Microsoft Purview Information Protection: The Enterprise Guide to Sensitivity Labels, Data Classification, and DLP

What Is Microsoft Purview Information Protection?

Microsoft Purview Information Protection is the unified data protection platform within the Microsoft 365 ecosystem. It replaces what was previously known as Azure Information Protection (AIP), Microsoft Information Protection (MIP), and Office 365 DLP — consolidating them into a single compliance framework managed through the Microsoft Purview compliance portal.

The platform operates on a three-step model: Know your data (discover and classify sensitive information), Protect your data (apply sensitivity labels with encryption and access controls), and Prevent data loss (enforce DLP policies across email, Teams, SharePoint, endpoints, and third-party apps).

At EPC Group, our Microsoft 365 consulting practice has deployed Purview Information Protection for over 500 enterprise organizations, including healthcare systems managing HIPAA-regulated PHI, financial institutions with SOC 2 requirements, and government agencies operating under FedRAMP. The technology is critical to any serious data governance strategy.

Core Components

Designing Your Sensitivity Label Taxonomy

The sensitivity label taxonomy is the foundation of your entire information protection strategy. A poorly designed taxonomy leads to user confusion, inconsistent classification, and gaps in protection. Based on hundreds of enterprise deployments, EPC Group recommends a four-tier taxonomy with sub-labels for regulatory categories.

Recommended Enterprise Label Taxonomy

Public
├── No protection applied
├── Watermark: "Public" in header
└── Use: Marketing materials, press releases, public-facing docs

General (Internal)
├── No encryption
├── Footer: "Internal Use Only"
└── Use: Day-to-day business documents, internal memos

Confidential
├── Confidential - All Employees
│   ├── Encrypt: All authenticated users in tenant
│   ├── Restrict: No external sharing
│   └── Use: HR policies, financial reports, strategy docs
├── Confidential - Project [Name]
│   ├── Encrypt: Specific group/team only
│   ├── Restrict: No copy, no print, no forward
│   └── Use: M&A documents, board materials
└── Confidential - HIPAA / PCI / GDPR
    ├── Encrypt: Designated compliance group
    ├── Restrict: No external sharing, watermark, audit trail
    └── Use: PHI, payment card data, EU personal data

Highly Confidential
├── Highly Confidential - Executive
│   ├── Encrypt: C-suite distribution list only
│   ├── Restrict: No copy, no print, no forward, no extract
│   └── Use: Board presentations, acquisition targets
└── Highly Confidential - Regulated
    ├── Encrypt: Compliance team + legal only
    ├── Restrict: All restrictions, offline access 7 days max
    └── Use: Legal holds, active litigation, audit findings

Label Priority and Downgrade Policies

Labels must have a defined priority order (highest number = highest sensitivity). Configure downgrade justification to require users to provide a reason when lowering a document's classification. For regulated industries, EPC Group recommends blocking downgrades entirely for HIPAA and Highly Confidential labels — only compliance officers should be able to reduce classification.

• Priority 0: Public — no restrictions on downgrade
• Priority 1: General — justification required for downgrade
• Priority 2: Confidential — justification required, logged to audit
• Priority 3: Highly Confidential — downgrade blocked (admin override only)

Container Labels for SharePoint and Teams

Sensitivity labels extend beyond files to SharePoint sites, Teams, and Microsoft 365 Groups. Container labels control the privacy setting (public/private), external sharing policy, unmanaged device access, and Conditional Access requirements for the entire site or team. This is essential for organizations using SharePoint as their primary collaboration platform.

• General Sites: Private, allow external sharing with authenticated guests, full access from unmanaged devices
• Confidential Sites: Private, block external sharing, limited access from unmanaged devices (web-only, no download)
• Highly Confidential Sites: Private, block external sharing, block unmanaged devices entirely, require compliant device via Conditional Access

Auto-Labeling Policies and Trainable Classifiers

Manual labeling relies on user judgment, which is inconsistent at best. Enterprise organizations need automated classification that applies labels based on content inspection. Purview offers two auto-labeling approaches: client-side (real-time as users create documents) and service-side (bulk scanning of existing content in SharePoint and OneDrive).

Sensitive Information Types (SITs)

Microsoft provides 300+ built-in sensitive information types that detect patterns like Social Security numbers, credit card numbers, passport numbers, and medical terms. Each SIT uses a combination of regular expressions, keyword dictionaries, checksums, and proximity rules to reduce false positives.

Trainable Classifiers

Trainable classifiers use machine learning to identify document types based on content, not just patterns. Microsoft provides pre-trained classifiers for common categories (resumes, source code, financial statements, legal agreements) and allows organizations to train custom classifiers on their own document corpus.

• Pre-trained classifiers: Contracts, invoices, resumes, source code, financial statements, threats/harassment, profanity — ready to use immediately
• Custom classifiers: Provide 50-500 positive samples of your document type, Purview trains a classifier. Common use cases include proprietary report formats, engineering specifications, and clinical trial documents
• Accuracy tuning: Review classifier predictions, mark false positives/negatives, retrain. Target 95%+ precision before deploying in enforcement mode

Auto-Labeling Configuration Strategy

Deploy auto-labeling in three phases: simulation, recommendation, enforcement. The simulation phase runs policies against your existing content without applying labels — use this to validate accuracy and estimate the volume of affected files. Recommendation mode suggests labels to users (yellow bar in Office apps) without forcing application. Enforcement mode applies labels automatically with no user interaction.

