What is Microsoft Purview and what can it do for a small business

On a Friday evening in February, a staff accountant at a 25-person tax and bookkeeping firm exported a client list from the tax software and emailed it to herself, so she could work through it at home over the weekend. It had names, Social Security numbers, and bank account numbers for a little over 300 clients, and it went to her personal Gmail. She mentioned it on Monday morning as the reason she was ahead of schedule.

The owner had two questions for the firm’s IT provider. Had anyone done this before, and could it be stopped from happening again? The first took most of an afternoon with the email logs, and as far as anyone could tell, it hadn’t. The firm’s lawyer spent part of the week working out whether the Gmail copy counted as a breach. It probably didn’t, since she’d sent it to herself in good faith and for work.

The answer to the second question was yes. The tools were already in the Microsoft 365 subscription the firm had paid for since it moved to Business Premium three years earlier, and nobody had ever switched them on.

If you’re the one who gets asked “can we stop that from happening?”, here’s what Microsoft Purview is, what each part does in plain terms, what your plan includes and what costs extra, and what a small business holding sensitive data should switch on first.

Short answer

Microsoft Purview is the set of data protection, compliance, and governance tools built into Microsoft 365. It lets you label and encrypt sensitive files and email, stop data like Social Security numbers from leaving the business, keep a searchable record of who did what, decide how long data is kept and when it’s deleted, put data on hold for a lawsuit, and track your setup against rules like HIPAA. Microsoft 365 Business Premium, at $22 per user per month, includes manual sensitivity labels, data loss prevention for email and files, a 180-day audit log, retention policies, and litigation hold. The advanced features, like automatic labeling, a year of audit history, and insider risk management, need Microsoft 365 E5 or the Purview add-on for Business Premium, which lists at $10 per user per month.

Microsoft Purview at a glance

Question	Short version
What is it?	Microsoft’s data protection and compliance tools for Microsoft 365, managed at purview.microsoft.com.
Do I already have it?	Partly, on every business plan. Business Premium includes the parts most small businesses need first.
What does it cover?	Email, OneDrive, SharePoint, and Teams. Laptops, desktops, and Teams chat messages need higher licensing.
Is it a backup?	No. It can stop data from being deleted, but it can’t roll a mailbox back to an earlier point.
Who needs it most?	Businesses holding health, financial, legal, or client records, and anyone whose insurer or clients ask how data is protected.
What does it cost?	The core features come with Business Premium. The add-on for Business Premium is $10 per user per month, and Microsoft 365 E5 is $60.
How long do the basics take?	Usually three to six weeks, worked on part time. Most of it goes into agreeing on the rules.

What Microsoft Purview is

Purview is the name Microsoft gave its compliance tools in 2022, when it folded the old Microsoft 365 compliance center together with a separate product called Azure Purview. Older guides that mention the “compliance center” or “Microsoft Information Protection” are describing parts of what’s now Purview. The admin side lives in the Microsoft Purview portal at purview.microsoft.com, and you need a Global Administrator account or one of the compliance roles to get in.

It has two halves. The Microsoft 365 half protects the email, documents, and chats your staff create every day, and that’s the half covered here. The other half came from Azure. It catalogs large stores of data like databases and data warehouses, it’s billed separately by usage, and very few businesses under a few hundred people need it.

The Microsoft 365 half answers four questions about your data:

• What sensitive data do you have, and where is it?
• Who’s doing what with it?
• How do you keep it from leaving when it shouldn’t?
• How long do you keep it, and can you produce it when someone asks?

Each part of Purview below answers one or more of those.

Why a small business with sensitive data should care

If your business only holds its own price lists and marketing photos, Purview can wait. Most small businesses hold more than they think, though. A payroll export has every employee’s Social Security number. A medical practice’s inbox has lab results. An accounting firm’s OneDrive has tax returns going back years. A law office’s SharePoint has client files that would hurt someone if they leaked.

