Microsoft Purview: A Practical Guide to Data Security, Governance, and Compliance

Microsoft Purview is Microsoft's unified portfolio for data security, data governance, and regulatory compliance. It replaced two separate brands — Azure Purview and the Microsoft 365 compliance solutions — which Microsoft consolidated under a single name in April 2022. Today it spans more than a dozen solutions delivered through one console: the Microsoft Purview portal.

This guide explains what Microsoft Purview actually does, which solutions are included, how licensing works across Microsoft 365 E3, E5, and the Microsoft Purview Suite, and — just as importantly — where its boundaries lie. That last part matters more than most vendor material admits, because one of Purview's documented design decisions creates a gap that every organization has to close some other way.

What is Microsoft Purview?

Microsoft Purview is a comprehensive set of solutions that helps an organization govern, protect, and manage data wherever it lives — Microsoft 365, Azure, multicloud storage, on-premises systems, and increasingly, generative AI apps and agents.

The platform is built around a simple premise: you cannot protect what you cannot see. Purview first builds a picture of your data estate — scanning sources, classifying content, applying sensitivity labels — and then applies protective and compliance controls on top of that picture.

Three things follow from this design, and they shape everything else in this article:

• Purview is metadata-first. It stores information about your data, not the data itself.
• Purview is strongest inside the Microsoft estate. Coverage of Exchange, SharePoint, OneDrive, Microsoft Teams, and Microsoft 365 Copilot is far deeper than coverage of third-party databases.
• Purview is policy and posture, not a working tool. It tells administrators what exists and what the risk is; it is not where analysts and engineers do their daily work.

The Microsoft Purview portal

The Microsoft Purview portal is the single entry point for every solution in the family. It replaced the older Microsoft Purview compliance portal and the separate Azure Purview governance experience, giving administrators one navigation model across data governance, data security, and compliance.

Access is role-based. Users see only the solutions their assigned roles permit, which is how a compliance officer, a data steward, and a security analyst can share one console without stepping on each other.

Microsoft Purview solutions: what's actually inside

Microsoft groups its solutions into three areas plus a layer of shared capabilities.

Data security

The data security solutions protect information through its lifecycle:

• Microsoft Purview Data Loss Prevention (DLP) — blocks or warns on risky sharing of sensitive content across Microsoft 365 services, endpoints, and browsers.
• Information Protection — sensitivity labels and encryption that travel with a document or email.
• Insider Risk Management — detects risky sequences of user behaviour, such as mass downloads before a resignation.
• Data Security Investigations — investigative tooling for incidents involving sensitive content.
• Information Barriers and Privileged Access Management — segregate communication between groups and gate just-in-time elevated access.

Sitting above these, Data Security Posture Management (DSPM) unifies signals from the other solutions into a single view of where sensitive data resides and which risks need remediation — including risks introduced by AI apps and agents.

Data governance

Two solutions carry the governance workload:

• Microsoft Purview Data Map — scans assets and multicloud sources to capture technical metadata and lineage.
• Unified Catalog — a searchable, SaaS-delivered catalog where stewards curate data products, define governance domains, attach glossary terms and OKRs, and track data quality and health.

The intended operating model is federated: a central data office sets standards, while domain owners and data stewards govern the assets they understand best.

Data compliance

The Purview compliance solutions address audit and regulatory obligations: Audit, Communication Compliance, Compliance Manager, Data Lifecycle Management, eDiscovery, and Records Management. Compliance Manager is the one most teams meet first — it scores your tenant against regulatory frameworks such as GDPR, HIPAA, and ISO 27001 and turns gaps into assigned improvement actions.

Shared capabilities

Several capabilities are reused across solutions: classifiers (including trainable classifiers and exact data match), sensitivity labels, connectors for importing third-party data, and the content and activity explorers that show where classified items live and how people interact with them.

Microsoft Purview and AI

The fastest-moving part of the portfolio is AI protection. Purview extends data security and compliance protections to Microsoft 365 Copilot, to enterprise AI apps you build, and to third-party generative AI apps your staff use. Sensitivity labels are honoured in Copilot responses, prompts and responses are captured for audit and eDiscovery, and DSPM for AI surfaces oversharing risks before they become incidents.

This is the strongest argument for adopting Purview early: Copilot inherits your existing permissions, so unlabelled and over-shared content becomes discoverable at conversational speed. Purview is Microsoft's answer to that problem.

