mcpField
P
purview-general

purview-general

github.com/vinayaklattheSecurity17876 installsUpdated 19w ago
Repository

About purview-general

A routing skill for teams choosing Microsoft Purview capabilities or starting a governance program. It maps goals to solutions and helps sequence discovery, licensing, roles, and rollout checks.

Key features

  1. 01Map goals to Purview solutions
  2. 02Guide discovery and licensing checks
  3. 03Recommend scoped roles
  4. 04Sequence capability rollout
  5. 05Verify pilot enforcement

Use cases

  1. 01Choose a Purview solution for a goal
  2. 02Plan a new Purview program
  3. 03Check licensing and roles before rollout

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/vinayaklatthe/microsoft-security-skills --skill purview-general

After installing, type/purview-generalin Claude Code to confirm it loaded.

Details

From the project README

Microsoft Purview (Overview)

Microsoft Purview is a unified suite for data security, data governance, and risk & compliance, managed from the Microsoft Purview portal. This skill is the router: it helps decide which Purview solution (and which deeper skill in this repo) addresses a goal, in what order, and what to verify before building anything.

When to use

Use this skill first when the user is unsure which Purview capability fits, is starting a Purview programme from scratch, is evaluating licensing, or asks "where do I begin". Once the route is clear, hand off to the specific skill (DLP, classification, eDiscovery, etc.).

Do not use this skill when the user already knows the solution they need - go straight to that skill (e.g. purview-dlp-policy, purview-ediscovery).

Map the goal to a solution

Pick the row that matches the question, then load the named skill.

If the goal is...Primary solutionDeeper skill
Find and tag sensitive dataInformation Protection + Data Classification (SITs, trainable classifiers, EDM)purview-data-classification
Stop sensitive data leaving M365, endpoints, or browsersData Loss Preventionpurview-dlp-policy, purview-advanced-dlp
Retain or delete content for legal / regulatory reasonsData Lifecycle Management, Records Managementpurview-data-lifecycle
Catalogue and curate enterprise data estate (lakehouses, DBs, SaaS)Unified Catalog + Data Mappurview-data-catalog, purview-data-map
Detect insider data theft, sabotage, or policy violationsInsider Risk Managementinsider-risk-baseline
Detect harassment, regulated comms, or info leakage in messagingCommunication Compliancepurview-communication-compliance
Run legal hold, collection, review for litigation/HReDiscovery (Premium for advanced)purview-ediscovery
Tenant-wide audit trail of user/admin activityPurview Audit (Standard or Premium)purview-audit
Understand AI prompt data flow (Copilot, custom agents)DSPM for AIpurview-dspm-ai
Fix oversharing before Copilot rolloutSAM + restricted content discovery + sensitivity labelspurview-copilot-oversharing
Govern data used by AI agents (Copilot Studio, custom)Agent security + classification + DLP for AIpurview-agent-365-security
Privacy programme (subject rights, GDPR)Microsoft Priva (separate product)microsoft-priva
Tour Purview for a specific workload (Exchange/SharePoint/Teams)Workload-scoped Purview controlspurview-for-m365
Information governance programme (Know→Protect→Govern→Manage)Cross-solution programmepurview-information-governance

Rule of thumb: if more than one row fits, start with classification - every other Purview capability is weaker without it.

Approach

A Purview programme dies fast when teams skip discovery and jump to enforcement. Follow this order; each step gates the next.

  1. Discovery first — Run the Content Explorer and Activity Explorer in the Purview portal to see what sensitive data already exists and how it moves. Without this, every downstream decision (labels, DLP rules, retention) is guesswork. Verify: Content Explorer shows non-zero items for at least 3 built-in SITs you expect to exist (e.g. credit card, national ID, IBAN).

  2. Confirm licensing before designing — Many capabilities are gated. Check before promising timelines.

    • Included in M365 E3: sensitivity labels (manual), basic DLP for SharePoint/OneDrive/ Exchange, Audit Standard, basic retention.
    • Requires M365 E5 / E5 Compliance: Advanced DLP, Endpoint DLP, Insider Risk, Comms Compliance, Records Management, eDiscovery Premium, Audit Premium, DSPM for AI.
    • Separate add-on/SKU: Microsoft Priva, Purview Data Governance for non-M365 sources.

    Verify: portal banner shows "Advanced features available" for E5; if missing, the feature will appear in UI but block at policy creation.

  3. Confirm roles, least privilege — Purview has its own role groups under Settings → Roles & scopes → Permissions. Do not assign Compliance Administrator or Organization Management wholesale; use scoped groups.

    • DLP work → Compliance Data Administrator + DLP Compliance Management
    • eDiscovery → eDiscovery Manager (not Admin) for case workers
    • Insider Risk → Insider Risk Management Investigators (separate from Analysts for SoD)
    • Read-only review → Compliance Reader

    Verify: a test account in a scoped role can perform the intended action and is blocked from other workloads.

  4. Sequence the rollout — Build maturity in this order; each layer assumes the previous. Classification → Sensitivity labels (manual) → Auto-labelling (simulation mode) → DLP audit-only → DLP block → Lifecycle / retention → Insider Risk → DSPM for AI. Skipping forward (e.g. auto-label without manual adoption first) creates user backlash and false positives that erode trust in the programme.

  5. Pilot before tenant-wide — Every Purview enforcement (DLP block, auto-label, retention delete) should run audit / simulation mode for 7-14 days on a pilot group before going live. Watch override counts and false-positive rates.

Guardrails

  • Never enable enforcement before classification maturity. Auto-labelling or DLP-block without confidence in your SITs produces false positives at scale and destroys user trust. Run simulation mode for at least 7 days first.
  • Do not over-assign Compliance Administrator or Organization Management. These bypass scoped role groups and break separation of duties for eDiscovery and Insider Risk investigations.
  • Validate licensing before designing. Several solutions appear in the portal regardless of SKU and only fail at policy-creation time. Use the M365 service description as the source of truth, not the portal UI.
  • Do not scope by feature availability. Scope by data sensitivity and regulatory driver (GDPR, HIPAA, FINRA, PCI). Building "we have it, let's turn it on" creates noise without reducing risk.
  • Teams retention has limits. Teams chat retention applies forward only; historical chats are not back-filled. Communicate this before rollout.
  • eDiscovery holds are silent to users by design. Confirm legal/HR sign-off before placing a hold - inadvertent notification has happened via admin audit log access.

Common anti-patterns

  • "DLP first, classification later" — Rules fire on regex matches without label context, flooding the SOC with false positives. Always classify first.
  • "Turn on every Purview feature at once" — Overwhelms admins and users. Stick to the Sequence in Approach step 4.
  • "Use Org Management for the Purview admin team" — Grants tenant-wide rights including Exchange and SharePoint admin. Use scoped Purview role groups instead.
  • "Auto-label everything sensitive" — Without simulation, you will mislabel hundreds of documents and trigger access denials. Always run simulation mode and review the report before publishing.

Example prompts

  • Which Microsoft Purview solution should I use for my scenario?
  • Where do I start with Microsoft Purview for a new tenant?
  • What licence do I need for Insider Risk Management?
  • Explain data governance vs data security vs compliance in Purview.
  • What is the right order to roll out Purview features?
  • Which Purview role should I give my compliance team?

Microsoft Learn

Comments

Markdown supported