rss.livelink.threads-in-node

Purview DSPM navigation difficulty

dsudip1 — Sat, 08 Aug 2026 05:37:40 GMT

Purview DSPM show many stats which are difficult to relate. Even supporting data are often partial. For e.g. Unprotected Asset, Unlabeled Asset, Classified unlabeled. If Unprotected asset is combination of labelled+unlabelled+classified+unclassified all types? While showing count of unprotected asset, why the scope or denominator is not shown. So many categories are pretty confusing and the stats never tally as scope considered, logic considered are often different which is not clearly articulated. I see Sensitivity label coverage is 100% but at the same time it also shows unlabeled sensitive Assets.

Labeling issue in Outlook

Franziska — Fri, 07 Aug 2026 07:10:56 GMT

Hello everyone,

I implemented labels in Purview and applied labeling policies in Outlook. The policy enforces the labeling of mails.

This issue is now that the mails have dynamic signatures that are being applied by a code, the process here is as follows: Mail with the attached code is sent to "CodeTwo" via a connector, the dynamic signature gets applied, the mail comes back via the connector and is being sent out.

Since the labels uses encryption, the code also gets encrypted and cannot be read, thus the dynamic signature is not being applied to the mail.

Has anyone experienced something similar?

Microsoft purview exchange online DLP duplicate events and alerts

Afsar_Shariff — Wed, 05 Aug 2026 18:22:29 GMT

Hello Everyone,

We have Microsoft purview DLP policy for exchange online, We dont have any other exchange policy apart from this. there are three rules High (51- Any), Medium (10-50), Low( 2-9). Whenever any rule matches there are two events in activity explorer and alerts getting generated. Does anybody has encountered this issue?

Kindly provide the feedback. Thank you.

Insider Risk Level not being correctly picked up by DLP

RICSEC — Wed, 05 Aug 2026 09:28:10 GMT

I have two users currently with assigned Insider Risk levels, one elevated and one minor. I have taken the templated DLP policy (DSPM for AI - Block sensitive info from AI sites) which looks for sensitive information being pasted to generative AI sites, and applies a block if the user is an elevated risk user, and a block with override for a moderate/minor risk user (this was audit only originally).

For each advanced DLP rule within that policy, I have a separate policy tip which shows so I know which Advanced DLP rule has been hit.

However, I'm having some discrepancies with the correct insider risk level being identified by Purview and therefore the wrong advanced DLP rule is being applied.

Testing examples:

Logged into a Windows 11 PC with the account, and using Medium confidence UK NINO's I try pasting the content into ChatGPT:

Elevated risk user: Block with Override
Minor Risk user: Block with Override

If I try the exact same scenario on a different PC, I can sometimes get to the point where even though its the same set of data, Purview allows me to paste it at after checking the data. Or in another scenario, I was getting both users hitting the "elevated risk" advanced DLP rule.

The Devices are all showing as up to date sync wise with DLP policies, and the policy itself is showing as fully synced.

Assigned insider risk levels:

DLP Rules:

Elevated:

Moderate/Minor:

Purview Endpoint DLP "Turn on Device onboarding" Query

Afsar_Shariff — Mon, 03 Aug 2026 19:31:23 GMT

Hello Microsoft Community,

We are planning to enable device onboarding in Microsoft Purview as a prerequisite for deploying Microsoft Purview Endpoint DLP.

Our environment uses CrowdStrike Falcon as the primary antivirus/EDR solution. However, we have identified a significant number of Windows 11 devices where Microsoft Defender Antivirus is currently reporting: AMRunningMode : Normal

This is occurring even though CrowdStrike is installed and is expected to be the primary antivirus provider. Our understanding is that, when a supported third-party antivirus such as CrowdStrike is correctly registered with Windows Security Center, Microsoft Defender Antivirus should normally operate in Passive mode after the device is onboarded to Microsoft Defender for Endpoint.

We are investigating why these devices are showing Normal mode. One suspicion is that there may have been an incomplete or unsuccessful Microsoft Defender for Endpoint deployment in the past, or an issue with CrowdStrike registration, Windows Security Center, Defender policies, or the existing MDE onboarding state.

We would like clarification on the impact of enabling Purview device onboarding in this situation.