Data Loss Prevention (DLP) Policies

DLP policies are the enforcement layer of information protection. While sensitivity labels classify and protect data at the file level, DLP policies monitor data in motion — preventing sensitive information from leaving the organization through email, Teams chat, SharePoint sharing, or cloud app uploads.

DLP Policy Architecture

Design DLP policies around three dimensions: what sensitive data to protect (SITs, labels, classifiers), where to monitor (Exchange, Teams, SharePoint, OneDrive, endpoints, Defender for Cloud Apps), and what action to take (notify, block, override with justification, encrypt).

Enterprise DLP Policy Examples

• HIPAA PHI Protection: Detect content containing 2+ HIPAA-related SITs (patient names + MRN, diagnosis codes + SSN). Block external sharing via email and Teams. Allow override for care coordination with logged justification. Apply to Exchange Online, Teams chat, SharePoint/OneDrive.
• Financial Data Protection: Detect content with credit card numbers, bank account numbers, or financial statement classifiers. Block sharing with external domains except approved partners. Require encryption for any external email containing financial SITs.
• Source Code Protection: Detect source code using the pre-trained classifier. Block uploads to consumer cloud storage (personal OneDrive, Dropbox, Google Drive). Allow sharing within approved development repositories and partner portals.
• Executive Communications: Detect content labeled "Highly Confidential - Executive." Block all external sharing without exception. Block copy to USB drives via endpoint DLP. Alert compliance team on any match.

Endpoint DLP and Device Protection

Endpoint DLP extends data loss prevention to the device level — monitoring and controlling sensitive data on Windows 10/11 and macOS devices. This is critical for organizations with remote workforces where data moves beyond the Microsoft 365 boundary. Endpoint DLP monitors file activities including copying to USB drives, printing, uploading to cloud services via browser, copying to clipboard, and accessing by unallowed applications.

• USB and removable media: Block or audit-only when users copy files containing sensitive data to USB drives. Configure allowed USB device groups by hardware ID for approved encrypted drives.
• Printing: Block printing of documents with "Highly Confidential" labels. Allow printing to approved network printers for "Confidential" documents with audit logging.
• Browser upload: Block upload of labeled documents to non-approved cloud services. Integrate with Microsoft Defender for Cloud Apps for shadow IT detection.
• Application access: Define unallowed apps (personal email clients, consumer cloud sync tools). Block these apps from opening files with "Confidential" or higher labels.

Compliance Mapping: HIPAA, SOC 2, GDPR, FedRAMP

One of the most valuable aspects of Purview Information Protection is its direct mapping to regulatory compliance requirements. EPC Group maps every sensitivity label and DLP policy to specific compliance controls, creating an auditable evidence trail. This is central to our data governance consulting practice.

Phased Deployment Strategy

Enterprise Purview Information Protection deployments should follow a phased approach that builds organizational readiness while progressively expanding coverage. Rushing deployment leads to misconfigured policies, user resistance, and compliance gaps. Our approach at EPC Group, refined across 500+ deployments, follows four phases.

Licensing and Cost Analysis

Understanding Purview licensing is critical for budget planning. Microsoft bundles information protection features across multiple SKUs, and choosing the wrong license tier means either paying for unused capabilities or lacking essential features. Here is the breakdown relevant to information protection.

For most enterprise organizations, EPC Group recommends Microsoft 365 E5 for users who create and classify sensitive content (typically 30-50% of the workforce) and E3 for general users who only consume protected content. This tiered approach reduces licensing costs by 25-40% compared to full E5 deployment.

Common Deployment Mistakes to Avoid

After 500+ deployments, EPC Group has identified the recurring mistakes that derail Purview Information Protection projects. Avoiding these issues accelerates time to value and ensures lasting adoption.

• Too many labels: Organizations with 15+ sensitivity labels see adoption rates drop below 30%. Keep the top level to 4-5 labels. Use sub-labels for granularity. Users should be able to choose the right label in under 5 seconds.
• Skipping the simulation phase: Deploying auto-labeling or DLP in enforcement mode without simulation generates hundreds of false positives, overwhelms the SOC team, and causes users to request exemptions. Always simulate first, validate accuracy, then enforce.
• No executive sponsorship: Information protection changes how every employee works with data. Without visible C-suite sponsorship and clear communication about why classification matters, adoption stalls. The CISO or CIO must champion the program.
• Ignoring change management: Technical deployment is 40% of the effort. The remaining 60% is training, communication, help desk preparation, and user support. Budget for at least 3 rounds of training (pilot, general, refresher) and dedicated support resources for the first 90 days.
• Not integrating with existing workflows: If users must leave their workflow to classify data, they won't do it. Leverage default labels, auto-labeling, and Office integration so protection happens within the tools users already use daily.
• Failing to monitor and tune: A deployed policy is not a finished policy. Review DLP alerts weekly, track false positive rates, and adjust SIT confidence levels and keyword dictionaries quarterly. Information protection is an ongoing program, not a project with an end date.

Partner with EPC Group

EPC Group has deployed Microsoft Purview Information Protection for over 500 enterprise organizations across healthcare, financial services, and government. Our Microsoft 365 consulting team combines deep technical expertise with compliance domain knowledge to deliver information protection programs that achieve high adoption rates and pass regulatory audits. We also integrate Purview with broader data governance frameworks and AI governance strategies for organizations deploying Copilot and other AI tools.