Security and AI Essentials
Protect your organization with AI-powered, end-to-end security.
Defend Against Threats
Get ahead of threat actors with integrated solutions.
Secure All Your Clouds
Protection from code to runtime.
Secure All Access
Secure access for any identity, anywhere, to any resource.
Protect Your Data
Comprehensive data security across your entire estate.
Recent Blogs
This blog post describes how to instantly revoke Entra service principal bearer tokens with continuous access evaluation, even before their lifetime has expired.
Aug 25, 2026838Views
0likes
1Comment
We are pleased to announce the enterprise-ready release of the security baseline for Microsoft Edge version 151!
We have reviewed the settings in Microsoft Edge version 151 and updated our guid...
Aug 25, 2026329Views
0likes
0Comments
Executive Summary
This triumvirate of tools present a cohesive and unified platform that tells a compelling story:
Microsoft Security Copilot as the assistive AI experience and extensible ...
Aug 24, 2026423Views
0likes
0Comments
David Weston leads Agentic Security at Microsoft, where he and his team build the AI models, autonomous agents, and evaluation systems redefining how defenders operate. At Microsoft since the Windows...
Aug 24, 2026103Views
0likes
0Comments
Recent Discussions
My companies app incorrectly detected as a trojan
Hi Team. I am the developer of a gaming geo fence and your system had falsely detected my app as Trojan:Script/Wacatac.C!ml I need help to remove it as it seems like analysts are no longer checking false detections anymore? ( at least to me it seems automatic now )? My app is a geo fence which creates firewall rules and use npcaap for packet capture to display server locations and the exe is encrypted to help fight against software pirates. Here is an example submission of my exe for my application https://www.microsoft.com/en-us/wdsi/submission/5ab00c91-ea84-4fbb-a739-613316b32dfe Please get an analyst to manually inspect the file and whitelist it as its a pain telling my customers to turn off their anti virus and also its not advice i should have to give to be honest. My company is called sbmmoff ltd https://papagal.bg/eik/207176266/58b9 Website is bflocker.com I really would appreciate a speedy response to resolve the situation and thank you for your time.SolvedInsider Risk Level not being correctly picked up by DLP
I have two users currently with assigned Insider Risk levels, one elevated and one minor. I have taken the templated DLP policy (DSPM for AI - Block sensitive info from AI sites) which looks for sensitive information being pasted to generative AI sites, and applies a block if the user is an elevated risk user, and a block with override for a moderate/minor risk user (this was audit only originally). For each advanced DLP rule within that policy, I have a separate policy tip which shows so I know which Advanced DLP rule has been hit. However, I'm having some discrepancies with the correct insider risk level being identified by Purview and therefore the wrong advanced DLP rule is being applied. Testing examples: Logged into a Windows 11 PC with the account, and using Medium confidence UK NINO's I try pasting the content into ChatGPT: Elevated risk user: Block with Override Minor Risk user: Block with Override If I try the exact same scenario on a different PC, I can sometimes get to the point where even though its the same set of data, Purview allows me to paste it at after checking the data. Or in another scenario, I was getting both users hitting the "elevated risk" advanced DLP rule. The Devices are all showing as up to date sync wise with DLP policies, and the policy itself is showing as fully synced. Assigned insider risk levels: DLP Rules: Elevated: Moderate/Minor:SolvedDomain controller showing "Not ready for migration"
I want to get the MDI sensor upgraded to v3 on our domain controllers. When I go into Settings > Sensors, two of our DCs are listed as "Ready for migration", but the third says "Not ready for migration". As far as I can tell, this DC meets all the prerequisites listed at Migrate from sensor v2.x to sensor v3.x - Microsoft Defender for Identity | Microsoft Learn. In the Troubleshooting section of that article, it says "hover over the status on the Sensors page to see a tooltip that lists the reasons the server doesn't meet the migration prerequisites", but I see no such tooltip, no matter where I hover. I tried opening a support request with Microsoft 365 Support, only to be told that I have to contact Azure support. We don't currently have an Azure support plan, so I guess we don't qualify for support. Anyone got any suggestions for things I can try?Solved
Azure Databricks Unity Catalog connector - Metadata