Environment

Windows 11 devices
CrowdStrike Falcon is intended to be the primary antivirus/EDR
Microsoft Purview Endpoint DLP is planned
Device onboarding has not yet been broadly enabled through Purview
Some devices report Microsoft Defender Antivirus in Passive mode
Large number of devices report Microsoft Defender Antivirus in Normal mode
We are separately troubleshooting the Normal-mode devices

Questions

Does enabling Turn on device onboarding in the Microsoft Purview portal make any immediate configuration change to Windows devices, or is it only a tenant-side setting until the onboarding package is deployed?
After “Turn on device onboarding” When the Purview onboarding package/script is deployed when the device is in “Normal mode”, does it modify the Microsoft Defender Antivirus operating mode?
Is there any risk of performance degradation, duplicate file scanning, application impact, or antivirus conflict on devices where:
- CrowdStrike is active, and
- Microsoft Defender Antivirus is also reporting Normal mode? If we enable device onboarding?

We are mainly trying to determine whether Purview device onboarding itself introduces any negative impact, as there is a pre-existing condition where both CrowdStrike and Microsoft Defender Antivirus may be operating actively.

Thank you.

Microsoft Purview Data Map Sensitivity Labelling

sashakorniakUK — Mon, 03 Aug 2026 14:57:42 GMT

I'm testing the new Microsoft Purview Data Map Sensitivity Labelling capability against Azure SQL and have a question about the relationship between Data Map classifications and Information Protection auto-labelling.

My goal is to automatically apply a sensitivity label such as PERSONAL DATA to Data Map assets and columns when PII is detected.

Examples of the PII classifications I'm interested in include:

All Full Names
Email Address
Date of Birth
Ethnic Group
Person Age
Person Gender
Personal IP Address
UK Driving Licence Number
UK Electoral Roll Number
UK NHS Number
UK Passport Number
UK UTR
National Insurance Number
Payment Card Number
Other common personal identifiers

From my testing, it appears that Data Map classifications and Microsoft Purview Information Protection auto-labelling use different detection engines and different supported rule sets.

For example:

Data detected	Data Map classification	Can directly trigger the Data Map Sensitivity Label?
Full Name	Yes	No
Date of Birth	Yes, or detected through schema and context	No
Email Address	Yes	Not available in my tenant's rule picker
National Insurance Number	Yes	Yes
UK Passport Number	Yes	Yes
Payment Card Number	Yes	Yes

This suggests that Purview can classify many types of personal data during scanning, but only a subset of those classifications are available as conditions in the Data Map auto-labelling policy.

My questions are:

Is this the expected behaviour, or am I missing additional configuration?
Is there a published mapping between Data Map classifications and the supported Sensitive Information Types (SITs) that can trigger Data Map sensitivity labels?
Can custom Sensitive Information Types be used for Data Map auto-labelling, or are only Microsoft prebuilt SITs supported?
Is there a roadmap for supporting classifications such as All Full Names, Date of Birth, Email Address, Person Age, Person Gender and similar PII as auto-labelling triggers?
How are other organisations implementing a consistent PII handling model when many common personal-data classifications cannot currently trigger a Data Map sensitivity label?

At present, my understanding is that the practical approach is:

Use supported auto-labelling for eligible identifiers, such as National Insurance numbers and passport numbers.
For classifications that cannot trigger a sensitivity label, such as Full Name or Date of Birth, use governance metadata such as custom attributes, glossary terms or Critical Data Elements (CDEs), together with governance policies and access controls.

I'd be interested to hear how others are implementing this in enterprise Purview environments and whether there are any recommended patterns from the Microsoft product team.

Purview SDK

NikiZheng — Wed, 29 Jul 2026 14:48:50 GMT

I've been spending quite a bit of time working with Purview APIs, The APIs themselves are fine, but after a while I realized I was writing the same authentication, pagination and relationship handling code over and over again.

So instead of construction the same code from project to project, I turned it into a python package, and now it's available on PyPI

pip install purview-unified-sdk

Right now, the SDK supports most of the common operations, such as creating, retrieving, updating and deleting business domains, data products, glossary terms, objectives, key results and etc.,

It also make it much easier to work with relationships, add group id as a owner, navigate resources and retrieve metadata across the unified catalog.

https://niki9001.github.io/purview-unified-sdk/

https://github.com/purview-unified-sdk

Feel free to fork the project, submit a pull request or open an issue if you have ideas or suggestions

Unified Catalog - Why I Think About Governance Domains Vertically and “Domains of Data” Horizontally

sashakorniakUK — Wed, 29 Jul 2026 13:10:40 GMT

One of the more useful ways I have found to think about Microsoft Purview is to separate ownership from meaning.

