PAGES
← all tools
◆ Data Security & DLP

Microsoft Purview

2026-07-30-79f99e65 commercial

Microsoft Purview is a unified data governance platform that discovers, manages, and protects data across cloud and on-premises environments.

Summary

Microsoft Purview is a commercial data-security platform, run as a cloud service within Microsoft 365, that gives organizations a single place to classify sensitive data and enforce loss-prevention policies across apps and networks. It extends data loss prevention to the network layer through integration with Microsoft Entra Internet Access, blocking sensitive uploads to unmanaged cloud and AI apps without third-party proxies, and it can stop Microsoft 365 Copilot from treating external-sender emails as grounding data. It's built for compliance and security teams responsible for insider risk and data governance rather than for individual developers, and its Insider Risk Management view now consolidates agentic alert triage and case notes in one place. Its Data Security Triage Agent, which reasons across user, device, and data signals, has moved from preview to general availability, indicating active, ongoing development.

Microsoft Purview is a unified data governance platform that discovers, manages, and protects data across cloud and on-premises environments.

Microsoft Purview publishes no documentation we track, so the description above is written from general knowledge rather than the vendor's own words.

How Microsoft Purview helps

Which uploads of sensitive data to AI and cloud apps outside IT's control are actually happening on the network?

inspects traffic via the network-layer integration and blocks sensitive uploads to unmanaged cloud and AI apps in real time, without a third-party proxy in the path

Is Copilot pulling in content from senders outside the company when it drafts an answer?

applies a policy that excludes external-sender emails from being referenced, summarized, or used as grounding data, so responses stay anchored to vetted internal content

Which insider-risk alerts need attention right now, and what has already been done about them?

consolidates agentic alert triage, enriched user details, and case notes with combined classic and agent filtering in one view instead of scattered queues

Why did this user, device, or data activity get flagged as risky?

the Data Security Triage Agent runs multi-step reasoning across user, device, and data signals and surfaces the chain of activity behind the alert

Can sensitivity labeling keep up with how much content lands in SharePoint and OneDrive each day?

auto-labeling policies process up to 500,000 files per day per location, so coverage scales with volume rather than stalling behind a lower daily cap

all 7 features, with the evidence for each →

Features

7 capabilities

Built from Microsoft Purview's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date.

Compare with peers →

All capabilities 7 capabilities
Automated Data Classification and Labeling shipped Applies sensitivity labels to content at scale using configurable policies, simulations, and auditing. 4 releases · first seen Aug 2026

release

  • Allows administrators to edit an auto-labeling policy without re-running simulation. Screenshot showing the local AI agents inventory in the Microsoft Defender portal with discovered agents listed. changelog · Sep 2026 · source · release history
  • Adds audit insights and reporting for auto-labeling policies, showing policy coverage and processing activity. changelog · Sep 2026 · source · release history
  • Scales Purview auto-labeling policy simulations to support up to 20 million items and up to 50,000 sites through adaptive scopes. changelog · Sep 2026 · source · release history
  • Auto-labeling policies now support up to 500,000 SharePoint and OneDrive files per day (up from 100,000), expanding sensitivity-label coverage at scale. changelog · Aug 2026 · source · release history
Data Lifecycle and Index Management shipped Archives inactive content to reduce AI data sprawl while maintaining retention, legal hold, and eDiscovery compliance. 2 releases · 2 other sources · first seen Sep 2026

release

  • Adds Priority Cleanup in Microsoft Purview Data Lifecycle Management to permanently delete approved content — including stale Teams recordings and transcripts — removing it from eDiscovery, SharePoint search, and Microsoft 365 Copilot indexing. Screenshot showing the local AI agents inventory in the Microsoft Defender portal with discovered agents listed. changelog · Sep 2026 · source · release history
  • Enables administrators in Microsoft Purview Data Lifecycle Management to archive inactive SharePoint content at the individual-content level without archiving the entire site, keeping archived content subject to retention, legal hold, and eDiscovery while removing it from Microsoft 365 Copilot indexing until… changelog · Sep 2026 · source · release history

