Microsoft Purview Data Catalog & Data Map Enterprise Hub (2026)

Pattern 1 — Regulated-industry sensitive-data discovery

The regulated-discovery pattern stands up Purview Data Map across every regulated source system — Epic Clarity, Cerner Millennium, Workday, ADP, SAP HR, Fabric and Synapse warehouses, Snowflake, on-premises SQL Server, the M365 estate, and the Fabric lakehouses — runs the classifier library against the regulated content (PHI, NPI, PII, PCI, MNPI, CUI, CJIS), and produces a sensitive-data inventory the audit committee will accept. EPC Group ships custom trainable classifiers for the specific PHI, MNPI, and CUI patterns the customer regulator cares about (HHS-OIG audit triggers, FINRA Rule 3110 surveillance, CMMC L2 CUI markings), the steward and owner assignment matrix per source system, and the remediation backlog that closes the discovery findings. This is the deliverable a Chief Privacy Officer takes to the audit committee in week 12.

Pattern 2 — M&A data inventory and consolidation playbook

The M&A pattern is the data-side complement to a tenant migration. EPC Group runs Purview Data Map against the acquired entity's source estate during diligence or the first 30 days post-close, produces a complete data inventory (tables, columns, sensitivity classifications, ownership, lineage to consumption), identifies redundant systems (two CRMs, three warehouses, four BI tools), surfaces compliance gaps (PHI flowing to an unencrypted on-premises share, MNPI in a Box account, customer NPI in an Excel attachment on personal email), and produces the consolidation backlog. With EPC Group's 216+ M&A tenant consolidations and 1.83M users migrated, this pattern is repeated dozens of times per year. Cross-link to the M&A playbook hub at /microsoft-ma-90-day-tenant-consolidation-playbook for the broader tenant story.

Pattern 3 — Data mesh with Data Products and Data Domains

The data-mesh pattern uses Data Domain and Data Products to federate ownership across business units while keeping a single discovery surface. Finance, Sales, Clinical, R&D, Supply Chain each own their domain, their glossary, their data products, and their access policies; the federated catalog lets a Finance analyst discover and request access to a Clinical data product through one search, with the access decision flowing to the Clinical domain owner. This is the deployment pattern for enterprises that have tried and failed at a monolithic top-down catalog. EPC Group ships the domain taxonomy, the data-product template library, the federated governance operating model, and the steward training curriculum.

Pattern 4 — Microsoft Fabric Lakehouse cataloging end-to-end

The Fabric Lakehouse pattern catalogs the full Fabric estate — workspaces, lakehouses, warehouses, KQL databases, eventhouses, semantic models, reports, dataflows, notebooks, pipelines — with end-to-end column-level lineage that resolves from Fabric ingestion (Dataflow Gen2, Data Factory pipeline, Eventstream) through transformation (Spark notebook, T-SQL stored procedure, KQL update policy) to consumption (Power BI report, Excel pivot, Copilot answer). Sensitivity labels propagate through the lineage — a PHI label applied at ingestion in the bronze lakehouse carries through silver and gold and into the Power BI report a clinician opens, with the encryption and rights protection traveling along. Cross-link to the broader Fabric story at /microsoft-fabric-expertise and /services/fabric-consulting.

Pattern 5 — GDPR data subject access request (DSAR) fulfillment

The GDPR DSAR pattern uses Purview Data Map and the business glossary to answer the regulator-mandated 30-day data subject access request without a fire drill. EPC Group builds the data-subject identifier map (email, customer ID, member ID, employee ID, claim ID — all mapped to the underlying source columns), the source-system query plan (which 17 systems hold data on a given subject), the fulfillment runbook (export, redact, package, deliver inside the SLA), and the right-to-be-forgotten propagation chain (delete in source → confirm in lakehouse → confirm in warehouse → confirm in Power BI semantic-model refresh). The same plumbing serves CCPA, LGPD, Quebec Law 25, and the state-level US privacy laws now in force across 19 states.

Pattern 6 — Healthcare HIPAA data inventory and BAA evidence

The healthcare HIPAA pattern produces the comprehensive PHI data inventory required for the Security Rule risk analysis (45 CFR 164.308(a)(1)(ii)(A)) and the documentation trail that satisfies the BAA obligations under 45 CFR 164.504(e). EPC Group catalogs PHI across the Epic, Cerner, Meditech, or Allscripts source environment, the Fabric and Synapse warehouses that feed Population Health and quality measure reporting, the Power BI semantic models clinicians and operations leaders consume, the M365 estate where PHI escapes into Word, Excel, and Teams, and the third-party SaaS connections (Salesforce Health Cloud, ServiceNow Healthcare, Smartsheet) that often hold uncatalogued PHI. Cross-link to /healthcare-it-consulting-hipaa-microsoft-2026 for the broader HIPAA Microsoft architecture and to /microsoft-purview-data-governance-enterprise-2026 for the broader Purview platform context.

