Microsoft Defender for Cloud Apps SaaS Security AMA

A particular instance is, might be, where I deal with a client and their organisation might hold 1Peta-byte of data, and there is limited tagging/classification or labelling, SPO is not in use. The organisation are running a hybrid model running apps and data on premises and in Azure. Let's say that the initial budget will influence the mechanism for first of all cleansing the data. Let's say as the data architect in this instance, considers a mass data move, onto Azure and let's leave the apps for this discussion. As being a data driven organisation is key for this organisation. The Apps can wait. Some data is actually static - so there is this to consider too. In order to start classifying the data, labelling the data - what would be the first part of the strategy. The data is highly secure and if leaked onto the public domain would be catastrophic, not from a PCIDSS perspective, more from a personal security issue. In this instance, Blobs and containers won't suffice, given the mass data farm moves required from off premises DC's to Azure. How can this be managed well, would Azure Fuel Sync be adequate, it's difficult to understand, due to the options available, which options fit the clients needs, to get the basics right, to then set the security wrappers to ensure best practices are adopted.