Several outside pressures land on exactly this kind of data:

• Regulations. HIPAA expects audit controls and protection for patient information, and our HIPAA cybersecurity guide walks through the requirements. The FTC Safeguards Rule covers tax preparers, mortgage brokers, and many other non-bank financial businesses. It expects a written security program with a named person in charge of it, and the IT governance guide has more on choosing that person.
• Insurance. Many cyber insurance applications now ask whether you encrypt sensitive email and use data loss prevention. Answering yes when you don’t can cause trouble at claim time.
• Clients. Larger clients send security questionnaires before they share their own data with you. “Do you classify and label confidential information?” is a common question, and in Microsoft 365, sensitivity labels let you answer yes.
• AI tools. Microsoft 365 Copilot can read anything the person using it can read, and Purview lets you put limits on that.

The main parts of Purview, in plain terms

Purview has more than a dozen components. These are the ones a small business is likely to use.

Sensitivity labels

A sensitivity label is a tag on a document, email, or meeting invite that says how sensitive it is, and it can carry protection with it. A file labeled Confidential can be encrypted so that only your own staff can open it, wherever the file ends up. It can also be stamped with a header, footer, or watermark.

Labels only protect files that carry them. A list exported from the tax software a minute earlier has no label unless someone adds one or automatic labeling is turned on. Once a file does carry an encrypting label, a forwarded copy or a hacked Gmail account shows nothing readable to anyone outside the firm, because opening the file requires signing in as someone the label allows. Data loss prevention, the next part, catches the files nobody labeled.

On Business Premium and E3, people apply labels themselves, and you can set a default label or require one before a document is saved. Labels applied automatically based on what’s in the file, like any spreadsheet containing Social Security numbers, need E5 or the Purview add-on.

Data loss prevention

Data loss prevention (DLP) watches email and files for sensitive information like Social Security numbers, credit card numbers, bank account numbers, and health details, and acts when that information is about to go somewhere it shouldn’t. Microsoft ships ready-made detectors for hundreds of data types, plus policy templates built around HIPAA, the Gramm-Leach-Bliley Act, and U.S. state breach notification laws.

A DLP rule can log the event quietly, show the sender a warning like “This message contains a Social Security number and is going outside the business,” encrypt the message automatically, or block it. A block can let the person override it with a reason, which keeps legitimate work moving and still leaves a record. Any rule can run in simulation mode first, so you can see what it would have caught before it touches anyone’s email.

On Business Premium and E3, DLP covers email, SharePoint, and OneDrive, which includes files shared in Teams, since those are stored in SharePoint and OneDrive. Covering Teams chat messages and the computers themselves, for example stopping a client file from being copied to a USB drive, needs E5 or the Purview add-on.

Audit

The audit log records what people and admins do across Microsoft 365: files opened, downloaded, and shared, mailbox rules created, sign-ins, permission and admin changes, and hundreds of other activities. It’s on by default on every business plan and keeps 180 days of history. Microsoft raised that from 90 days in October 2023.

Audit (Premium), which comes with E5 or the Purview add-on, keeps a year of history for email, for SharePoint and OneDrive files, and for sign-ins and account changes. It lets you keep other activity longer (up to ten years with a separate add-on), and it records extra detail that helps during an investigation, such as what a user searched for in their mailbox.

Six months covers most day-to-day questions, like who deleted a folder or when a mailbox started forwarding to an outside address. It can fall short after a compromise that went unnoticed for a while. If an auditor or your insurer expects a year, budget for Premium or export the logs on a schedule. Confirming the log is on, and that someone knows how to search it, is one of the items in our Microsoft 365 security audit checklist.

Retention and deletion

Retention policies decide how long email, files, and Teams messages are kept, and whether they’re deleted automatically when the time is up. One policy can keep everything in mailboxes for seven years even if someone deletes it. Another can delete Teams chats after two years. Retention labels do the same job for individual items, like a “Client tax file, keep seven years” label.

Business Premium and E3 include organization-wide retention policies and retention labels that people apply by hand. Applying retention labels automatically, declaring items as records that can’t be edited, and having someone approve a deletion before it happens need E5 or the add-on.