For the Azure Databricks Unity Catalog connector, I believe Microsoft Purview scans and collects the following technical metadata: Table name View name Column names Catalog name Schema name Metastore information Table and column descriptions from Databricks comments Unity Catalog tags, which are stored within Purview properties Table, view and column lineage where supported Storage location information may also appear within the technical properties of the asset, depending on the Databricks object. However, Microsoft does not appear to clearly document storage location as guaranteed metadata from every scan. Can anybody explain this further or confirm whether they have seen different behaviour? Where the metadata is stored or managed in Azure Databricks Metadata collected by Microsoft Purview Where it is stored or managed in Azure Databricks Metastore Unity Catalog Metastore Catalog name Unity Catalog Schema name Unity Catalog Schema Table name Unity Catalog Table metadata View name Unity Catalog View metadata Column names Table schema in Unity Catalog Table description Unity Catalog Table Comment Column description Unity Catalog Column Comment Unity Catalog tags Tags applied to Unity Catalog objects such as tables, views and columns Table and column lineage Unity Catalog lineage metadata and system lineage tables Storage location Table metadata where applicable, particularly for external tables I believe table and column descriptions are stored in Databricks as comments against the Unity Catalog object. These comments can then be scanned into Microsoft Purview and displayed as descriptions. The Microsoft documentation appears clearer for column comments than it does for table comments, so I am planning to test this myself. Does anybody have practical experience of this behaviour? Unity Catalog tags Tags are stored as metadata against Unity Catalog securable objects. Tag information can also be queried through Unity Catalog INFORMATION_SCHEMA, including TABLE_TAGS and the corresponding column tag metadata. The core Unity Catalog structure is: Unity Catalog Metastore Catalog Schema Table or View Columns Additional metadata can include: Comments Tags Lineage Storage location where applicable What Microsoft currently documents as collected by the Microsoft Purview Azure Databricks Unity Catalog connector Databricks Unity Catalog metadata Collected into Purview? Notes Metastore Yes Represented in the Purview hierarchy Catalog name Yes Unity Catalog catalog Schema name Yes Unity Catalog schema Table name Yes Creates/discovers the table data asset View name Yes Views are supported Column names Yes Schema/column metadata is collected Table comment / description Yes Your observation is correct: Databricks table comments/descriptions can appear as the Purview Data Asset description Column comments / descriptions Yes Microsoft explicitly states that Databricks column comments are displayed as column descriptions in Purview Unity Catalog tags Yes Microsoft explicitly states that Unity Catalog tags are scanned into Purview Properties Table/view lineage Yes, subject to prerequisites Extracted from Unity Catalog system lineage tables Column lineage Yes, subject to prerequisites Supported, although there are lineage limitations External tables Metadata yes External table metadata is supported; lineage for external tables is not supported Microsoft's connector documentation currently lists the following core hierarchy and metadata as being extracted by the scan: Metastore Catalogs Schemas Tables and Columns Views and Columns Unity Catalog Tags Data Asset descriptions This behaviour appears to be genuine. Microsoft specifically documents that a Databricks column comment can be used as the description displayed in Microsoft Purview. Microsoft also notes that setting a Databricks table column comment to an empty string prevents the column description from being displayed in Purview. For practical purposes, the relationship is: Databricks comment or description Purview scan Microsoft Purview description This is explicitly documented for column comments. Table comments also appear to be surfaced as the Data Asset description through the connector, based on observed behaviour, although Microsoft's documentation is less explicit about this. Has anybody seen this working consistently for table descriptions? Unity Catalog tags Unity Catalog tags are supported by the current connector. Microsoft documentation states that tags from Unity Catalog are extracted during scanning and displayed within Microsoft Purview Properties. There is a documented exception where tags are not supported when the scan uses the Kubernetes Self-hosted Integration Runtime option. That exception should not apply where Kubernetes SHIR is not being used. Storage location The official connector documentation clearly documents the Unity Catalog hierarchy and the metadata listed above. However, it does not appear to explicitly list the table storage location or storage path as a guaranteed metadata element within the supported metadata capabilities. Storage location information may therefore appear for some Databricks objects, particularly external tables, but I would not currently treat it as guaranteed metadata from every Purview Unity Catalog scan without further testing. My current understanding is that a Microsoft Purview scan of Azure Databricks Unity Catalog can collect: Metastore Catalog Schema Table View Columns Table descriptions or comments Column descriptions or comments Unity Catalog tags Table and view lineage where supported Column lineage where supported External table metadata Storage location may also be visible where applicable, but this appears less clearly documented as a guaranteed field? Does this sound correct based on other people's experience of Microsoft Purview scans of Azure Databricks Unity Catalog data sources?Solved55Views0likes1Comment
How can we identify the size of a Microsoft Purview DLP policy and individual DLP rules?