Microsoft Purview licensing and pricing

Licensing is where most evaluations stall, because Purview is sold three different ways at once.

Is Microsoft Purview included with Microsoft 365 E3 and E5?

Partly. Microsoft 365 E3 includes core capabilities: DLP for Exchange Online, SharePoint Online and OneDrive, Information Protection, Audit, eDiscovery, Data Lifecycle Management, and Compliance Manager.

Microsoft 365 E5 includes everything in the Purview Suite — advanced capabilities such as Insider Risk Management, Communication Compliance, Records Management, and automatic sensitivity labelling at scale. E5 is listed at $57.00 per user/month annually with Teams, or $48.45 without.

Microsoft Purview Suite

If you are on E3 and don't want to jump to E5, the Microsoft Purview Suite (formerly the E5 Compliance Suite) is a $12.00 per user/month add-on. It requires Microsoft 365 E3, or Office 365 E3 plus Enterprise Mobility + Security E3.

Pay-as-you-go

Capabilities that reach beyond Microsoft 365 — Purview Data Governance, plus data security and data compliance for broader data estates and AI apps — are consumption-billed and require an Azure subscription. Data Map scanning and Unified Catalog usage fall into this model, so cost scales with the size of your estate rather than headcount.

Getting started with Microsoft Purview

A workable sequence for a first deployment:

1. Assign the Data Governance Administrator role, then delegate the remaining roles to stewards and owners.
2. Use Data Map to scan each data source and capture metadata.
3. Build governance domains in Unified Catalog and curate data products.
4. Connect assets to business context — glossary terms, OKRs, ownership.
5. Roll out sensitivity labels and DLP policies in simulation mode before enforcing them.
6. Use Compliance Manager to track improvement actions against the frameworks you're held to.

Start narrow. Organizations that scan the entire estate on day one usually end up with metadata nobody trusts and thousands of unreviewed classification hits.

The limits of Microsoft Purview

Purview is deliberately scoped, and Microsoft's own documentation is unusually direct about it. Two statements from the data governance documentation deserve to be read carefully:

All data in Data Map and Unified Catalog is metadata, not the underlying data itself. None of the permissions or roles in Data Map or Unified Catalog provide access to the underlying data itself.

In other words: Purview will tell you that a customer table in Oracle contains payment card numbers, who owns it, and how it flows downstream. It will not decide who may run a SELECT against it, mask the columns at query time, or record the statement that was executed.

Four practical consequences follow:

• Classification does not equal enforcement. A sensitivity label on a database asset is a signal, not a control on the database itself.
• Non-Microsoft data sources get shallower treatment. Coverage of Oracle, PostgreSQL, Snowflake, Redshift, Teradata, or MongoDB is metadata-level. Purview is optimised for the Microsoft estate, and extending it cleanly across multicloud or third-party tooling takes real effort.
• It isn't a working environment. The portal is built around admin dashboards and catalogs. You cannot run a SQL script, alter a table, or schedule a job there — and consumption-billed capabilities get expensive quickly once you scan a large estate.
• Operational access remains unsolved. Analysts, developers, and DBAs still connect with desktop SQL clients and shared credentials — the exact pattern Purview's dashboards make visible but cannot fix.

This is not a flaw. It is a scope boundary, and it defines what you need next.

Closing the access gap: Purview plus a secure data access layer

Purview answers what data do we have and how risky is it? A secure database access platform answers who may touch it, what may they see, and what did they do? The two questions are complementary, and neither product category answers both.

DBHawk is built for the second question. It sits between users and databases as a browser-based, Zero Trust access layer — no desktop clients, no distributed credentials, no direct network path to production.

How the two fit together in practice

These are complementary layers, and they can be wired together. DBHawk exposes APIs that let you pull Purview's classification output and turn it into enforceable access policy, so the two systems stay aligned rather than drifting apart. The working pattern:

1. Purview classifies. Data Map scans your Azure SQL, SQL Server, Oracle, PostgreSQL, Snowflake, and Redshift sources and flags columns holding PII, PHI, or payment data.
2. DBHawk retrieves those classifications via API. The sensitive-column inventory Purview produced becomes the input to masking and object-access rules, instead of a spreadsheet someone maintains by hand.
3. DBHawk enforces at query time. A DBA sees the full value; a business analyst sees a redacted one — same query, same table, different result set by role. Nobody ever sees the underlying database credentials, because users authenticate to DBHawk by SSO and DBHawk holds the connection.
4. Elevated access is time-bound. Where someone genuinely needs production, just-in-time access grants it for a defined window rather than permanently.
5. DBHawk audits. Every connection, statement, export, failed login, and administrative action is logged, and can be streamed to Splunk or Datadog alongside Purview Audit records.
6. The loop stays closed. When Purview classifies new columns, the API sync feeds them into policy. Treat it as a recurring control, not a one-time mapping.

