Empowering SMBs: Your Microsoft Purview Compliance Setup Guide for Data Protection

Step 1: Access and Initial Configuration of the Microsoft Purview Portal

The Microsoft Purview portal is your unified command center for data security, governance, and compliance. While many advanced Purview features are best configured through the portal due to their visual nature and integrated workflows, establishing a PowerShell connection is crucial for scripting, automation, and specific administrative tasks.

First, connect to the Microsoft Purview Compliance PowerShell session. This session allows you to manage many of the underlying components that Purview orchestrates, such as Information Protection (including sensitivity labels) and Data Loss Prevention policies.

Connect-IPPSSession -UserPrincipalName "admin@yourdomain.com"

• -UserPrincipalName: Specify the UPN of a user with Global Administrator or Compliance Administrator roles. You will be prompted for credentials.

Portal alternative: Navigate directly to compliance.microsoft.com using an account with appropriate administrative permissions. The Purview portal provides a streamlined interface for exploring and configuring all Purview solutions. Familiarize yourself with the left-hand navigation pane to locate Data classification, Information Protection, and Data loss prevention sections.

Run this to verify: After connecting, you can verify your session by running a simple cmdlet, for example:

Get-Label

• This command will list any existing sensitivity labels in your organization. If successful, your PowerShell session is properly established.

Step 2: Identify and Classify Sensitive Data with Sensitive Information Types (SITs)

The cornerstone of any effective compliance strategy is understanding your data. Microsoft Purview's Sensitive Information Types (SITs) enable you to identify sensitive data across your digital estate, whether it's credit card numbers, national identification numbers, or custom intellectual property. SMBs should start by leveraging the extensive library of built-in SITs before considering custom ones.

While creating custom SITs is primarily a portal-driven experience for visual pattern matching and testing, you can list existing SITs via PowerShell to understand what's available.

Get-DlpSensitiveInformationType | Format-Table Name, Description

• Get-DlpSensitiveInformationType: Retrieves a list of all sensitive information types available in your tenant, including built-in and custom types.
• Format-Table Name, Description: Displays the name and description for easier readability.

Portal alternative: For identifying and creating SITs, the Purview portal offers a superior, more intuitive experience. Navigate to Data classification > Sensitive info types. Here, you can review the hundreds of built-in SITs, test them against example content, and create custom SITs using dictionaries, regular expressions, or functions. For most SMBs, starting with a review of relevant built-in SITs is highly recommended to cover common sensitive data patterns like credit card numbers, social security numbers, or health information.

Run this to verify: After reviewing built-in SITs or creating a custom one in the portal, you can run the `Get-DlpSensitiveInformationType` command again to confirm that new or specific SITs are now listed.

Step 3: Create and Publish Sensitivity Labels for Data Protection

Microsoft Purview Information Protection (MPIP) uses sensitivity labels to classify and protect sensitive data. These labels allow you to apply flexible protection actions such as encryption, visual markings (headers, footers, watermarks), and access restrictions to documents, emails, and even Teams meetings. For SMBs, we recommend starting with a simple, clear hierarchy of labels.

Here's how to create and publish sensitivity labels using PowerShell (after connecting your IPPSession from Step 1):

# 1. Create a basic 'Confidential - All Employees' label
New-Label -Name "Confidential - All Employees" -DisplayName "Confidential - All Employees" -Tooltip "This content is confidential and intended for all employees." -Comment "Used for general internal confidential information." -Priority 10

# 2. Configure visual marking for the 'Confidential - All Employees' label (e.g., a footer)
Set-Label -Identity "Confidential - All Employees" -AddFooter "True" -FooterText "%%LABEL%% - SkyCore Solutions Confidential" -FontSize 9 -FontColor "#808080" -Alignment "Center"

# 3. Create a more restrictive 'Highly Confidential - Internal Only' label with encryption
New-Label -Name "Highly Confidential - Internal Only" -DisplayName "Highly Confidential - Internal Only" -Tooltip "This content is highly confidential and restricted to internal SkyCore Solutions employees. It will be encrypted." -Comment "Used for highly sensitive internal information requiring encryption." -Priority 20

# 4. Configure encryption for 'Highly Confidential - Internal Only' label
# This grants Full Control to members of a specific Microsoft 365 group (e.g., 'InternalOnlyGroup')
$accessRights = New-CsCustomPermissions -Users "InternalOnlyGroup@yourdomain.com" -AccessRights FullControl
Set-Label -Identity "Highly Confidential - Internal Only" -EncryptionEnabled $true -CustomPermissions $accessRights -AddWatermark "True" -WatermarkText "HIGHLY CONFIDENTIAL" -AddHeader "True" -HeaderText "%%LABEL%%"

# 5. Create a label policy to publish these labels to users
New-LabelPolicy -Name "SMB Standard Labels" -Labels @("Confidential - All Employees", "Highly Confidential - Internal Only") -Force

