Microsoft Purview · Data classification & DLP

Your data, classified and protected. Wherever it travels.

Purview puts labels and controls on the data itself, so the protection follows the document, not the folder it happens to sit in. We design it, switch it on properly and train your people to use it.

Book a Discovery Call See how labels work

ISO 27001 certified ourselves DISP member Essential Eight ML2, third-party audited

Microsoft Purview — Where the file went

SharePoint

Emailed out

Home laptop

Still protected

Out of the box, Purview classifies nothing, blocks nothing and alerts no one.

It's easy to turn on and hard to do well. Here's the gap between the default tenant and the one we hand back. We run our own business on this configuration, so the advice comes from using it every day.

Area

Default tenant

After an InterIntra engagement

Classification

DefaultNo labels. Every document looks the same to the system.

After usFour labels, Public to Restricted, aligned to NIST guidance and applied by staff or automatically.

Data loss prevention

DefaultNo policies. Sensitive files leave by email without anyone knowing.

After usPolicies that block sensitive documents leaving the business, with alerts routed to your nominated contact.

Insider risk

DefaultOff. A mass download before a resignation goes unnoticed.

After usBuilt on the data-leaks template and tuned to flag exfiltration patterns before they become an incident.

AI and Copilot

DefaultNo view of what Copilot can reach.

After usDSPM for AI shows how Copilot and other AI tools touch sensitive data, so oversharing is caught first.

Workarounds

DefaultUSB sticks, personal devices and overseas sign-ins all get around the labels.

After usUSB storage blocked, unmanaged devices limited to browser-only, sign-ins restricted to Australia.

Four labels. Each one carries its own rules.

A label is stamped on the file, and the controls go with it: encryption, who can open it, whether it can leave. Move the file anywhere and the rules still apply.

Tier 1

Public

Brochures, published pricing, anything already on the website.

No restrictions
Marked, so nobody has to guess

Tier 2

Internal

Day-to-day working documents. The default for anything new.

Staff can open and edit
Header marking applied

Tier 3

Confidential

Client records, contracts, financials, HR files.

Encrypted
External sharing blocked by DLP
Watermarked on print

Tier 4

Restricted

Board papers, M&A, anything that would make the news.

Named people only
No download on unmanaged devices
Every access logged

Cameron Weymouth, Solutions Architect · information protection, and how it meets DLP

Watch

Information protection, explained in under a minute.

How labels, DLP and AI visibility fit together.

01
Sensitivity labelsThe document carries its own handling rules wherever it goes.
02
Data loss preventionAn alert, not a silent failure, when something tries to leave.
03
Visibility into AISee what Copilot can reach before the licences go out.

Set up end to end, in four parts.

From the labels themselves through to the hardening that stops people working around them.

Classify & protect

Sensitivity labels with encryption and access controls that stay with the document
DLP policies with alerts routed to a named contact

Detect & monitor

Insider Risk Management on the data-leaks template
Data Security Posture Management, including DSPM for AI

Train & adopt

Material written for your environment
A delivered session and hands-on time with your staff, because a label nobody applies protects nothing

Harden so it sticks

Conditional access: MFA, legacy auth blocked, sign-ins limited to Australia
Intune baselines with USB storage blocked
SharePoint, OneDrive and mobile app protection
Defender to Microsoft baselines, audit logging on

Purview complements the Essential Eight rather than replacing it: the Eight hardens your systems, Purview protects the data that moves between them. If your tenant needs work first, our Microsoft 365 management service gets the basics right before the data controls go on top.

A few weeks, scoped up front.

Most SMB engagements run a few weeks from kickoff to handover, training included. We work time-and-materials against an agreed scope, so you pay for the effort, not a padded fixed price.

Step 01
Scope
Where your sensitive data sits today, and what's in and out.
Step 02
Design
A label taxonomy and DLP rules that fit how you share.
Step 03
Harden
Close the workarounds before the labels go live.
Step 04
Train & roll out
A session with your staff, then policies switched to enforce.
Step 05
Handover
Documented, with alerts landing with the right person.

New for Business Premium

You no longer need E5 for any of this.

Microsoft's Purview Suite add-on bolts enterprise Purview onto Microsoft 365 Business Premium, without re-licensing your whole tenant. If you're on Business Premium, it's the practical path to everything on this page. It's the next step up from what Business Premium already gives you.

Read our breakdown of the add-on

What the add-on includes

Insider Risk Management
DSPM for AI
Information Protection
Records & Data Lifecycle
Advanced DLP
eDiscovery Premium
Message Encryption
Audit Premium
Customer Key
Compliance Manager
Communication Compliance

Questions

What people ask before they start.

Something else? Call 1300 080 000 and you'll get a straight answer.

Do we need Microsoft 365 E5 for Purview?

No. Until recently the advanced Purview features were locked behind E5 licensing, which put them out of reach for most SMBs. Microsoft now offers the Purview Suite add-on for Microsoft 365 Business Premium, which brings Insider Risk Management, advanced DLP, DSPM for AI, eDiscovery Premium and the rest of the suite to Business Premium tenants. If you're already on Business Premium, the add-on is the practical path: you get the capability without re-licensing the whole organisation.

What is Microsoft Purview?

Microsoft Purview is Microsoft's data security and governance platform for Microsoft 365. It lets you classify documents and emails with sensitivity labels, enforce Data Loss Prevention policies that stop sensitive content leaving the business, detect risky behaviour by departing staff through Insider Risk Management, and monitor how AI tools like Copilot interact with your data. The protections attach to the data itself, so a Confidential document stays controlled even after it's downloaded, forwarded or copied somewhere else.

What are sensitivity labels and how do they work?

A sensitivity label is a classification stamped on a document or email, such as Public, Internal, Confidential or Restricted. The label carries protections with it: encryption, access restrictions, watermarks and sharing controls that stay attached to the file wherever it goes. If a Restricted document is emailed outside the business or copied to a personal device, the controls still apply because they live in the file, not in the folder it came from. Labels can be applied by users, applied automatically based on content detection, or both.

How long does a Purview implementation take?

It depends on scope: how many label tiers you need, how much existing data needs classifying, and how much of the supporting hardening is already in place. A typical SMB engagement runs a few weeks from kickoff to handover, including the user training session. We deliver the work time-and-materials, so you pay for the actual effort rather than a padded fixed price, and we agree the scope up front so there are no surprises.

Does Purview replace the Essential Eight?

No. Purview complements the Essential Eight rather than replacing it. The Eight hardens your systems; Purview protects the data that moves between them. Most businesses need both, and the hardening work in a Purview engagement overlaps with several Essential Eight controls.