with your records team, against your disposal authority.
Isn't insider risk monitoring invasive for our staff?
It can be if it's done badly. We design it with your HR and legal teams and scope it to defined groups, such as departing staff. Staff are told the monitoring exists. Purview hides names by default, so analysts look at the pattern before they see the person.
Does Purview make us compliant with the Privacy Act or the Essential Eight?
No tool does that on its own. Purview gives you the controls and the evidence for the parts of privacy and records law that deal with protecting information and keeping or disposing of it. The Essential Eight is a separate set of eight protections for devices and accounts, such as multi-factor authentication and backups, and Purview isn't one of them. We map your obligations to controls and leave legal advice to your lawyers.
What happens after go-live?
We stay on and run it with you. We review alerts with your team, adjust the rules as your work changes, label new sites and agents as they appear, and keep up with Microsoft's changes. Each quarter we re-check the four Data Trust pillars, so you can see progress.