Regulatory Compliance in Microsoft Purview

Regulatory compliance in Microsoft Purview refers to the suite of tools and services that help organizations meet legal, regulatory, and organizational standards for data protection, retention, and discovery. The core components are: - Microsoft Information Protection (MIP): Sensitive information types, sensitivity labels, and labeling policies. - Data Loss Prevention (DLP): Policies that detect and prevent accidental or intentional sharing of sensitive data. - Records Management: Retention labels, retention policies, and disposal review. - Audit (Standard and Premium): Logging of user and admin activities. - eDiscovery (Standard and Premium): Search, hold, and export of content for legal investigations.

These components work together to enforce data governance across Exchange Online, SharePoint Online, OneDrive for Business, Microsoft Teams, and endpoints.

Sensitive Information Types (SITs) are the foundation. Microsoft provides over 200 built-in SITs (e.g., Credit Card Number, U.S. Social Security Number). Each SIT is defined by a regular expression pattern, checksum validation, keyword proximity, and confidence level. For example, the SIT for U.S. Social Security Number uses the pattern \d{3}-\d{2}-\d{4} and validates with Luhn checksum (though SSNs don't actually use Luhn; Microsoft uses a similar algorithm for other types). Custom SITs can be created using the Compliance Center or PowerShell.

Sensitivity labels are the primary classification tool. They can be published to users or auto-applied based on SIT detection. Labels can enforce encryption (using Azure Information Protection), visual markings (header/footer/watermark), and auto-labeling for files and emails. When a label is applied, it stamps the document with metadata and optionally encrypts it using Azure RMS. Encryption uses a symmetric key wrapped with an asymmetric RSA key pair per tenant.

DLP policies are evaluated at the transport layer (Exchange Online) and at rest (SharePoint, OneDrive). For Exchange, the policy is enforced during message submission—the transport agent inspects the message body, attachments, and subject. For SharePoint and OneDrive, the policy is enforced when a document is shared externally or accessed by an unauthorized user. DLP rules can block access, send notifications, or trigger incident reports.

Retention policies work via a timer in the content's metadata. When a retention label is applied, the item's RetentionDate is calculated based on the item's creation date or last modified date, plus the retention period. During the retention period, the item cannot be permanently deleted. After the period expires, a disposal review may occur, or the item is automatically deleted.

Audit logging captures events from Exchange, SharePoint, Azure AD, and other workloads. Standard Audit logs are retained for 90 days by default. Premium Audit extends retention to 1 year for all events and up to 10 years for specific high-value events (e.g., when an admin accesses a mailbox). Audit logs are stored in the Unified Audit Log (UAL) and can be searched via the Compliance Center or Search-UnifiedAuditLog cmdlet.

eDiscovery uses content search to query mailboxes, SharePoint sites, OneDrive locations, and Teams. eDiscovery holds (litigation holds) preserve content by placing a hold on the source—this prevents deletion and version cleanup. eDiscovery Premium adds machine learning models for relevance and predictive coding.

To create a custom sensitive information type using PowerShell:

$pattern = @{
    Id = "CustomSSN"
    Name = "Custom SSN Pattern"
    Pattern = @{
        Id = "SSNPattern"
        Elements = @(
            @{
                Name = "SSNRegex"
                Regex = @{
                    Pattern = "\d{3}-\d{2}-\d{4}"
                    IsCaseSensitive = $false
                }
            }
        )
        ConfidenceLevel = 85
    }
}
New-DlpSensitiveInformationType -Name "Custom SSN" -Description "Detects SSN" -Pattern $pattern

To create a DLP policy:

New-DlpCompliancePolicy -Name "PII Policy" -Comment "Blocks PII sharing" -ExchangeLocation All -SharePointLocation All -OneDriveLocation All -TeamsLocation All
New-DlpComplianceRule -Name "Block Credit Card" -Policy "PII Policy" -BlockAccess $true -NotifyUser $true -SensitiveInformationNames "Credit Card Number"

To search audit logs:

Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-30) -EndDate (Get-Date) -Operations "MailboxLogin", "FileAccessed" -ResultSize 1000

Purview compliance integrates with: - Azure AD: For user identity and group membership used in policy scoping. - Microsoft 365 Defender: DLP incidents can be integrated with Defender for Cloud Apps for cloud app governance. - Information Rights Management (IRM): Sensitivity labels use Azure RMS encryption. - Microsoft Teams: DLP policies can be applied to Teams chat and channel messages (requires Premium DLP). - Endpoint DLP: Extends DLP to Windows 10/11 devices via the Microsoft 365 Apps for Enterprise.

The MS-102 exam specifically tests:

A large bank must comply with SOX (Sarbanes-Oxley) and PCI DSS. They use Purview to automatically classify any document containing credit card numbers or financial statements. They create custom SITs for account numbers. Sensitivity labels enforce encryption on all documents containing PII. DLP policies block any email containing credit card numbers from being sent outside the organization. Retention labels keep financial records for 7 years, then automatically delete them. Audit logs are retained for 1 year (Premium) to meet regulatory requirements. eDiscovery cases are used for internal investigations. The bank deploys Endpoint DLP on all employee laptops to prevent sensitive data from being copied to USB drives. Common issues include false positives from DLP policies (e.g., blocking legitimate credit card transactions) and performance impact of auto-labeling on large SharePoint farms. They mitigate by using simulation mode and scoping policies to specific sites.

A hospital must comply with HIPAA. They use Purview to protect electronic protected health information (ePHI). Built-in SITs for medical terms and patient IDs are used. Sensitivity labels mark all medical records as 'Highly Confidential' with encryption. DLP policies prevent sharing of patient data in Teams chats and emails. Retention policies keep medical records for 6 years (state requirement). Audit logs track access to patient records. eDiscovery holds are placed on terminated employees' mailboxes. The hospital also uses communication compliance to detect inappropriate patient data sharing. Challenges include managing retention across different state laws and ensuring that auto-labeling does not miss newly created documents. They use adaptive scoping to apply policies only to departments handling ePHI.

A global company must comply with GDPR and local data residency laws. They use Purview to classify personal data across regions. Sensitivity labels include geographic scoping (e.g., 'EU Personal Data'). DLP policies block cross-border transfers of EU citizen data. Retention policies align with GDPR's 'right to erasure' by setting a maximum retention of 5 years. Audit logs are searched regularly for data subject access requests (DSARs). eDiscovery cases are used to respond to DSARs within the 30-day window. The company uses double key encryption for highly sensitive data. Performance considerations include high volume of audit log events (millions per day) and the need to index large amounts of data for eDiscovery. They use audit log retention policies to purge old logs and optimize eDiscovery searches by date range.