Retention isn’t a backup. It can stop items from being deleted, but it can’t restore a mailbox to how it looked on a given morning, and someone with admin rights can remove the policy. That gap is why Microsoft 365 still needs a backup. The deletion side is easy to forget, too. Old client records sitting in a former employee’s OneDrive add risk and do nothing for the business, and a retention policy can clear them out on a schedule.

eDiscovery and legal holds

eDiscovery is the process of finding, preserving, and handing over electronic information for a lawsuit, an investigation, or a regulator’s request. In Purview, that means searching mailboxes, OneDrive, SharePoint, and Teams for everything matching a name, a date range, or some keywords, putting a hold on it so nobody can delete it, and exporting the results for your lawyer.

Business Premium includes content search and litigation hold, which cover most of what a small business needs when a former employee files a claim or a client dispute turns into a records request. Microsoft licenses its full case-management eDiscovery tools with the Enterprise plans, starting at E3. The premium version adds tools for tracking whose data is involved and notifying those people of a hold, plus review tools that cut down what a lawyer has to read. It comes with E5 or the Purview add-on.

The most common mistake here happens months before any lawsuit. A departing employee’s account gets deleted during offboarding, and when a claim arrives, the mailbox is gone. A hold placed before the account is removed keeps the mailbox searchable, so it belongs on your offboarding checklist for anyone leaving on bad terms. When a real dispute starts, talk to your lawyer before you search or export anything, because how evidence was collected can be questioned later.

Compliance Manager

Compliance Manager compares your Microsoft 365 setup against a regulation or framework and gives you a list of improvement actions and a score. It checks some actions automatically, like whether multifactor authentication (MFA) is on. Others are about process, like having a written incident response plan, and you mark those complete yourself, with evidence attached.

Every plan includes Microsoft’s Data Protection Baseline assessment. Templates for specific rules, including HIPAA/HITECH, NIST CSF 2.0, CMMC Level 2, and Florida’s breach statute, are premium templates. E5 lets you choose three of them at no extra charge, and other plans pay for them individually.

The score is useful for deciding what to work on next. Microsoft’s own documentation says a high score doesn’t mean you’re compliant, so don’t hand it to an auditor as proof.

Insider risk management, communication compliance, and information barriers

Insider risk management looks for patterns that suggest someone is about to leave with data: a burst of downloads after a resignation, files copied to a USB drive, sensitive documents emailed to a personal address. It scores those signals and, by default, hides people’s names from reviewers until there’s a reason to look. Communication compliance scans email and Teams messages for harassment, threats, or sensitive information being shared where it shouldn’t be. Information barriers stop two groups inside the business from finding or messaging each other, which some financial firms need to keep advisory and trading staff apart.

All three need E5 or the Purview add-on, and the first two need someone with time to review what they flag. For a business under 50 people, they usually make sense only when there’s a specific concern, like a salesperson leaving for a competitor with the client list.

Purview and Copilot

Copilot works inside each person’s existing access, so a folder shared with the whole company by mistake becomes something Copilot will summarize for anyone who asks. Fixing permissions and applying sensitivity labels come first, and our Copilot guide has the rollout checklist. Business Premium alone can’t use a DLP policy to keep Copilot away from labeled files, which needs E5. The Purview add-on for Business Premium lists its own controls for Copilot interactions, so ask which ones it includes if that’s your reason for buying it.

What each Microsoft 365 plan includes

Here’s how Purview’s features line up across the plans small businesses usually compare. Prices are U.S. list prices per user per month with an annual commitment, after Microsoft’s July 2026 price change. Enterprise plans are also sold without Teams for a little less.

Capability	Business Premium ($22)	Microsoft 365 E3 ($39)	Microsoft 365 E5 ($60)	Business Premium + Purview add-on ($32)
Manual and default sensitivity labels, including encryption	Yes	Yes	Yes	Yes
Automatic sensitivity labeling	No	No	Yes	Yes
DLP for email, SharePoint, and OneDrive	Yes	Yes	Yes	Yes
DLP for Teams chat and for computers	No	No	Yes	Yes
Audit log with 180 days of history	Yes	Yes	Yes	Yes
Audit (Premium), with a year of history and extra detail	No	No	Yes	Yes
Retention policies and manual retention labels	Yes	Yes	Yes	Yes
Automatic retention labels and records management	No	No	Yes	Yes
Content search and litigation hold	Yes	Yes	Yes	Yes
Premium eDiscovery	No	No	Yes	Yes
Compliance Manager baseline assessment	Yes	Yes	Yes	Yes
Insider risk management, communication compliance, information barriers	No	No	Yes	Yes

