You have Microsoft Purview. But is it really protecting your crown jewels?

From Microsoft 365 licensing to demonstrable control over your critical data

Many organisations already have access to Microsoft Purview through their Microsoft 365 licences.

But having the technology is not the same as being demonstrably in control.

For executives, the more important questions are:

• Do you know what your organisation’s five most important digital crown jewels are?
• Can you demonstrate who has access to them and how that information is being used?
• Do you know which critical information employees are sharing with AI tools, external parties or personal accounts?
• Is unusual employee behaviour identified early enough?

And perhaps the most important question:

• Are you actually using the Microsoft Purview capabilities you already own to manage these risks?

e3 helps organisations turn Microsoft Purview from an available Microsoft capability into a working Data Protection programme.

Data Protection is a board-level issue

Cybersecurity has traditionally focused heavily on keeping attackers out.

That remains essential.

But for executives and boards, there is another question that is just as important:

What happens to our most important information once someone already has access?

That person could be:

• an attacker;
• an employee;
• an external consultant;
• a supplier;
• a departing employee;
• a user of generative AI;
• an AI agent.

Your critical information continuously moves across:

• Microsoft 365;
• Teams;
• SharePoint;
• OneDrive;
• email;
• endpoints;
• cloud applications;
• AI applications.

The challenge is therefore not only to secure access.

The challenge is to retain control over the information itself.

From Microsoft E5 to real protection

Many organisations have invested in Microsoft 365 E5 and therefore already have access to extensive security and compliance functionality.

But in practice, we often see that Purview is only partially configured.

For example:

• sensitivity labels exist but are rarely used;
• classification is not sufficiently aligned with the business;
• DLP policies remain in monitoring mode;
• false positives are too high;
• policies are too generic;
• critical business information is not recognised;
• Insider Risk Management has never been activated;
• AI-related risks are barely addressed;
• governance and ownership are unclear.

The result:

the technology is available, but the actual level of protection remains limited.

e3 helps organisations close this gap.

Microsoft Purview Data Loss Prevention optimisation

Microsoft Purview DLP can identify sensitive information and apply controls when employees use or share that information.

But effective DLP is not created by simply activating Microsoft templates.

The key question is:

Which information do you actually need to protect?

For your organisation, this may include:

• intellectual property;
• customer information;
• pricing models;
• contracts;
• product designs;
• source code;
• research information;
• strategic plans;
• personal data.

e3 helps organisations align Purview DLP with these specific business risks.

Why existing DLP often underperforms

Many DLP implementations face the same problems.

Too many alerts

Policies are too broad and generate so many incidents that users and security teams eventually start ignoring them.

Too little relevant detection

Standard templates may detect personal data, but not necessarily the information that is strategically important to your organisation.

No connection to business processes

A DLP policy often does not understand why an employee is sharing specific information.

No clear owner

Security configures the technology, but the business has never formally decided which information is truly critical.

Monitoring without protection

Policies remain in audit or monitoring mode for years without ever progressing towards active protection.

e3 optimises Purview DLP based on business risk.

From detection to protection

Our approach focuses on controlled progression:

Identify → Detect → Understand → Optimise → Protect

This typically means:

1. determining which information is business-critical;
2. analysing existing policies;
3. reducing false positives;
4. improving detection logic;
5. involving business owners;
6. rationalising exceptions;
7. measuring first;
8. introducing warnings or blocking controls in a controlled way.

The objective is not to create as many DLP rules as possible.

The objective is:

to protect the right information without unnecessarily disrupting the business.

Microsoft Purview Classification & Sensitivity Labels

A strong Data Protection strategy starts with understanding which data matters.

Microsoft Purview Information Protection helps organisations discover, classify and protect sensitive information. Sensitivity labels can make the sensitivity of information visible and can enforce additional controls such as encryption.

Examples of labels may include:

• Public;
• Internal;
• Confidential;
• Highly Confidential.

Creating labels technically is easy.

The real challenge is deciding:

Which information belongs in which category?

Who decides?

When should a label be applied automatically?

When should users be allowed to change it?

What protection should be associated with each label?

Classification must reflect the organisation

A classification model must be recognisable and understandable for employees.

Too many labels make the model difficult to use.

Too few labels provide insufficient differentiation.

e3 helps organisations develop a classification model aligned with:

• business activities;
• regulatory requirements;
• privacy;
• intellectual property;
• customer information;
• data sovereignty;
• AI use.

We do not focus only on standard sensitive information such as national identification numbers or credit card details.

The information that determines your competitive advantage should also be included.

Protect your Crown Jewels

For executives, we recommend linking classification directly to the organisation’s digital crown jewels.

These are the datasets, documents and forms of knowledge where loss or misuse could directly affect:

• revenue;
• competitive position;
• business continuity;
• reputation;
• enterprise value.

Examples include:

• product designs;
• source code;
• R&D results;
• customer contracts;
• pricing strategies;
• acquisition plans;
• forecasts;
• strategic information.

Purview can then help make this information recognisable and protectable.

Labels as the foundation for DLP

Sensitivity labels and DLP should not be treated as separate projects.

A label provides context about the importance of information.

DLP then determines what users are allowed to do with that information.

For example:

A document labelled:

Highly Confidential – Intellectual Property

could be subject to stricter controls for:

• external email;
• personal cloud storage;
• USB;
• printing;
• sharing with external users;
• AI applications.