Phase one inventories every source system in scope, every existing metadata or catalog tool the customer has tried (Alation, Collibra, Atlan, Informatica EDC, data.world, Erwin Data Intelligence Suite, SAP DataSphere catalog), every regulatory driver (HIPAA, FINRA, GLBA, GDPR, CCPA, FedRAMP, CMMC, GxP), and every active failure mode (monolithic top-down attempt that rotted, classification false-positive flood, steward backlog never cleared). EPC Group ships a costed roadmap, a domain taxonomy proposal, a steward and owner staffing plan, and a board-ready decision package anchoring on the Assess stage of the EPC Group Lifecycle.

• Source-system inventory across Fabric, Synapse, Snowflake, Databricks, on-premises, SAP, Salesforce
• Existing-tool teardown — Alation, Collibra, Atlan, Informatica, data.world, Erwin, SAP DataSphere
• Regulatory driver mapping — what each regulator requires, how Purview satisfies it
• Data Domain taxonomy proposal scoped to the customer org structure and data-mesh appetite

Phase two provisions Data Map capacity, deploys the self-hosted integration runtime for VNet and on-premises sources, configures connectors and scan schedules across the source estate, and tunes the classifier library — system-defined plus trainable plus customer custom — to a defensible false-positive rate. EPC Group ships the scan-health monitoring runbook, the classification review workflow, and the steward escalation path for false-positive disputes. The deliverable at the end of Phase 2 is a populated catalog with classifications a steward will sign off on.

• Data Map capacity provisioning sized to source-system footprint, with scaling alarms
• Self-hosted integration runtime deployed for on-premises and VNet-isolated sources
• Connector configuration for Fabric, Synapse, Snowflake, Databricks, on-prem SQL, Oracle, SAP, Salesforce
• Classifier library tuned to <5% false-positive rate on customer-specific regulated content

Phase three stands up the business glossary and Data Domain structure. EPC Group authors the initial glossary import covering the regulated terms the customer's industry requires (PHI, NPI, MNPI, PCI, CUI, attorney-client privileged) plus the customer-specific business terms (Net Revenue, Loss-Given-Default, Patient Day, Active Subscriber, Daily Active User), defines the Data Domain taxonomy, assigns initial domain owners and stewards, and trains the steward community on the approval workflows. This is the phase where the catalog acquires meaning.

• Glossary import covering 200-500 initial terms with definitions, stewards, owners, hierarchy
• Data Domain taxonomy operationalized with domain owners and per-domain stewards
• Approval workflows configured and tested for term publication, classification change, lineage edit
• Steward training curriculum delivered, with one-week shadow program before steady-state handoff

Phase four delivers end-to-end column-level lineage across the catalog plus the first wave of curated Data Products. Lineage resolves from ingestion (Fabric Dataflow Gen2, Azure Data Factory, Databricks job, dbt run, Stored Procedure) through transformation (Spark notebook, T-SQL, KQL, Power Query) to consumption (Power BI semantic model, Tableau workbook, Excel pivot, Copilot grounding). Data Products are authored for the highest-leverage business analytics — customer 360, patient 360, sales pipeline, supply chain visibility — and routed through owner-approved access requests.

• Column-level lineage validated end-to-end across Fabric, Synapse, Snowflake, Databricks, Power BI
• Five to ten curated Data Products authored, with documentation, SLAs, and access workflow
• Quality scorecards bound to Data Products via Microsoft Purview Data Quality engine
• Self-service consumption pattern operationalized — analyst search → product request → grant → consume

Phase five is steady-state operation. EPC Group provides managed catalog services — classifier tuning, scan-health monitoring, glossary evolution, steward coaching, Data Product backlog curation, quality alerting, and quarterly governance steering committee output. Senior-architect escalation is the differentiator; tier-one analysts handle routine cases, but every customer has named senior architects on call for the cases that matter — a regulator inquiry, an M&A diligence, a Copilot rollout gate.

• Monthly catalog-health report — scan coverage, classification accuracy, steward backlog, lineage completeness
• Quarterly governance steering committee output with Chief Data Officer review pack
• Quarterly regulatory change review — new state privacy laws, sector regulator changes, Fabric updates
• Senior-architect on-call escalation tied to data-governance incident severity matrix