# 6. Publish the label policy
Publish-LabelPolicy -Identity "SMB Standard Labels"

• New-Label: Creates a new sensitivity label.
• -Name / -DisplayName: The internal and user-facing name of the label.
• -Tooltip / -Comment: Provide descriptive information.
• -Priority: Determines the order labels appear. Higher numbers mean lower priority (appear later in the list).
• Set-Label: Modifies an existing label.
• -AddFooter / -FooterText: Configures visual markings. %%LABEL%% is a dynamic placeholder.
• -EncryptionEnabled $true: Enables encryption.
• -CustomPermissions: Defines who has access to encrypted content. For SMBs, using a Microsoft 365 group is efficient. Replace 'InternalOnlyGroup@yourdomain.com' with an actual group email.
• New-LabelPolicy: Creates a policy to group labels.
• -Labels @("Label1", "Label2"): Assigns specified labels to the policy.
• Publish-LabelPolicy: Makes the label policy available to users.

Portal alternative: For a more visual and guided setup, navigate to Information Protection > Labels and Information Protection > Label policies in the Purview portal. This interface allows you to define label settings (visual marking, encryption, auto-labeling), test them, and then publish them to specific users or groups. For SMBs, this is often the easiest way to create and manage labels.

Run this to verify: To confirm your label policies are published, you can use:

Get-LabelPolicy | Format-Table Name, Labels, IsPublished

• This command shows the names of your label policies, the labels included, and whether they are published.

Step 4: Configure Microsoft Purview Message Encryption

Email is a primary vector for sharing sensitive information, often externally. Microsoft Purview Message Encryption (M365 ME) allows you to send encrypted emails and attachments to anyone, inside or outside your organization, ensuring only authorized recipients can read the content. M365 ME is largely automatic for eligible tenants, but you often need transport rules to enforce encryption based on content or recipient.

While the core M365 ME service is typically enabled by default with your Microsoft 365 license, you can configure transport rules in Exchange Online to automatically apply encryption. This example creates a rule to encrypt emails containing the custom sensitive info type "Project Confidential Info" (assuming you created one in Step 2) when sent externally.

# Connect to Exchange Online PowerShell if not already connected
Connect-ExchangeOnline -UserPrincipalName "admin@yourdomain.com"

# Create a transport rule to encrypt outbound emails containing a specific SIT
New-TransportRule -Name "Encrypt Outbound Project Confidential" `
    -Comments "Automatically encrypts emails containing 'Project Confidential Info' SIT when sent outside the organization." `
    -SentToScope "NotInOrganization" `
    -ApplyClassification "Project Confidential Info (Encrypt)" `
    -SetSCL -1 `
    -RuleErrorAction "Stop" `
    -Enabled $true

• -SentToScope "NotInOrganization": Applies the rule to emails sent to external recipients.
• -ApplyClassification "Project Confidential Info (Encrypt)": This parameter requires an existing sensitivity label or a mail flow classification that enforces encryption. For simplicity and to integrate with Purview, it's often best to link this to a sensitivity label that applies encryption (e.g., the 'Highly Confidential - Internal Only' label from Step 3, which can be modified to allow external sharing if needed for specific scenarios). Alternatively, you could directly use the `ApplyRightsProtectionTemplate` parameter if you have specific templates. For this guide, assuming a label that encrypts is the best path. You might need to adjust this if your Purview label for encryption isn't available directly here. A common SMB approach is to use sensitivity labels with encryption directly from Outlook/Office apps. A transport rule acts as a fallback or enforcement for specific conditions.
• To ensure this rule works, you need to ensure the sensitivity label used (`Project Confidential Info (Encrypt)`) is configured to apply encryption. If you're using a label like 'Highly Confidential - Internal Only' which encrypts, you'd integrate it by having users apply that label or by a different mechanism. For transport rules specifically targeting encryption, ensure you have the correct Classification or RMS template available. The example uses a conceptual 'Classification' that would be tied to encryption. For Purview Message Encryption itself, the service enables the ability to encrypt; rules trigger when to use it.

Portal alternative: Navigate to the Exchange admin center (admin.exchange.microsoft.com) > Mail flow > Rules. Here, you can create new rules and select actions such as "Modify the message security > Apply Office 365 Message Encryption and rights protection" or "Apply a rights management template" based on conditions like sender, recipient, or sensitive information contained in the message. This portal approach provides a visual builder for complex mail flow rules.

Run this to verify: To list existing transport rules and check their status:

Get-TransportRule | Format-Table Name, State, Conditions

• Verify that your new encryption rule appears and is enabled. Then, send a test email containing the specified sensitive information to an external recipient to confirm it's encrypted upon arrival.

Step 5: Implement Data Loss Prevention (DLP) Policies

Microsoft Purview Data Loss Prevention (DLP) policies are critical for preventing accidental oversharing of sensitive information. DLP can monitor and restrict data sharing across various locations, including Exchange Online, SharePoint Online, OneDrive for Business, and Microsoft Teams. For SMBs, starting with a basic policy that detects and alerts on common sensitive data is a smart move, initially in audit mode.