For me, that creates two different but connected structures:

Vertical = Ownership

Governance Domains tell us WHO owns and governs the data.

They provide the organisational structure for accountability.

A Governance Domain can contain:

Data Products → Data Assets → Critical Data Elements → Columns and Attributes

It also gives us the governance context around those objects:

Ownership
Stewardship
Accountability
Governance responsibilities
Data quality
Access
Controls

So when I look at a Governance Domain, I am really asking:

Who is responsible for this data?

That is the vertical view.

Horizontal = Meaning

Enterprise Glossary Terms give us a different perspective.

Rather than focusing on who owns the data, they can represent what the data means across the organisation.

This is what I think of as a “Domain of Data”.

I use the phrase “Domain of Data” as a conceptual way of describing an enterprise business concept that can span multiple Governance Domains.

Take Personally Identifiable Information (PII) as a simple example.

PII is unlikely to fit neatly within a single Governance Domain.

It may exist across:

Customer information
Complaints and incidents
HR and work force data
Case management
Regulatory data
Operational systems
Contact information
Financial and administrative processes

Each Governance Domain may own and govern the PII within its own area.

But the concept of PII itself spans all of them.

That is where an Enterprise Glossary Term becomes particularly useful.

It provides a common enterprise definition that cuts horizontally across multiple ownership boundaries.

Why the two structures should not be the same

It can be tempting to make the Enterprise Glossary hierarchy simply mirror the Governance Domain hierarchy.

I think that misses an important opportunity.

They answer different questions.

Governance Domains

WHO owns and governs the data?

They represent:

Ownership
Accountability
Organisational responsibility

Enterprise Glossary Terms

WHAT does the data represent?

They represent:

Business meaning
Shared concepts
Enterprise vocabulary

The two structures should connect, but they should not simply duplicate each other.

One Governance Domain can contain many Domains of Data

A Governance Domain may contain many different business concepts.

For example, one Governance Domain might contain:

PII
Customer Data
Location Data
Financial Data
Operational Data

The Governance Domain is therefore not necessarily a “type of data”.

It is primarily an ownership and governance boundary.

One Domain of Data can cross many Governance Domains

The reverse is equally important.

A single Domain of Data can exist across many Governance Domains.

For example, PII might appear in:

Governance Domain 01 – Customer and contact data
Governance Domain 02 – Complaints and incident data
Governance Domain 03 – Employee and work force data
Governance Domain 04 – Regulatory and operational data

This gives us a many-to-many relationship:

One Governance Domain can contain many Domains of Data.
One Domain of Data can exist across many Governance Domains.

That is the part I think is especially powerful.

Where the two structures intersect

This is where the model becomes much more valuable.

Think about it as:

Governance Domain
WHO owns it?

Enterprise Glossary Term
WHAT does it mean?

Governed Business Context

For example:

HR Governance Domain
PII Enterprise Glossary Term

The result is:

The HR-owned instance of an enterprise-wide PII concept.

That intersection gives us both ownership and meaning.

Why this matters for data consumers

Most data consumers do not necessarily know:

which Governance Domain owns the data;
which platform contains it;
which Data Product it belongs to;
what the database table is called; or
what the individual column names are.

They may simply know the business question they are trying to answer.

For example:

Where do we hold PII?
Which Data Products contain Customer information?
Where is Location information used?
Which Data Assets contain Financial information?

This is where the Enterprise Glossary becomes much more than a list of definitions.

It becomes a business discovery layer.

From business concept to technical data

If the relationships are created properly, a user can begin with a business concept and navigate towards the underlying data.

For example:

Enterprise Glossary Term → Data Products → Data Assets → Critical Data Elements → Columns and Attributes

This creates a bridge between:

Business meaning ↔ Technical implementation

That is a much more useful experience than expecting users to understand the technical structure of the data estate before they can discover anything.

Enterprise terms, local terms and CDEs

There is also an important distinction between the different types of business metadata.

Enterprise Glossary Terms

These should represent concepts that have meaning across multiple Governance Domains.

Examples might include:

PII
Customer
Organisation
Location
Financial Information

These provide the horizontal enterprise view.

Local Glossary Terms

These are better suited to terminology that is specific to:

a Governance Domain;
a business area;
a Data Product; or
a specialised process.

