Microsoft Purview · Information Protection
Find your sensitive data. Label it. Let the protection travel with it.
Information Protection lets an organization decide which information is sensitive, stamp it with a sensitivity label (manually or automatically), and attach protection to that label: encryption, access rules, watermarks. The label lives inside the file or email, so the protection follows it to a laptop, a USB stick, a partner's inbox or an AI assistant.
Think of a label as the "CONFIDENTIAL" stamp on a paper folder, except this stamp also locks the folder and only opens for the right people.
Discover
Find where sensitive data already lives: credit cards, health records, contracts, source code.
Classify
Teach Purview what "sensitive" means for you, with patterns, your own data, or machine learning.
Label
Apply labels by hand or automatically. Each label carries encryption, markings and access rules.
Monitor
See who labeled, changed or removed what, and report coverage to leadership and auditors.
Step zero
Before you click anything: prerequisites and dependencies
Information Protection works on its own. You do not need to deploy another Purview solution first. A few tenant settings must be in place, and some features depend on other components.
Tenant checklist
- Licenses assignedManual labeling comes with E3 / Business Premium. Automatic labeling and advanced classifiers need E5-level licensing. See Licensing.
- Admin roles grantedInformation Protection Admin (or Compliance Admin) to create labels and policies. Viewing actual file content in the explorers needs extra roles, such as Data Classification Content Viewer. Settings › Roles & scopes
- Encryption service activeAzure Rights Management is the engine behind label encryption. It is on by default in new tenants; confirm it if you use older tenants.
- Labels turned on for SharePoint & OneDriveLets co-authoring, search and eDiscovery work on encrypted Office files. Offered as a Recommendation on first visit. Information Protection › Recommendations
- Audit logging onActivity explorer and reports read from the unified audit log. On by default; verify it.
- Office apps up to dateMicrosoft 365 Apps have labeling built in. No separate client to deploy.
- Devices onboarded (optional)Only needed for device activity in Activity explorer and on-device classification. Settings › Device onboarding
Do I need DSPM first?
No. Data Security Posture Management (DSPM) is helpful but not required. It is a dashboard that shows where your unprotected sensitive data is and recommends policies. Many teams open it to decide which labels to build first.
Information Protection already contains its own discovery tools: Data explorer, Content explorer and On-demand classification. Those show where sensitive data sits using built-in classifiers, before you create a single label.
Simple rule: DSPM tells you where the risk is. Information Protection is how you fix it.
Microsoft Entra ID
What it is: Microsoft's identity service (users, groups, sign-in). Labels are published to Entra users and groups, and encryption checks who the reader is.
Azure Rights Management
What it is: the cloud encryption service built into Purview. When a label says "encrypt", this service issues and checks the keys.
DSPM (Data Security Posture Management)
What it is: a Purview dashboard that scores your data-security posture and points to unprotected sensitive data. Good for choosing priorities.
Purview Data Map / Unified Catalog
What it is: Purview's scanner and inventory for data outside Microsoft 365 (Azure SQL, Azure Storage, Amazon S3). Needed to label those sources and to use Protection policies on them.
Device onboarding
What it is: enrolling Windows/Mac devices into Purview (also used by Endpoint DLP). Needed for device activity and on-device classification.
Data Loss Prevention (DLP)
What it is: rules that block or warn when sensitive data is shared, uploaded or copied. DLP can say "block anything labeled Highly Confidential from leaving". Not required, but the most common next step.
Bottom line for a customer: If you have Microsoft 365 and Entra ID, you can start labeling today. DSPM and DLP make it stronger. Data Map and device onboarding only matter when you extend beyond Microsoft 365 files and email.
The click path
Where do I click first? Then what?
The menu is grouped by feature, not by the order you use it. This is the order that works in real deployments. Each green chip opens that menu item's explanation below.
Portal map · all 21 items
Every item in the left menu, explained
This is the same menu you see in the portal. Click any item to see what it is for, when you use it, and what you will find inside. Use the arrows to walk through them in order.
One picture
The menu as a mind map
The same 21 menu entries grouped by the job they do. Click any leaf to jump to its explanation.
Real-world scenarios
Three problems Information Protection solves
Each scenario walks through the menu in the order you would use it. Chips jump to the menu explanation.
Brief note
Licensing at a glance
Licensing changes often, so confirm details in Microsoft's official service description before quoting a customer.
Microsoft 365 E3 / Business Premium
Create and publish labels, manual labeling in Office apps, encryption, content markings, default and mandatory labeling.
Microsoft 365 E5 / E5 Compliance / E5 Information Protection & Governance
Automatic labeling (client and service side), trainable classifiers, EDM, Content & Activity explorer depth, labels as conditions in other E5 solutions.
Pay-as-you-go (Azure subscription)
Billed per use, for example on-demand classification of data at rest and some features for data outside Microsoft 365. Tracked in the Pay-as-you-go usage report.
Words you will hear
Glossary
- Sensitivity label
- A tag such as "Confidential" stored in a file's metadata or an email header. It can carry encryption, markings and access settings.
- Sublabel
- A child label under a parent, for example Confidential › Finance. Users see the parent as a group.
- Sensitive information type (SIT)
- A pattern detector: credit card number, US SSN, passport number. 300+ are built in.
- Exact data match (EDM)
- Detection based on your real records (customer table, patient list), uploaded as secure hashes.
- Trainable classifier
- A machine-learning model that recognizes a document type (contract, résumé, source code) by its content.
- Auto-labeling
- Purview applies a label for you, either while a user edits (client side) or to stored files and mail (service side).
- Simulation mode
- A dry run of an auto-labeling policy that shows what would be labeled without changing anything.
- Label priority
- Label order. Higher means more sensitive; users must justify moving a file to a lower label.
- Content marking
- Visible header, footer or watermark added by a label.
- Container label
- A label applied to a Team, Microsoft 365 group or SharePoint site that controls privacy and external sharing, not the files inside.