Purview Operational Model
Atlanta, USA (United States of America)
Last updated: 2026-07-27
Official references
Operate Purview as a service: review scanner health, policy outcomes, label adoption, access changes, exceptions, and audit evidence. Every change needs an owner, test, approval, rollback, and post-change review.
Define the service model
| Service area | Accountable owner | Evidence |
|---|---|---|
| Data map, sources, and scanning | Platform and source owners | Scan health, freshness, classification, cost |
| Catalog and governance domains | Data governance | Ownership, quality, glossary, access policies |
| Information protection and labels | Compliance | Taxonomy, adoption, encryption, user impact |
| Data loss prevention | Compliance and business owners | Simulation results, matches, overrides, exceptions |
| Audit and eDiscovery | Investigators and legal | Access control, retention, case evidence |
Operating routines
- Review scanner and connector health, classification drift, and metadata growth.
- Monitor DLP (data loss prevention) matches, overrides, false positives, and alert triage in activity explorer.
- Track label adoption, downgrades with justification, and container protection.
- Review privileged access, PIM (Privileged Identity Management) activations, and role-group membership.
- Convert confirmed incidents into policy, training, or control improvements.
Change management
Change-managed items include sources, scans, classifications, collections, labels, DLP (data loss prevention) policies, retention, legal holds, and access. For each change record the reason, scope, test, expected outcome, owner, rollback, and post-change validation.
Business example
A monthly service review finds a DLP (data loss prevention) policy generating excessive false positives after a new source was onboarded. The compliance owner returns the policy to simulation mode, tunes the sensitive information types with the data owner, and re-enables enforcement only after the pilot evidence is approved.