They provide local business context without forcing every term into the enterprise vocabulary.

Critical Data Elements

CDEs are different again.

A Domain of Data may represent a broad business concept such as PII, while CDEs represent individual important data elements such as:

Email Address
Date of Birth
Customer Identifier
Postcode

That gives us another useful relationship:

Enterprise Glossary Term: PII → Critical Data Element: Email Address → Physical Column: customer_email

Now the business concept is connected directly to the technical implementation.

The principle I keep coming back to

The value is not in creating as many glossary terms as possible.

It is in applying:

The right term → at the right level → connected to the right data

That means asking:

Is this genuinely an enterprise-wide concept?
Should this be local to one Governance Domain?
Is this actually a Critical Data Element?
What Data Products and Data Assets should it connect to?

The quality of those relationships matters far more than the volume of metadata.

The bigger picture

This is ultimately why I think the horizontal and vertical model is useful.

Vertical = Ownership

Governance Domains tell us WHO owns and governs the data.

Horizontal = Meaning

Enterprise Glossary Terms tell us WHAT the data represents across the organisation.

And where they intersect:

Ownership + Meaning = Governed Business Context

That is what allows Microsoft Purview to move beyond simply listing technical assets.

Instead, it starts to create a connected view of:

Ownership → Business Meaning → Discovery → Governance

across the enterprise data estate.

For me, that is where the real value of the catalogue starts to appear.

Microsoft Fabric metadata in Microsoft Purview

sashakorniakUK — Tue, 28 Jul 2026 07:18:33 GMT

I’ve been mapping how Microsoft Fabric metadata is surfaced in Microsoft Purview through Data Map scanning, and I’ve created this visual to make the relationship easier to understand.

The diagram separates:

Documented mappings – such as Fabric items, Lakehouse tables, schema and item-level lineage.

Metadata known to be scanned, but where the exact Purview UI location needs confirmation.
? Areas still needing validation – particularly Lakehouse table/column descriptions and tags.

The principle I’m exploring is:

Microsoft Fabric → Purview Data Map Scan → Purview Data Asset → Purview governance enrichment

Importantly, a Fabric asset does not automatically become a Purview Data Product. It is first represented as a Data Asset, which can then be governed, enriched and associated with a Data Product.

I’d really appreciate feedback from anyone working hands-on with Microsoft Fabric and Microsoft Purview:

Does this mapping match what you are seeing in your environment?

I’m particularly interested in confirming:

Lakehouse table descriptions → Purview Asset Description?
Lakehouse column descriptions → Purview Schema → Column Description?
Lakehouse table/column tags → where exactly are these surfaced in Purview?

Corrections, screenshots or practical experience would be very welcome.

Does this Unity Catalog → Purview guidance make sense?

sashakorniakUK — Mon, 27 Jul 2026 08:25:08 GMT

I’ve been working through how Azure Databricks Unity Catalog metadata surfaces in Microsoft Purview after a scan, and I’ve created the attached visual to make the relationship easier to understand.

The principle I’m trying to communicate is simple:

Maintain Databricks-native technical metadata in Unity Catalog → scan supported metadata into Microsoft Purview → use Purview for the wider enterprise governance, discovery and business context.

The short guidance accompanying the visual would be:

In Azure Databricks:

Navigate to Catalog Explorer → Catalogue → Schema → Table/View. From here, maintain metadata such as table comments, column comments and Unity Catalog tags. Some comments can also be AI-generated as a starting point and reviewed before saving.

After the Microsoft Purview scan:

Find the corresponding Data Asset in Purview and review the surfaced metadata:

Table Comment → Data Asset → Description

Column Comment → Data Asset → Schema → Column Description

Table Tag → Data Asset → Properties → Tags

Column Tag → Data Asset → Schema → Tags

Column Name / Data Type → Data Asset → Schema

Table/View and Column Lineage → Data Asset → Lineage, subject to the relevant prerequisites.

The distinction I’m trying to reinforce is that this is not Purview vs Unity Catalog, and it is not about manually duplicating technical metadata.

Unity Catalog remains the Databricks-native governance and technical metadata layer, while Purview can consume supported metadata through scanning and place it into the wider enterprise governance context.

I’d be interested in feedback from people implementing Purview + Azure Databricks Unity Catalog:

Does the visual and navigation guidance make the relationship clear?

