Today, data management and protection are of paramount importance. Organizations handle vast amounts of data daily, and they must ensure that the data is properly protected. managed.. Microsoft 365 Purview’s data management features allow data to be effectively protected and managed. In this blogpost we delve into how Microsoft 365 Purview‘s data classifications (Sensitivity labels) ja Tiedon säilytysajat (Retention policies) mahdollistaa tehokkaan ja turvallisen tiedonhallinnan. Toki Microsoft 365 Purview:n tiedon hallinta koostuu paljon muustakin, kuin näistä kahdesta ominaisuudesta. Nämä ovat kuitenkin ne keskeisimmät, joista tyypillisesti organisaatioissa lähdetään liikkeelle.
What is data classification?
Data classification refers to the process by which an organization defines how different types of data should be handled and protected, based on their content and regulatory requirements. Classifications can include, for example:
- Confidential (e.g., personal data, financial information)
- Internal Use (e.g., internal reports and memos)
- Public (e.g., marketing materials)
With Microsoft 365 Purview’s data classifications, organizations can classify Office documents, emails, and define background logic, such as encryption, access to classification, and whether classification is performed automatically based on identification or manually by users. Classifications are not limited to Office documents; they can also classify SharePoint/Teams workspaces, meetings, and Azure resources (Storage & SQL). For example, at Above IT, we have protected Teams so that external members cannot be invited to teams intended for internal use, nor can information be shared outside the organization. Classification ensures that critical data receives the necessary protection and is properly maintained throughout its lifecycle.
Copilot respects data protection
Copilot has access to the same areas as the user. If a document is accidentally saved in the wrong place, there is a possibility that the user can view the material through Copilot. For this reason, data classifications are an important part of data protection. The classification travels with the document, regardless of where it is saved. Copilot can also apply the same classification from a referenced document to a new document. For example, when creating a PowerPoint presentation from a classified Word document, Copilot automatically applies the same classification to the PowerPoint presentation as defined in the referenced Word document.
Microsoft has now also introduced the ability to add a setting to classifications that can completely prevent Copilot usage. Previously, restrictions could be made from SharePoint settings on a site-by-site basis. Now the setting can be defined per classification. For example, we have our own classification for HR documents, which is also restricted from Copilot. This ensures that Copilot cannot access confidential material and return information in prompts to users.
Data Lifecycle Management
The data lifecycle in Microsoft 365 services covers the entire existence of data—from its creation, use, retention, and ultimately its destruction or archiving. The goal of lifecycle management is to optimize data management and provide protection and maintain compliance, such as GDPR.
The stages of the lifecycle are:
- Creation – The emergence and storage of data in the right place and in the right way (e.g., SharePoint, OneDrive).
- Usage – The use and modification of data according to need, using the correct permissions and protection measures.
- Retention – The storage of data in accordance with retention and archiving requirements.
- Disposal / Archiving – The deletion or archiving of data when it is no longer in active use or retention requirements are met.
In Microsoft 365, this management is implemented through retention policies, which automate processes related to data retention and deletion.
What license level to start with?
Even with lighter Microsoft 365 Business Premium licenses, some data management functionalities can be utilized, such as basic data classifications and protection. However, comprehensive data management and its automation require E5-level licensing.
Good data management and protection should, however, start with understanding the overall picture and your own needs:
- Plan a classification strategy: define clear classification levels and guidelines for their use.
- Automate classification: utilize automatic classification functions to enhance data management (Requires E5-level licensing).
- Utilize access management: ensure that only the right people have access to critical data.
- Automate data lifecycle management: define retention periods for documents (Requires E5-level licensing).
- Regular auditing: ensure that data management policies are implemented and adapt to needs and regulatory requirements. Utilize Purview’s Compliance Manager tool or a separate security management system, such as Digiturvamalli.
Microsoft recently introduced the possibility to extend the security of Business Premium licenses with the E5 Security add-on. It remains to be seen whether the E5 Compliance add-on will also become available in the future, as this would enable more comprehensive data management even with lighter Business licensing.
Need help with your IT management?
Microsoft 365 offers comprehensive and flexible tools for data classification and lifecycle management. This allows organizations to enhance data protection, reduce risks, and ensure compliance. Smooth data management and achieving goals, however, require a clear strategy and continuous evaluation. When properly utilized, Microsoft 365 provides an excellent toolkit to support an organization’s data management.
Microsoft 365 services, however, comprise a fairly extensive package of cloud services, including various security and privacy technologies, and no one is born a master. Therefore, you might need your own ‘consigliere’ to enhance your IT management expertise.
If you need further insight into Microsoft 365 privacy technologies, we held a Better Privacy webinar on 15.5.2025 at 14:00 related to the topic. The recording is available here.
Do you need help with data protection matters? Contact us below, and let’s discuss further.