Sensitive data sat across Microsoft 365 with no controls. I designed a Purview classification and DLP program that made governance enforceable.
Context
The insurer held large volumes of sensitive data across Microsoft 365, with little classification and inconsistent handling.
Challenge
Without classification there was no way to apply meaningful protection. Compliance was a periodic scramble, not an operating capability.
Scope
- Define a classification and labeling scheme
- Design data loss prevention policies
- Align controls to regulatory obligations
- Plan a phased rollout
Constraints
- A business wary of controls that block legitimate work
- Diverse data types across many teams
- Strict regulatory expectations
Approach
- 01Built a label taxonomy mapped to how the business handles data
- 02Designed DLP policies tuned to real risk, piloted before enforcement
- 03Mapped controls to the relevant frameworks for a defensible position
- 04Rolled out in phases with feedback loops
Technologies
Microsoft PurviewSensitivity LabelsDLP
Microsoft PurviewOutcome
- Classification and labeling established across core data
- Lower data loss risk without blocking legitimate work
- A defensible, repeatable compliance operating model
Lessons
DLP that fights the business gets switched off. Tuning to real workflows is what makes data protection stick.
What made it complex
Strong data protection against a business that could not tolerate broad blocking.
Azure Landing Zones
Entra ID
Azure Policy
Microsoft Sentinel
Defender XDR
KQL
Conditional Access