This creates a much more logical and manageable Data Protection model.

Purview and Microsoft Copilot

The introduction of Microsoft Copilot makes strong classification even more important.

Microsoft Copilot and agents can recognise sensitivity labels and use them as part of the information-protection model.

At the same time, Copilot creates an important executive challenge.

Copilot can make information that users already have access to much easier to discover.

An employee no longer needs to know where a document is stored.

They can simply ask for it.

Before broad AI adoption, organisations should therefore understand:

• what data exists;
• how sensitive it is;
• who has access;
• whether that access is still appropriate;
• which information AI should be allowed to use.

AI increases the importance of good Data Governance and Data Protection.

Microsoft Purview Insider Risk Management

Not every data risk comes from outside the organisation.

A significant amount of risk originates from legitimate users.

For example:

• an employee accidentally shares information incorrectly;
• someone downloads unusually large volumes of documents;
• an employee sends files to a personal account;
• a consultant accesses more information than necessary;
• a departing employee takes intellectual property with them.

Microsoft Purview Insider Risk Management uses multiple signals to identify potential accidental or malicious insider risks, including data leakage and intellectual-property theft.

An anomaly is not automatically an insider threat

Insider Risk Management must be applied carefully.

Unusual behaviour does not automatically mean malicious intent.

The real question is:

Is this behaviour logical within the role and context of this user?

For example:

An engineer opening hundreds of design documents may be completely normal.

A Finance employee suddenly downloading those same documents may be more relevant.

Combining:

data + user + behaviour + context

is what makes Insider Risk Management valuable.

Privacy by design

Insider Risk Management directly affects employees and privacy.

That means implementation must be handled carefully.

Microsoft provides privacy capabilities such as default pseudonymisation, role-based access controls and audit logging.

But technology alone is not enough.

A mature programme also requires clear agreements between:

• Security;
• Privacy;
• HR;
• Legal;
• Compliance;
• Risk;
• Works Councils.

e3 helps organisations establish this governance before operational deployment.

From signals to a controlled process

An Insider Risk solution should not end with a dashboard full of alerts.

There must be a clearly defined process.

For example:

Signal → Alert → Triage → Investigation → Decision → Action

The organisation must define:

• who is allowed to review an alert;
• when an investigation may begin;
• when a user’s identity may be revealed;
• when HR or Legal should be involved;
• which information may be used as evidence;
• how long information is retained.

Microsoft Purview supports alerts, investigations and case management within Insider Risk Management.

Insider Risk and AI

Insider Risk Management is also becoming more relevant because of AI.

It is no longer only employees who use data.

AI agents can increasingly:

• search for information;
• access files;
• combine data;
• perform actions.

This creates a new executive question:

Not only: which employee has access?

But also:

Which AI agent has access to our critical information?

One integrated Purview Data Protection model

The greatest value is created when Microsoft Purview is not configured as a collection of separate features.

We recommend connecting the capabilities.

Classification

What is our critical information?

Sensitivity Labels

How do we make that information recognisable?

Protection

What level of protection belongs to each classification?

DLP

Where may this information go — and where may it not go?

Insider Risk

Which users or behaviours represent elevated risk?

AI Data Protection

Which information may Copilot and other AI solutions use?

This creates one coherent Data Protection model.

From Microsoft licence to executive control

For a CEO or board member, Purview is ultimately not about policies and configuration.

It comes down to four questions:

1. Do we know which data is critical?

2. Do we know who can access it?

3. Can we prevent that data from being misused?

4. Can we demonstrate that our controls actually work?

That is the difference between:

having Microsoft Purview

and:

using Microsoft Purview as a real Data Protection platform.

The e3 Purview Data Protection Review

e3 can help organisations perform a focused assessment of their existing Microsoft Purview environment.

We review areas including:

Classification & Labels

• classification model;
• sensitivity labels;
• automatic classification;
• label adoption;
• protection associated with labels;
• alignment with crown jewels.

Purview DLP

• existing policies;
• incident volumes;
• false positives;
• detection coverage;
• endpoint controls;
• email;
• Teams;
• SharePoint;
• OneDrive;
• AI use cases.

Insider Risk Management

• relevant use cases;
• available signals;
• policies;
• privacy;
• governance;
• investigation processes;
• roles and responsibilities.

Organisation

• Data Owners;
• Security;
• Privacy;
• HR;
• Legal;
• Risk;
• business ownership.

What does this deliver?

The outcome is not simply a technical report with dozens of configuration findings.

Executives and management gain clarity on:

• which critical data is actually protected;
• which important risks are not yet covered;
• which existing Microsoft capabilities remain unused;
• where the biggest improvements can be made;
• which actions should be prioritised.

This creates a practical roadmap.

From Microsoft licence to demonstrable Data Protection.

Do you already have Microsoft Purview?

Then the most important question may not be:

“Which additional security technology should we buy?”

But:

“Are we using the capabilities we already have effectively enough to protect our most important data?”

e3 helps organisations answer that question objectively.

Let e3 assess your current Microsoft Purview Data Protection maturity and identify where you can gain more control over your critical data using the Microsoft technology you already own.

CONTACT E3

Do you recognize your organization in our vision on data protection and DLP?
We would be happy to meet, learn more about your environment and explore how we can help protect your critical data.

Get in touch with e3 Benelux and let’s secure your business together.