A few things the table doesn’t show:

• Business Basic ($7) and Business Standard ($14) include the audit log and content search. They don’t include sensitivity labels, DLP, or retention policies, except for Teams chats. If you’re on Standard and handle sensitive data, Business Premium is the first upgrade to look at, and our Microsoft 365 licensing guide puts the plans side by side.
• E3 is mostly for businesses over 300 people, the cap on Business plans. Under 300, Business Premium covers nearly all of the same Purview features for less.
• The Purview add-on for Business Premium arrived in 2025. It brings the E5 compliance features to Business Premium for $10 per user per month on an annual subscription, for up to 300 users, or $15 when bundled with the matching Defender security add-on. For a 25-person firm, the Purview add-on alone is $3,000 a year. Moving the same firm to E5 would add $38 per user per month, though E5 also includes Microsoft’s top security tools, a phone system, and Power BI Pro, so the comparison only holds if you’d use those.
• Licenses are per person, not per business. Anyone whose mailbox or OneDrive is covered by a policy needs a license that includes the feature. One add-on seat for the admin doesn’t protect everyone. You can license a group, like the finance team, and point the advanced policies only at them.

Microsoft changes Purview licensing often, so check the current service description or ask your provider before you buy.

What you can do on Business Premium without paying more

If you’re on Business Premium, these six steps cost nothing but time, and together they cover what most small businesses need first.

1. Confirm the audit log is on and someone can search it. Sign in at purview.microsoft.com, open Audit, and run a test search for last week’s activity. Give the person who’d investigate an incident the role they need now, before there’s an incident.
2. Run the Data Protection Baseline in Compliance Manager. Read the top ten improvement actions. Many of them point back to settings covered in Microsoft 365 security hardening.
3. Publish three or four sensitivity labels. Public, Internal, and Confidential is a common start, with encryption on Confidential so only your staff can open those files.
4. Start a DLP policy in simulation mode. Pick the template closest to what you hold, such as U.S. financial data, U.S. personally identifiable information, or HIPAA. Run it for two weeks, read what it caught, adjust it, then turn on warnings before you turn on blocks.
5. Set retention policies that match your records schedule. Decide how long you keep email and client files, write it down, and set both the keeping and the deleting.
6. Know how to place a litigation hold. Add it to your offboarding process for anyone leaving on bad terms or after a complaint.

When it’s worth paying for more

The add-on or E5 starts to pay off when one of these is true:

• You have more sensitive files than people will reliably label by hand, and you need automatic labeling.
• An auditor, insurer, or framework expects a year of audit history, and exporting logs yourself isn’t practical.
• You’re rolling out Copilot to people who can reach sensitive data.
• Staff handle sensitive files on laptops, and you need to stop copies to USB drives or personal cloud accounts.
• You deal with lawsuits or records requests regularly, as many law firms, staffing agencies, and property managers do.
• You need to know when a departing employee is taking data with them.
• You’re a financial firm that needs walls between groups of staff.

What Purview won’t do for you

Purview won’t stop someone signing in with a stolen password. Once an attacker is signed in as your employee, every label and DLP rule treats them as that employee, so MFA, sign-in rules, and the rest of the hardening work have to be in place before Purview does much good.

Purview also doesn’t decide your rules. It can enforce “client files never go to personal email,” but someone in the business has to make that the rule, choose who can override it, and read the reports.

A worked example

The tax firm is a composite, not a real business, and the figures are illustrative. The owner waited until after the April filing deadline, then the firm set things up over five weeks in May.

The licenses. The firm stayed on Business Premium. It didn’t buy anything new.

The first week. The IT provider confirmed the audit log was on, then pulled a sharing report from SharePoint and OneDrive. Two client folders had been shared with “anyone with the link” years earlier for a one-time transfer and never closed. Both links were removed that day, and links shared outside the firm now expire after 30 days, one of several guest access settings the firm reviewed.