Hello Microsoft Community, According to the Microsoft Purview DLP policy reference, the following platform limits apply: Maximum size of a DLP policy: 100 KB Maximum size of an individual DLP rule: 100 KB or 102,400 characters Maximum number of rules within a policy: Limited by the overall policy size I would like to understand how these limits are calculated and how administrators can monitor the current size of an existing DLP policy or rule. Could someone please clarify the following? What exactly is included when calculating the 100 KB DLP policy size? Does the policy size include only policy-level configuration, such as locations, users, groups, administrative units, inclusions and exclusions, or does it also include the combined definitions of all rules associated with the policy? What exactly is included in the 100 KB individual rule size? Sensitive information types and their GUIDs Condition groups Instance-count and confidence-level configurations Exceptions Endpoint DLP restrictions User notifications and policy-tip messages Override options Alert and incident-report settings Recipient lists Advanced rule configuration For example, does it include: The documentation describes the rule limit as “100 KB (102,400 characters).” Is the limit based on: The number of characters The UTF-8 or Unicode byte size The serialized JSON/XML representation An internally generated policy payload Is there a supported method in the Microsoft Purview portal, Security & Compliance PowerShell, Microsoft Graph, or another API to display the current size of: A DLP policy Each DLP rule The remaining available policy capacity Can the size be estimated by exporting the output from Get-DlpCompliancePolicy and Get-DlpComplianceRule? If so, which properties should be included in the calculation, and what encoding or serialization format should be used? Does the 100 KB policy limit represent the combined size of the policy and all its rules, or are the policy and rule limits evaluated independently? What error or warning is generated when a policy or rule approaches or exceeds the limit? Is there any notification before the limit is reached? We are designing global Microsoft Purview DLP policies containing multiple Sensitive Information Types, condition groups and workload-specific rules. We need a reliable method to measure policy and rule sizes during design and ongoing policy governance. Any official guidance, supported script, API property, or calculation method would be appreciated.SolvedIs system-preferred first factor overriding Single Sign-On?
My colleagues and I have noticed that we've started being prompted to perform a Windows Hello for Business authentication when we use Edge to access web resources that are authenticated with Entra. Previously, this authentication occurred silently through Single Sign-On with the PRT, per Understanding Primary Refresh Token (PRT) in Microsoft Entra ID - Microsoft Entra ID | Microsoft Learn. While investigating what might have caused this change in behavior, I found MC1411574 in the M365 Message Center, which talks about a change to system-preferred authentication that started rolling out in late June 2026, whereby it now applies to the first factor as well as multi-factor authentication. I excluded myself from system-preferred authentication and sure enough, that seems to have restored the previous behavior. Is it intended that this change to system-preferred authentication will disable SSO, or do we have something misconfigured?Solved125Views0likes3CommentsCustom Detection Rules as Code in Sentinel Repositories: What Your Pipeline Owns Now
While going through the June Sentinel updates I almost scrolled past this one, and I think that would have been a mistake: custom detection rules can now be managed as code in Sentinel Repositories, the same way analytics rules, playbooks, parsers and workbooks already are. You connect a GitHub or Azure DevOps repo, enable the Custom Detection Rules content type, and rules are synced on every commit. There is also a standalone path via the Bicep CLI for teams running their own pipelines. The feature is in preview per the Learn documentation, and in my view it matters more than the low-key rollout suggests. Microsoft has been positioning custom detections as the unified experience for building rules over both Defender XDR and Sentinel data since late 2025. If custom detections are becoming the primary detection type, then this preview is the moment your primary detection type becomes pipeline-managed. I spent some time in the documentation to understand what that actually means, and there is one implication I have not seen anyone talk about yet. How it works Custom detection rules use a different mechanism than every other content type in Repositories. Analytics rules deploy as Microsoft.OperationalInsights/workspaces/providers/alertRules resources, with the Microsoft.SecurityInsights provider sitting in the resource name. Custom detection rules instead use a dedicated Bicep extension. You declare it in a `bicepconfig.json` at the repo root: { "extensions": { "MicrosoftSecurity": "br:mcr.microsoft.com/bicep/extensions/microsoftsecurity:v1.0.1" } } The rule itself is a `Microsoft.Security/detectionRules` resource. This is the structure from the Microsoft documentation: extension MicrosoftSecurity resource detectionRule 'Microsoft.Security/detectionRules@2026-06-01-preview' = { id: 'custom-rule-id' displayName: 'Custom Rule Display Name' status: 'enabled' queryCondition: { queryText: 'DeviceProcessEvents | take 10 | project DeviceId, Timestamp, FileName' } schedule: { frequency: 