Cybersecurity Analyst

Question

One of the companies try to set up DLP. they put bunch of search term for exchange and all the email. It would email and put separate mailbox. One of the problems is not notifying anyone. another one is just taking them out and copy them. It duplicates sensitive information. We wanted to know how does it work? Is it copying the data in some way to Microsoft Purview? Is it notifying us in some way? who gets access to it? Is it changing data? Is it just notification saying Data with this classification label has been as its location or has been transferred any email? What does it look like? We need to know how purview works and how we get notified of sensitive data being transferred.

Answer 1

Hello Akyildiz, Busra,

Welcome to the Microsoft Q&A forum.

Microsoft Azure Purview is a data governance solution that helps organizations discover and manage data. It provides a unified view of data across organization, and helps understand the data's lineage, classification, and sensitivity.

Regarding your questions:

How Purview works with DLP:

Purview does not directly integrate with DLP solutions. In Microsoft Purview, you implement data loss prevention by defining and applying DLP policies. With a DLP policy, you can identify, monitor, and automatically protect sensitive items: Please check this document

Is it copying the data in some way to Microsoft Purview?

No, Microsoft Purview works through metadata, self-referential data markers based on type, date, and other key identifying attributes.

Is it notifying us in some way?

Yes, to create alerts, you first set up an alert policy to outline the conditions that trigger an alert and the frequency of notifications. When a match to your policy conditions is detected, you’ll receive an email notification with details. Check this document.

Who gets access to it?

Access to the data is determined by the underlying data source. However, Purview provides tools for managing and securing your organization's data. Please check Microsoft Purview Information Protection

Is it changing data?

No, Microsoft Purview does not change the data. It applies encryption to protect sensitive data.

Is it just notification saying Data with this classification label has been as its location or has been transferred any email?

The notification will provide details about the sensitive data that was detected, including its classification label and location, so you can determine whether to investigate or take further action.

I hope this helps. Please let us know if you have any further questions.