Microsoft Purview Essentials for Copilot

Microsoft Purview is the unified compliance and data-governance platform in Microsoft 365, managed through the Microsoft Purview portal. It consolidates Information Protection (sensitivity labels), Data Loss Prevention, Insider Risk Management, Communication Compliance, Data Lifecycle Management, eDiscovery, data classification, and DSPM for AI under one umbrella. For AB-900, remember Purview is the platform, not a single feature, and govern data Copilot can access. Do not confuse it with Defender, which handles threat protection; sensitivity labels travel with content and influence what Copilot surfaces.

Microsoft Purview Information Protection is the capability within Microsoft Purview that discovers, classifies, labels, and protects sensitive content across Microsoft 365 services, endpoints, and cloud apps. It uses sensitivity labels to apply persistent encryption, access restrictions, and visual markings to documents and emails, so protections travel with the content wherever it is shared. The exam distinction is that Information Protection labels and encrypts the data, while Data Loss Prevention (DLP) detects and blocks policy violations; a label classifies content, and DLP can enforce rules based on it. Microsoft 365 Copilot honors these labels and a user’s existing permissions.

Sensitivity labels are configurable classifications created in Microsoft Purview Information Protection that attach metadata—and optionally encryption, watermarks, or header/footer markings—directly to files and emails. Because the label persists with the content as it moves, protection such as encryption stays enforced across services like SharePoint, Teams, and Exchange. For the AB-900 exam, the key distinction is between a sensitivity label and a retention label: sensitivity labels govern confidentiality and access, while retention labels govern how long content is kept or deleted. They serve different purposes and can both apply to the same item, making “which Purview feature fits which requirement” a common exam differentiator.

Microsoft Purview Data Loss Prevention lets administrators define policies that detect sensitive information—credit card numbers, health records, or custom patterns—and apply protective actions like blocking sharing, restricting access, or notifying users across Exchange, SharePoint, OneDrive, Teams, and endpoints, with matches surfaced as alerts admins triage in the Microsoft Purview portal. For AB-900, distinguish DLP from sensitivity labels: labels classify and mark a document, while DLP enforces actions based on content or sharing. DLP also offers a Microsoft 365 Copilot location, letting organizations exclude items carrying specific sensitivity labels from Copilot responses.

Microsoft Purview Insider Risk Management is a compliance solution that uses machine learning and policy templates to correlate signals—such as file exfiltration, unusual download volume, or departing-employee activity—into a risk score for each user, letting security teams investigate and act while protecting privacy through measures like pseudonymization. A key exam distinction is that Insider Risk Management focuses on user behavior and activity over time, whereas Communication Compliance reviews the actual content of messages for policy violations. The two are complementary and can share signals, but address different dimensions: one watches what users do, the other what users say.

Microsoft Purview Communication Compliance is a solution in the Microsoft Purview portal that monitors messages across Microsoft Teams, Exchange email, Viva Engage, and connected third-party channels for policy violations such as harassment, profanity, sensitive data exposure, or regulatory misconduct. When a policy match occurs, the flagged message enters a remediation workflow where designated reviewers can investigate, escalate, or resolve the alert.

A key AB-900 distinction is that Communication Compliance reviews message content, whereas Insider Risk Management correlates behavior signals across activities to surface risky users. They complement each other but serve different purposes.

Microsoft Purview Data Lifecycle Management governs how long content stays in Microsoft 365 workloads — Exchange mailboxes, SharePoint sites, OneDrive accounts, and Teams messages — automatically retaining or deleting it by administrator-defined rules. It helps meet regulatory retention obligations and keeps stale data from surfacing in Copilot responses. The exam distinction is scope: retention policies act broadly at the workload level, while retention labels apply at the item level and travel with content when it moves. When both apply, the principle of retention wins — the longest retention period takes precedence over a shorter one.

Data classification in Microsoft Purview underpins information protection by identifying what data is before any policy acts on it. It detects sensitive information types (pre-built patterns like credit card or Social Security numbers) and runs trainable classifiers (machine-learning models for business content such as contracts or resumes). The key exam distinction is that classification detects and categorizes content, while sensitivity labels are the mechanism that enforces protection. Content Explorer shows where classified data lives at rest, while Activity Explorer surfaces what actions users take on labeled content.

Microsoft Purview Compliance Manager is a risk-assessment tool in the Microsoft Purview portal that measures an organization’s environment against regulatory standards—such as ISO 27001, NIST, GDPR, and HIPAA—and surfaces a numeric compliance score. Prebuilt assessments map Microsoft-managed controls alongside customer-managed improvement actions that administrators complete to raise the score. A key exam distinction is that Compliance Manager measures and guides remediation; it does not enforce policies or classify data—enforcement comes from other Purview solutions like Data Loss Prevention or Information Protection. Questions about a compliance score or improvement actions point here, not Microsoft Secure Score.

Microsoft Purview Data Explorer is a read-only view in the Microsoft Purview portal (under Information Protection) that shows a current snapshot of items carrying a sensitivity label, a retention label, or a detected sensitive information type across Microsoft 365 data such as SharePoint, OneDrive, and Exchange. Admins use it to understand where sensitive content resides before deploying Copilot, so data is protected before AI can surface it. The key exam contrast is with Activity Explorer: Data Explorer answers where labeled items reside, while Activity Explorer reports what actions users took on them. Access is tightly scoped through the Data Explorer List viewer role, with the Content viewer role additionally permitting reading actual item contents.