'PT1H' } detectionAction: { alertTemplate: { title: '<ruleTitle>' description: 'Custom detection rule' severity: 'medium' tactics: [ { tactic: 'Execution' techniques: [ { technique: 'T1059' } ] } ] entityMappings: { hosts: [ { id: 'h' deviceIdColumn: 'DeviceId' } ] } } } } Rules are uniquely identified by the `id` property, which you provide in the template. Deployment is either the automatic Repositories sync or a plain `az deployment group create` against a resource group. That last part is what I like most about the design: any CI/CD system that can run Azure CLI can ship these rules. Prerequisites beyond the standard Repositories setup: a Microsoft 365 E5 license or equivalent that includes Defender XDR, and a Sentinel workspace onboarded to the Defender portal. Two preview limitations are documented: custom frequency for Sentinel-only data is not supported yet, and neither are custom details. The part that made me stop reading and think Repositories are designed as the single source of truth. The documentation is explicit that content in your repo overwrites changes made through the portal. That is the whole point of the feature, and for analytics rules it has been mostly harmless. For custom detections I see a wrinkle. When Microsoft renames tables or columns in the advanced hunting schema, those naming changes are applied automatically to queries saved in Microsoft Defender, including the queries inside custom detection rules. The docs are equally explicit that this automatic migration does not cover queries run via API or saved anywhere outside Defender. A Git repo is outside Defender. Play that forward with a current example. The `AIAgentsInfo` table stopped being accessible on July 1, 2026, replaced by the unified `AgentsInfo` table with a changed column set. A portal-managed custom detection referencing the old table got migrated automatically. The same rule managed as code did not, because the authoritative copy of the query now lives in your repo, and nothing in the sync path rewrites your Bicep files. Your repo is now the thing standing between Microsoft's server-side fix and your production detection. Either the sync starts failing, or the stale query gets reasserted over the migrated rule. The documentation does not say which of the two happens, and honestly, neither is good. No alert fires for either. And if smart deployments, which skip files that have not changed since the last deployment, apply to this content type the same way they do to the rest of Repositories, it gets slightly worse in a way I find almost funny: a stale rule would sit untouched until someone happens to edit it. What I would put in front of the merge To be clear, none of this is an argument against the feature. I want detections in Git, and I suspect most people reading this do too. It is an argument that moving custom detections into a repo moves the schema lifecycle responsibility into your review process, because the portal safety net explicitly does not reach into source control. Concretely, a PR touching detection content should be checked for references to deprecated or transitioning advanced hunting tables, for the result columns the custom detection docs recommend (`Timestamp` or `TimeGenerated`, plus `DeviceId` or `DeviceName` for Defender for Endpoint tables, plus `Timestamp` and `ReportId` from the same event for the other Defender tables), and for complete entity mappings, since entities drive how alerts group into incidents. One more detail from the custom detection docs that I suspect will trip up people coming from analytics rules, because it goes against years of muscle memory: avoid filtering on `Timestamp` or `TimeGenerated` in the query itself. The service prefilters data based on the detection lookback using ingestion time. The scheduled-analytics-rule reflex of always pinning a time window works against you here. Whether you enforce these checks with a homegrown script or a linting step in the pipeline matters less than doing it before merge rather than discovering it in the alert queue. The deployment mechanics are now solved. The content governance is yours. Full transparency: I have worked through the documentation and the sample content, but I have not yet run a retired-table scenario through the sync myself. So if you are testing the preview, I would genuinely like to hear how it behaves in your environment when a repo-managed rule references a table like `AIAgentsInfo`. That failure mode is the one I want to understand before this reaches GA. Beyond that specific case, I am curious where you all stand: are you moving custom detections into Git now, or waiting for GA? And if you already run detections as code for analytics rules, what checks have earned a permanent place in your PR pipeline? My used references: Manage content as code with Microsoft Sentinel repositories: https://learn.microsoft.com/en-us/azure/sentinel/ci-cd-custom-content Advanced hunting schema naming changes: https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-schema-changes Create custom detection rules in Microsoft Defender XDR: https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules Custom detections as the unified detection experience: https://techcommunity.microsoft.com/t5/microsoft-defender-threat-protection/custom-detections-are-now-the-unified-experience-for-creating/ba-p/4463875Solved
Using Cloud sync to sync AD to existing Entra Accounts
I want to sync in premise AD accounts with existing Entra accounts. The email on both accounts is the same, and I added the Entra/o365 suffix to the domain and set the UPN to that suffix, making both UPN(s) the same. It did not sync. It created a NEW Entra account. I thought I covered all my bases. How can I get on premise AD and existing Entra accounts to sync? thank youSolvedPurview HR connector