example

  • Archive inactive SharePoint content site-selectively to drop it from Copilot indexing while keeping it under retention and legal hold. In the Microsoft Purview compliance portal, go to Data Lifecycle Management > SharePoint archiving, select the target content (not the full site), apply the archive action, and confirm the content… changelog · Sep 2026 · source
  • Remove stale Teams recordings from Copilot indexing and eDiscovery to reduce AI data sprawl in regulated environments. In the Microsoft Purview compliance portal, go to Data Lifecycle Management > Priority Cleanup, create a new cleanup policy targeting Teams recordings and transcripts, obtain approval, and execute to… changelog · Sep 2026 · source
Network-layer DLP for unmanaged cloud and AI apps shipped Integrates with Microsoft Entra Internet Access to detect and block uploads of sensitive data to unmanaged cloud and shadow AI apps at the network layer, without requiring third-party proxies. 2 releases · 1 other source · first seen Jul 2026

release

  • Adds network-layer data loss prevention via Microsoft Purview and Microsoft Entra Global Secure Access (now generally available), enforcing context-aware classification policies at the network layer to block sensitive files and text from reaching unsanctioned AI tools, covering both human and on-behalf-of (OBO)… Screenshot showing the local AI agents inventory in the Microsoft Defender portal with discovered agents listed. changelog · Sep 2026 · source · release history
  • Integrates with Microsoft Entra Internet Access to extend data loss prevention to the network layer, detecting and blocking sensitive data shared with unmanaged cloud and AI apps in real time. changelog · Jul 2026 · source · release history

example

  • Block uploads of sensitive data to shadow AI apps at the network layer without deploying third-party proxies. In the Microsoft Purview portal, go to Data Loss Prevention > Policies > Create policy, select the 'Microsoft Entra Internet Access' scope, define a condition for sensitive info types, and set the… changelog · Jul 2026 · source
Enhanced eDiscovery Investigation Capabilities shipped Expands search, hold, and export functionality to user-owned containers and provides human-readable content exports. 2 releases · first seen Sep 2026

release

  • Extends Microsoft Purview eDiscovery to support search, hold, review, and export of content in user-owned SharePoint embedded containers, enabling investigators to find content from Microsoft Loop, Copilot Pages, Copilot Notebooks, Outlook newsletters, and other apps mapped to a user without needing the container URL… Screenshot showing the local AI agents inventory in the Microsoft Defender portal with discovered agents listed. changelog · Sep 2026 · source · release history
  • Adds an optional HTML conversion in eDiscovery export to produce a more human-readable version of content for downstream legal tools. changelog · Sep 2026 · source · release history
Microsoft 365 Copilot DLP policy controls shipped Provides DLP policies that let admins prevent external-sender emails from being referenced, summarized, or used as grounding data in Microsoft 365 Copilot responses. 1 release · 1 other source · first seen Jul 2026

release

  • New DLP policy for Microsoft 365 Copilot (preview) lets admins exclude external-sender emails from being referenced, summarized, or used as grounding data in Copilot responses. changelog · Jul 2026 · source · release history

example

  • Prevent Copilot from using external emails as grounding data to keep AI responses anchored to vetted internal content. In the Microsoft Purview portal, go to Data Loss Prevention > Policies > Create policy, choose 'Microsoft 365 Copilot' as the location, add a condition for 'Sender is external', and set the action to… changelog · Jul 2026 · source
Data Security Triage Agent shipped Performs multi-step AI reasoning across user, device, and data activity signals to triage data security alerts. 1 release · first seen Jul 2026

release

  • Data Security Triage Agent's advanced AI reasoning layer — performing multi-step analysis across user, device, and data activity signals — is now generally available. changelog · Jul 2026 · source · release history
Insider Risk Management alert triage shipped Provides a centralized alert experience that consolidates agentic triage, enriched user context, case notes, and combined classic and agent-based alert filtering in a single view. 1 release · first seen Jul 2026

release

  • New centralized Insider Risk Management alert experience consolidates agentic alert triage, enriched user details, case notes, and combined classic/agent filtering into a single view. changelog · Jul 2026 · source · release history

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface

Five scores for Microsoft Purview, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail Microsoft Purview puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Commercials

pricing & packaging history · Microsoft vendor page

16 readings of Microsoft's pricing page since Mar 2022, with 3 relaunches of its plan lineup — each one dated, compared with the reading before it, and explained for someone buying the tool.

Pricing and packaging history is included with Researcher and Business. See how every vendor we track sells, and how that has changed over time, using data we don't publish anywhere else.

See plans →

Website history

microsoft.com, every change

Microsoft's home page and 40 more pages as they looked each month from October 2021 to October 2026: 1520 renders, 335 changes of tagline or palette. Step through them, play them, or put any two months side by side.

Website history is included with Researcher and Business.

See plans →

Releases

3 entries

  1. September 20261
  2. August 20261
  3. July 20261

    3 entries

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    browse all tools → score card for your toolchain →