PROTECT YOUR SENSITIVE DATA WITH MICROSOFT PURVIEW

Implement Microsoft Purview Information Protection (formerly Microsoft Information Protection) capabilities to helps discover, classify, and protect sensitive information wherever it lives or travels.

These information protection capabilities give the tools to know the data, protect data, and prevent data loss. Use the following sections to learn more about the available capabilities and how to get started with each one.

Know your data.

To understand your data landscape and identify sensitive data across the hybrid environment, use the following capabilities:

Sensitive Information Type

Microsoft Purview provides three ways of identifying items so that they can be classified:

• manually by users
• automated pattern recognition, like sensitive information types
• machine learning

Sensitive information types (SIT) are pattern-based classifiers. They detect sensitive information like social security, credit card, or bank account numbers to identify sensitive items. Microsoft provides a large number of pre-configured SITs or can be create to suite the desired outcomes.

Sensitive information types are used in

• Microsoft Purview Data Loss Prevention policies
• Sensitivity labels
• Retention labels
• Insider risk management
• Communication compliance
• Auto-labeling policies
• Microsoft Priva

Trainable Classifiers

This categorization method is well suited to content that isn't easily identified by either the manual or automated pattern-matching methods. This method of categorization is more about using a classifier to identify an item based on what the item is, not by elements that are in the item (pattern matching). A classifier learns how to identify a type of content by looking at hundreds of examples of the content you're interested in identifying.

Where you can use classifiers

Classifiers are available to use as a condition for:

• Office auto-labeling with sensitivity labels
• Auto-apply retention label policy based on a condition
• Communication compliance
• Sensitivity labels can use classifiers as conditions, see Apply a sensitivity label to content automatically.
• Data loss prevention

Types of classifiers

• pre-trained classifiers - Microsoft has created and pre-trained multiple classifiers that can start using without training them. These classifiers will appear with the status of Ready to use.
• custom trainable classifiers - If the content identification and categorization need that extend beyond what the pre-trained classifiers cover, it can be created and train the pre determined classifiers.

Data Classification

As a Microsoft 365 administrator or compliance administrator, which can be evaluated and then tag content in the organization to control where it goes, protect it no matter where it is, and ensure that it is preserved and deleted according to the organization's needs. 

This can be done through the application of sensitivity labels, retention labels, and sensitive information type classification. There are various ways to do the discovery, evaluation, and tagging, but the end result may have many documents and emails tagged and classified with one or both of these labels. After applying retention labels and sensitivity labels, an overall view showing how the labels are being used across the tenant and what is being done with those items. The data classification page provides visibility into that body of content, specifically:

• the number of items that have been classified as a sensitive information type and what those classifications are.
• the top applied sensitivity labels in both Microsoft 365 and Azure Information Protection.
• the top-applied retention labels.
• a summary of activities that users are taking on your sensitive content.
• the locations of your sensitive and retained data.

The following features can be managed on the data classification page:

• trainable classifiers.
• sensitive information types.
• Learn about exact data match-based sensitive information types.
• content explorer.
• activity explorer.

Protect your data

Sensitivity Labels

Sensitivity labels from Microsoft Purview Information Protection allows for the classification and protection of the organization's data while making sure that user productivity and their ability to collaborate aren’t hindered.

What a sensitivity label is

When assign a sensitivity label is assigned to content, it's like a stamp that's applied and is:

• Customizable. Specific to an organization and business needs, different levels of sensitive content can be created. For example, Personal, Public, General, Confidential, and Highly Confidential.
• Clear text. Because a label is stored in clear text in the metadata for files and emails, third-party apps and services can read it and then apply their protective actions, if required.
• Persistent. Because the label is stored in metadata for files and emails, the label stays with the content, no matter where it's saved or stored. The unique label identification becomes the basis for applying and enforcing policies that you configure.
• Encryption

Encryption is an important part of file protection and information protection strategy. This article provides an overview of encryption for Office 365. Get help with encryption tasks like how to set up encryption for your organization and how to password-protect Office documents.

Prevent Data Loss

To help prevent the accidental oversharing of sensitive information, use the following capabilities:

Data Loss Preventions

Organizations have sensitive information under their control such as financial data, proprietary data, credit card numbers, health records, or social security numbers. To help protect this sensitive data and reduce risk, they need a way to prevent their users from inappropriately sharing it with people who shouldn't have it. This practice is called data loss prevention (DLP).In Microsoft Purview, you implement data loss prevention by defining and applying DLP policies. With a DLP policy, you can identify, monitor, and automatically protect sensitive items across:

• Microsoft 365 services such as Teams, Exchange, SharePoint, and OneDrive
• Office applications such as Word, Excel, and PowerPoint
• Windows 10, Windows 11, and macOS (three latest released versions) endpoints
• non-Microsoft cloud apps
• on-premises file shares and on-premises SharePoint.

DLP detects sensitive items by using deep content analysis, not by just a simple text scan. Content is analyzed for primary data matches to keywords, by the evaluation of regular expressions, by internal function validation, and by secondary data matches that are in proximity to the primary data match. Beyond that DLP also uses machine learning algorithms and other methods to detect content that matches your DLP policies.