Hi, I am trying to upload a csv file with resigning users to Purview through the HR connector, following the steps from this documentation (https://learn.microsoft.com/en-us/purview/import-hr-data). Have set up a power automate flow to create a bearer token and upload the csv file using a POST API to "https://webhook.ingestion.office.com/api/signals" as shown in the Github sample solution and script. However, I run into the following error: "No HTTP resource was found that matches the request URI 'https://40.75.149.147/api/signals'. The IP seems to change each time I make the API call. Is the URI correct or should I be using another specific URI? Any help would be greatly appreaciated. Thanks in advance!Solved111Views0likes1Comment
Unlabelled Files
I have a requirement to produce a report which contains the number of files in M365 SharePoint & OneDrive which do not have a sensitivity label applied. I am struggling to find a sensible approach to this and I am fairly certain this is not possible in Purview unless I have missed something. If anyone can help it would be appreciated. ThanksSolved
Passkey Sign in Method (Entra Account) missing in Security
Hi BANNEDUSERNAMESupport we enable FIDO2 passkey in entraId. However, when we try to register the FIDO2 passkey on myaccount.microsoft.com -> Security -> Add a Sign-in Method -> Passkey is missing. Attached screenshot. For a personal account, the Passkey method is available at the same location, even though interface is slightly different than an Entra Id account. Attached screenshot for the personal account as well. Kindly guide us on where to register the passkey or if we need to enable certain settings in EntraId for the passkey to show up in sign-in methods. We have Auth Strengths enabled in EntraId for the particular user in question and this reflects in the Device Lockscreen during login on Entra Registred Device. Thanks ChandraSolved
Data System Wide Lineage via API Request
I'm struggling with finding a solution. My goal is to identify all existing lineage relationships for any data objects within a specific data system they belong to. I've been using the Purview REST API (Datamap Dataplane) but I haven't found an endpoint returning data system side lineage/relationships. For my scenario I have a Databricks metastore and need to know the existing lineage relationships of those data objects within Purview so I can purge them out when we are doing our scheduled lineage refresh.Solved166Views1like3Commentspasskeys in the Authenticator app regarding attestation
I have a question about passkeys in the Authenticator app regarding attestation in connection with QR code-based cross-device sign-in. When we register a passkey with attestation enabled in the Authenticator app, it can be used to complete the sign-in process on another device via QR code and Bluetooth Low Energy. According to Microsoft’s documentation, this shouldn’t be possible with attestation enabled, yet it works. What are we misunderstanding here? https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-enable-authenticator-passkey Thanks for your inputs. JohannesSolved
Auto Labeling Policy Delay for Old Files (Exsisting Files)
Hi Everyone, We are observing a difference in auto labelling policy behaviour in Purview for Sharepoint. An auto labelling policy has been enabled and scoped to sharepoint with metadata based rule(document creation date or document modification date). The scoped sharepoint only contain 7 unlabeled files that were uploaded before the policy turned on. The policy is working because if i placed any new file after enabling the policy got labelled within about 5 minutes, but the exsisting files are not labeled and remains unlabelled. It seems the new files are evalauated via the near time while exsisting file rely on asychronous mode. Can anyone help explain why exsisting files take longer to be proceesed even when there there are only a few files or share if you faced similar behaviour. This is the test scenario, as we plan to enable the same policy across more than 50 plus sites containing millions of unlabeled files and we want to understand and predict that even though its takes time all exsisting unlabeled files will eventually will be labelled. This is very crucial, so please helo us understand this behaviour. Regards, BanuMuraliSolvedUnified Catalog Self-serve analytics integration
I'm hoping someone has gone through the process of setting up the Self-serve analytics in the Unified Catalog settings to push the Unified Catalog information down to a Fabric Lakehouse. I created a Workspace, and then created a lakehouse in this workspace, and created a folder under the files section in the lakehouse. I used the MSI that is shown in Purview when you configure the storage for the connection and granted it contriubutor access to the Workspace. I then went into Purview, settings for Unified Catalog, and in the solution integrations, set up Fabric storage and provided the URL to the File folder I set up on the lakehouse. I tested the connection and it tested successfully. When I set up the scheduler to run, I received the following: The blacked out is the Workspace ID. I'm trying to understand what I'm missing, I'm assuming write permissions are missing somewhere, but I'm not sure. Any assistance is appreciated.Solved134Views0likes4CommentsSentinel RBAC in the Unified portal: who has activated Unified RBAC, and how did it go?