Both platforms authenticate against Microsoft Entra ID, so identity stays centralized — one SSO provider governing both the catalog and the connection. DBHawk is also available through the Microsoft commercial marketplace, which usually simplifies procurement for organizations already committed to Azure.

Where this pattern earns its keep

Financial services teams with customer records spread across Oracle, SQL Server, and Snowflake use Purview for lineage and classification, and DBHawk to keep analysts away from raw account numbers while still letting them run their own queries. Healthcare organizations catalog PHI in Purview and mask patient identifiers at query time. Analytics teams get self-service SQL without anyone handing out production credentials — which is usually the single largest reduction in audit findings a data team can achieve in one quarter.

Best practices for a combined deployment

• Treat Purview as the system of record for classification, and your access layer as the system of enforcement. Don't duplicate either.
• Authenticate everything through Microsoft Entra ID SSO; eliminate standing database credentials.
• Apply least privilege at the object and column level, not the schema level.
• Turn on masking for every column Purview classifies as sensitive, by default, and grant exceptions explicitly.
• Audit every database session, and retain logs long enough to satisfy your longest regulatory window.
• Sync classifications into policy over the API rather than by hand — manual reconciliation drifts within a quarter.
• Use just-in-time grants for production rather than standing elevated roles.

Frequently asked questions

What was Microsoft Purview called before?

Azure Purview and the Microsoft 365 compliance solutions. Microsoft merged both brands into Microsoft Purview in April 2022, and later consolidated their portals into the single Microsoft Purview portal.

Is Microsoft Purview worth it?

For organizations already on Microsoft 365 E5, the capabilities are included and the question is only whether you have the staff to operate them — an unstaffed Purview deployment produces dashboards nobody acts on. For E3 organizations facing a regulatory audit or a Copilot rollout, the $12 per user Purview Suite add-on is usually easier to justify than the jump to E5.

Does Microsoft Purview control access to my databases?

No. Purview catalogs and classifies data; its roles govern access to metadata, not to the underlying data. Database-level access control, masking, and query auditing require a separate layer.

Does Microsoft Purview replace a data access platform?

No — they solve different problems. Purview is governance and posture, used by data stewards, compliance officers, and architects. A platform like DBHawk is operational access, used daily by DBAs, developers, and analysts: authentication, least-privilege permissions, dynamic redaction, SQL tooling, and activity monitoring across hybrid database estates.

Can DBHawk integrate with Microsoft Purview?

Yes. DBHawk provides API support for retrieving Purview's sensitive-data classifications and building access and masking policies from them, so what Purview discovers becomes what DBHawk enforces. Both platforms also authenticate against Microsoft Entra ID, keeping identity centralised across the catalog and the connection.

What does DBHawk not do?

It isn't a governance catalog. There's no enterprise data mapping, no file-system discovery, and no data lineage — DBHawk tracks user query history and activity, not how data transforms across pipelines. Its scope is your structured and semi-structured database estate. That's precisely why the two pair well rather than compete.

Which databases does Purview cover?

Data Map scans a wide range of Azure, multicloud, and on-premises sources for metadata. Depth of data protection varies considerably — richest inside Microsoft 365 and Azure, metadata-level for most third-party engines.

Conclusion

Microsoft Purview solves visibility. It discovers, classifies, and catalogs your data estate, scores your compliance posture, and extends protection into Copilot and other generative AI apps — a genuinely strong foundation, and for Microsoft-centric organizations, the obvious one.

What it does not do, by design, is stand between a user and a database. Metadata roles don't grant or restrict data access, and no amount of classification changes who can run a query against a production table. Pairing Purview's governance foundation with a Zero Trust access layer that enforces least privilege, masks sensitive columns at query time, and audits every statement is what turns a governance programme into an actual control.

Start a free DBHawk trial to see how secure, audited database access works alongside your existing Microsoft Purview deployment.