The labels. The firm published three labels: Public, Internal, and Client confidential, the last one encrypted so only staff can open it. Internal became the default for new documents. Business Premium can’t label a whole SharePoint library automatically, so two staff members spent an afternoon putting Client confidential on the active client files by hand. Exports from the tax software still start out unlabeled, which is why the DLP rule does most of the work.

The DLP policy. A rule for Social Security and bank account numbers ran in simulation mode for two weeks and caught 63 messages. Most were documents going to clients’ own email addresses, and a few were payroll files going to the payroll service the firm uses for its bookkeeping clients. The final rule encrypts any message with a Social Security number that leaves the firm, so clients and the payroll service get a protected message they open after confirming who they are. It blocks any message carrying more than ten of them to a personal email domain like gmail.com, with an override that asks for a reason.

Retention. Email and client files are kept seven years, the same period the firm already used for paper files, and then deleted. Teams chats are deleted after two years.

The time. Setup took about 20 hours of the provider’s time and six hours of the owner’s.

The next February, the rule stopped two emails headed to personal addresses. One was a staff member sending a client list home for the weekend. She opened it from OneDrive at home instead, signed in with her work account, and the file never left Microsoft 365.

Microsoft Purview for Tampa Bay businesses

Sequentur is headquartered in Clearwater, Florida, with a team in Tampa. Medical and dental practices, accounting firms, law offices, and financial advisors around the bay all hold the kind of data Purview protects, and Florida’s breach statute, section 501.171, has two parts worth knowing about here.

Encryption and Florida’s breach law

Once you know, or have reason to believe, that a breach happened, the statute gives you 30 days to notify the people affected, and the state attorney general’s office has to hear from you too if 500 or more Floridians are involved. Its definition of personal information leaves out information that’s encrypted, secured, or modified so that it no longer identifies anyone or can’t be used. A client file protected by an encrypting sensitivity label is a different starting point for that conversation than the same file in plain text. Ask your lawyer how it applies before you rely on it in a real incident, and keep your label settings documented so you can show a file was protected when it left.

The statute also says good-faith access by an employee isn’t a breach, as long as the information isn’t used for something unrelated to the business or misused further. That’s why the tax firm’s lawyer concluded the Gmail copy probably wasn’t one. If you’d like to track your setup against the statute itself, Compliance Manager has a premium assessment template built on 501.171.

Disposal is part of the law, too

Section 501.171 also requires businesses to take reasonable measures to dispose of customer records containing personal information once they’re no longer being kept, by shredding, erasing, or otherwise modifying the information so it can’t be read. Most offices have a shredding bin for paper. For email and files in Microsoft 365, the equivalent is a retention policy that deletes on schedule, and Business Premium includes it.

Common mistakes

1. Turning on DLP in block mode on day one. A rule that stops real work in its first hour tends to get switched off and forgotten. Give it the two weeks in simulation first.
2. Creating too many labels. With ten overlapping labels, people pick the first one or none at all.
3. Encrypting files your clients need to open. A label that limits a file to your own staff also locks out the client you send it to. Keep a separate way to share with people outside the business, like encrypted email or a client portal, and tell staff which one to use.
4. Buying E5 for everyone before using Business Premium. Many businesses pay for advanced features while the basic ones sit unconfigured.
5. Nobody owns the alerts. DLP reports and audit searches only help if someone looks at them. Name who reviews DLP matches each week and who gets the alert emails. If nobody inside the business has the time, managed Microsoft 365 services can cover the routine part.

What is next in this series

The next article covers Microsoft Purview sensitivity labels in more depth: how to design a label scheme that fits a small business, how to publish labels to staff, how labels apply encryption, watermarks, and access restrictions, and how manual and automatic labeling compare across Word, Excel, Outlook, Teams, and SharePoint. After that come data loss prevention policies, then Compliance Manager.

How Sequentur can help

If you’d like to know what your Microsoft 365 plan already covers, or you want help switching Purview on, schedule a call. For businesses in Tampa and Clearwater, we can walk through it at your office.