Following the RSAC 2026 announcements last month, I have been working through the full permission picture for the Unified portal and wanted to open a discussion here given how much has shifted in a short period. A quick framing of where things stand. The baseline is still that Azure RBAC carries across for Sentinel SIEM access when you onboard, no changes required. But there are now two significant additions in public preview: Unified RBAC for Sentinel SIEM itself (extending the Defender Unified RBAC model to cover Sentinel directly), and a new Defender-native GDAP model for non-CSP organisations managing delegated access across tenants. The GDAP piece in particular is worth discussing carefully, because I want to be precise about what has and has not changed. The existing limitation from Microsoft's onboarding documentation, that GDAP with Azure Lighthouse is not supported for Sentinel data in the Defender portal, has not changed. What is new is a separate, Defender-portal-native GDAP mechanism announced at RSAC, which is a different thing. These are not the same capability. If you were using Entra B2B as the interim path based on earlier guidance, that guidance was correct and that path remains the generally available option today. A few things I would genuinely like to hear from practitioners: For those who have activated Unified RBAC for a Sentinel workspace in the Defender portal: what did the migration from Azure RBAC roles look like in practice? Did the import function bring roles across cleanly, or did you find gaps particularly around custom roles? For environments using Playbook Operator, Automation Contributor, or Workbook Contributor role assignments: how are you handling the fact those three roles are not yet in Unified RBAC and still require Azure portal management? Is the dual-management posture creating operational friction? For MSSPs evaluating the new Defender-native GDAP model against their existing Entra B2B setup: what factors are driving the decision either way at your scale? Writing this up as Part 3 of the migration series and the community experience here is directly useful for making sure the practitioner angle is grounded.Solved
How to identify users handling SITs before purchasing Microsoft Purview licenses?
Posting this on behalf of a customer we are currently advising as a Microsoft Partner. The customer is in the evaluation stage of Microsoft Purview and has raised a licensing concern that we would like the community's guidance on. CUSTOMER'S CONCERN Purview licenses are user-based, meaning every user who directly or indirectly benefits from the service needs to be licensed. However, to determine which users actually handle sensitive data (and therefore require a license), tools like Content Explorer and Activity Explorer are needed — both of which require an E5 or equivalent license to access in the first place. This creates a chicken-and-egg problem for the customer: They need Purview to identify who handles sensitive data, but they need to know who handles sensitive data to decide how many Purview licenses to buy. QUESTIONS ON BEHALF OF THE CUSTOMER 1. Is there an official Microsoft-supported mechanism or tool that allows customers to assess their SIT exposure and identify affected users before committing to a full Purview license purchase? 2. Is it viable for the customer to purchase a single license (1 qty) assigned to an admin account to perform a tenant-wide scoping and discovery exercise — and would that single license provide sufficient access to identify all users handling SITs across the tenant? 3. If the 90-day Purview E5 trial is the recommended path, does Content Explorer automatically scan and surface SIT matches across all users in the tenant without requiring any pre-configured DLP policies or sensitivity labels to be set up first? As a partner, we want to ensure we are guiding our customer toward the correct pre-purchase assessment approach before recommending a licensing SKU and quantity. Any guidance from the community or Microsoft would be greatly appreciated.SolvedPurview Graph API
Hello. I'm trying to find information on the Purview Graph API and it's endpoints. It looks like the endpoints aren't posted publicly and are listed within an admin console. Can someone help me with how to view the endpoints? Also, are the graph API endpoints capable of reading and creating assets into Purview?Solved151Views0likes1Comment
Events
Learn more about Microsoft Entra Tenant Governance – a built-in solution that helps bring an organization’s tenants under control, reduce shadow-tenant risk, and manage tenant configuration at scale....
Tuesday, Sep 15, 2026, 09:00 AM PDTOnline
1like
2Attendees
0Comments