Here's how to create a DLP policy using PowerShell (after connecting your IPPSession from Step 1):

# 1. Create a new DLP compliance policy in Audit mode
New-DlpCompliancePolicy -Name "SMB Standard DLP Policy" `
    -Comment "DLP policy for detecting common sensitive information across M365 services." `
    -Identity "SMB Standard DLP Policy" `
    -PolicyScope "All" `
    -Mode "AuditAndNotify" `
    -Enabled $true

# 2. Add a rule to the DLP policy to detect US Social Security Numbers (SSN)
New-DlpComplianceRule -Policy "SMB Standard DLP Policy" `
    -Name "Detect US SSN" `
    -ContentContainsSensitiveInformation @(@{Name="U.S. Social Security Number (SSN)"; minCount="1"}) `
    -AccessScope "External" `
    -BlockAccess "False" `
    -BlockAccessExternal "False" `
    -NotifyUser "Owner,PolicyTip" `
    -IncidentReportEmail "complianceadmin@yourdomain.com" `
    -Priority 100 `
    -RuleMode "Audit" `
    -Enabled $true

• New-DlpCompliancePolicy: Creates a new DLP policy.
• -PolicyScope "All": Applies the policy to all locations (Exchange, SharePoint, OneDrive, Teams).
• -Mode "AuditAndNotify": Recommended starting mode for SMBs. It logs incidents and notifies users/admins without blocking actions. Once confident, you can change to `Enforce`.
• New-DlpComplianceRule: Adds a rule to the specified policy.
• -Policy "SMB Standard DLP Policy": Links the rule to your newly created policy.
• -ContentContainsSensitiveInformation: Specifies the SITs to detect. Here, it's 'U.S. Social Security Number (SSN)'.
• -AccessScope "External": Triggers when sensitive content is shared outside the organization.
• -BlockAccess "False" / -BlockAccessExternal "False": In audit mode, we set these to false. Change to true for enforcement.
• -NotifyUser "Owner,PolicyTip": Notifies the content owner and shows a policy tip.
• -IncidentReportEmail: Sends incident reports to the specified email address.
• -RuleMode "Audit": Ensures the rule operates in audit-only mode, without blocking.

Portal alternative: Navigate to Data loss prevention > Policies in the Purview portal. Click "Create policy" to use a template (e.g., "Financial > U.S. Personally Identifiable Information (PII) Data") or a custom policy. The portal provides a wizard-like experience to define locations, conditions (which SITs to detect), and actions (block, audit, notify). This is often simpler for SMBs configuring their first policies.

Run this to verify: To list your DLP policies and their associated rules:

Get-DlpCompliancePolicy | Format-Table Name, Mode, PolicyScope
Get-DlpComplianceRule -Policy "SMB Standard DLP Policy" | Format-Table Name, ContentContainsSensitiveInformation, RuleMode

• Verify that your DLP policy and rule are listed and are in `Audit` mode as intended.

Step 6: Monitor Compliance Activity with Audit Logs and Activity Explorer

A robust compliance setup isn't a one-time configuration; it requires continuous monitoring. Microsoft Purview provides unified audit logs and the Activity explorer to help you track user activities, discover how sensitive data is being used, and identify potential compliance risks or policy violations.

You can search the unified audit log using PowerShell to retrieve specific activities. This example searches for all file deletion activities in SharePoint Online by a specific user.

# Search for file deletions by a specific user in SharePoint Online
Search-UnifiedAuditLog `
    -Operations "FileDeleted" `
    -UserIds "user@yourdomain.com" `
    -StartDate (Get-Date).AddDays(-7) `
    -EndDate (Get-Date) `
    -ResultSize 1000 | `
    Format-Table CreationDate, UserIds, Operations, Workload, ObjectIds

• -Operations: Specifies the audit operation to search for (e.g., `FileDeleted`, `FileAccessed`, `LabelApplied`).
• -UserIds: Filters activities by specific users.
• -StartDate / -EndDate: Defines the time range for the search.
• -ResultSize: Specifies the maximum number of results to return.
• ObjectIds: The name of the file or object acted upon.

Portal alternative: The Purview portal offers visual and user-friendly tools for monitoring. Navigate to Audit > Audit search to search the unified audit log with various filters for activities, users, dates, and workloads. For deeper insights into sensitive data, use Data classification > Activity explorer. Activity explorer provides a visual dashboard to see where sensitive data resides, how it's being used, and which sensitivity labels are being applied, giving you an immediate overview of data interactions.

Run this to verify: Execute the PowerShell command above, adjusting the -UserIds and -Operations as needed for recent activity in your tenant. You should see audit records if the specified user performed the operation within the timeframe. Similarly, navigating to Activity explorer in the Purview portal should populate with data over time, confirming that auditing is active and reporting information.