Microsoft Purview: DLP, retention and labels for MSPs

Key insights

• The demonstration says Microsoft 365 Business Premium includes the Purview capabilities discussed.
• Augmentt offers DLP templates for UK personal information, including National Insurance and NHS numbers.
• The demonstrated DLP workflow can start in simulation mode with notifications off.
• The retention templates shown cover Exchange, SharePoint and OneDrive, but not Teams.
• The demonstrated sensitivity-label templates use labels without encryption by default.

Microsoft Purview gives administrators tools to detect risky sharing, govern how long content is kept, and classify documents and email. These controls matter to managed service providers (MSPs) supporting Microsoft 365 clients with sensitive information. Jonathan Edwards demonstrates DLP, retention and sensitivity-label workflows using Augmentt, a third-party management platform.

What's new

The workflows described here are existing Purview capabilities managed through Augmentt; the material does not identify a new Microsoft Purview feature or rollout. The distinction matters: Purview supplies the data-protection controls, while Augmentt presents templates and a deployment workflow for MSPs managing client tenants. The demonstration focuses on three different jobs rather than one combined policy.

Data loss prevention (DLP) looks for sensitive information and flags activity that may expose it. Retention policies govern how long content is kept and whether it is retained, deleted, or both at the end of a period. Sensitivity labels classify content, such as Public, Internal or Confidential, so users can identify how it should be handled.

In the demonstration, Augmentt’s DLP library includes a UK personal-information template that checks for National Insurance numbers, NHS numbers and passport numbers across Exchange, SharePoint, OneDrive and Teams. It also shows templates for other regions and frameworks. The templates are starting points, not a substitute for deciding whether a policy fits a particular client.

Who it is for and what you need

This approach is aimed at MSPs that administer Microsoft 365 for multiple clients and want to deploy or review data-protection settings from Augmentt rather than repeatedly opening client portals. The video states that Microsoft Purview is included in Microsoft 365 Business Premium. It does not provide licensing detail beyond that statement, so verify the applicable service and feature entitlements for a client before planning deployment.

The material does not specify an Augmentt plan, permissions prerequisites, regional availability or a Microsoft rollout stage. It also does not establish that every template applies to every customer. MSPs should confirm their client’s requirements and assess the proposed policy scope before deployment, especially for retention schedules and regulatory frameworks.

The three controls address different concerns. DLP helps identify or respond to sensitive data being shared inappropriately; retention addresses preservation and deletion; labels classify individual content. A label can also inform DLP rules, according to the demonstration, but deploying labels does not by itself establish a complete data-protection program.

How it works

1. In Augmentt, open Secure, then Purview, then Data Loss Prevention. Choose the client tenant and review its deployed policies or browse the template library.
2. Select Deploy Policy, choose a template, and review its description, rules and locations. Adjust locations if needed, then select a mode. The presenter recommends simulation mode with notifications off so the MSP can review matches before enforcement.
3. Deploy the DLP policy. The Policies view shows information such as mode, sync status and last modified time. After reviewing simulation results, the presenter says the policy can be switched to On.
4. For retention, open the retention-policy area and create a policy from a template. Review the duration, end-of-period action and covered locations; the demonstrated seven-year example uses retain then delete for Exchange, SharePoint and OneDrive. The workflow also allows scope to be changed to selected groups or groups to be excluded.
5. For labels, choose templates and create a baseline with the desired labels, then deploy it to a client. The demonstration’s default templates include Public, Internal, Confidential, Attorney-Client Privileged, Education Records and Restricted PHI. It says these are label-only and have no encryption by default.

These steps are the workflows shown in Augmentt, not a full policy-design guide. In particular, the presenter recommends reviewing DLP simulation results before enforcement. That gives an MSP a chance to inspect what the policy matches before applying it in On mode.

Limitations and open questions

The retention templates shown do not include Teams. The presenter says Teams retention must be created separately in the Purview portal because the static policy type in those templates cannot combine Teams with Exchange, SharePoint and OneDrive. The video describes that as a Microsoft constraint, not an Augmentt limitation.

Retention deployment may show pending propagation. The presenter says Microsoft can take up to about a week to apply a retention policy fully and cautions against editing it during that period. The material does not explain how to validate a specific tenant’s propagation or what to do if it takes longer.

The retention examples include one-, three-, seven- and ten-year schedules, plus six-year HIPAA-oriented and five-year SOX-oriented templates. Those durations are presented as templates, not as universal legal instructions. The correct schedule depends on the client and the data, and the material does not provide legal advice or a method for determining each client’s requirements.

Finally, the demonstration is limited to Augmentt’s displayed workflows. It does not verify the behavior of every template, customer configuration or licensing scenario. MSPs should inspect the proposed rules, locations and scope before deploying any policy, and establish how they will review results and maintain the configuration.

Sources

• Jonathan Edwards’ Purview and Augmentt demonstration

Frequently asked questions

Is Microsoft Purview included in Microsoft 365 Business Premium?

The demonstration states that Purview is included in Microsoft 365 Business Premium. It does not detail individual feature entitlements, so confirm the client’s licensing and service configuration.

Can the Augmentt retention templates cover Teams?

The templates shown cover Exchange, SharePoint and OneDrive, not Teams. The demonstration says Teams retention must be configured separately in the Purview portal.

How should an MSP deploy a DLP policy with Augmentt?

Select a template, review its rules and locations, and consider starting in simulation mode with notifications off. Review the matches before switching the policy to On.

Do Augmentt sensitivity-label templates apply encryption by default?

No. The demonstrated templates are label-only and do not include encryption by default.