In particular, are the field mappings and terminology intuitive enough for Data Engineers, Data Stewards and Data Owners, or is there anything you would simplify, rename or clarify?

Microsoft Purview, Databricks Unity Catalog and Medallion Architecture

sashakorniakUK — Mon, 27 Jul 2026 08:14:09 GMT

Microsoft Purview, Databricks Unity Catalog and Medallion Architecture three different responsibilities, one governed data ecosystem.

I created this visual because these concepts are often mixed together.

🔵 Microsoft Purview = Enterprise Data Governance & Discovery

Purview provides the enterprise-wide governance layer across Databricks and other platforms — Governance Domains, Data Products, glossary, Critical Data Elements, ownership, stewardship, metadata, data quality and discovery.

🔴 Databricks Unity Catalog = Databricks Data & AI Governance + Access Control

Unity Catalog is not simply an access-management tool. It governs Databricks data and AI assets, including catalogs, schemas, tables, permissions, technical metadata, lineage, auditing and discovery.

🥉🥈🥇 Medallion = Data Engineering

Bronze → Silver → Gold describes how data is progressively refined.

It is not a governance hierarchy.

That distinction is important:

Governance Domains answer:

👉 Who owns and governs the data?

Bronze / Silver / Gold answer:

👉 What stage of engineering and refinement is the data in?

And Gold does not automatically equal Data Product.

My preferred enterprise model is therefore:

Purview → Enterprise Governance & Discovery

Unity Catalog → Databricks Governance & Access

Medallion → Data Engineering & Refinement

The goal isn't Purview vs Unity Catalog.

It is clearly defining which platform is authoritative for which responsibility and connecting the metadata and lineage into a coherent governance model.

The distinction between governance domains (who owns the data) and Medallion layers (what stage of refinement) is one that trips up many implementation teams. In practice, when Microsoft Fabric is the analytics platform, Purview becomes the authoritative governance layer across both Fabric OneLake and Databricks, with Unity Catalog handling Databricks-internal access. Connecting lineage metadata across both is what creates a truly coherent governance model.

Data Product Lineage not automatic

davidfombella — Fri, 24 Jul 2026 09:29:46 GMT

Hi all i am new in Purview and I am trying to create a lineage with a Report--> Dataset--> Tables in Data Products however after adding report only dataset is shown, how can I view all tables of this dataset.

Only when I press open in fabric the Dataset the table list appears, how can I give permissions

Azure Databricks Unity Catalog connector - Metadata

sashakorniakUK — Tue, 21 Jul 2026 11:21:47 GMT

For the Azure Databricks Unity Catalog connector, I believe Microsoft Purview scans and collects the following technical metadata:

Table name
View name
Column names
Catalog name
Schema name
Metastore information
Table and column descriptions from Databricks comments
Unity Catalog tags, which are stored within Purview properties
Table, view and column lineage where supported

Storage location information may also appear within the technical properties of the asset, depending on the Databricks object. However, Microsoft does not appear to clearly document storage location as guaranteed metadata from every scan.

Can anybody explain this further or confirm whether they have seen different behaviour?

Where the metadata is stored or managed in Azure Databricks

Metadata collected by Microsoft Purview

Where it is stored or managed in Azure Databricks

Metastore

Unity Catalog Metastore

Catalog name

Unity Catalog

Schema name

Unity Catalog Schema

Table name

Unity Catalog Table metadata

View name

Unity Catalog View metadata

Column names

Table schema in Unity Catalog

Table description

Unity Catalog Table Comment

Column description

Unity Catalog Column Comment

Unity Catalog tags

Tags applied to Unity Catalog objects such as tables, views and columns

Table and column lineage

Unity Catalog lineage metadata and system lineage tables

Storage location

Table metadata where applicable, particularly for external tables

I believe table and column descriptions are stored in Databricks as comments against the Unity Catalog object.

These comments can then be scanned into Microsoft Purview and displayed as descriptions.

The Microsoft documentation appears clearer for column comments than it does for table comments, so I am planning to test this myself.

Does anybody have practical experience of this behaviour?

Unity Catalog tags

Tags are stored as metadata against Unity Catalog securable objects.

Tag information can also be queried through Unity Catalog INFORMATION_SCHEMA, including TABLE_TAGS and the corresponding column tag metadata.

The core Unity Catalog structure is:

Unity Catalog Metastore
Catalog
Schema
Table or View
Columns

Additional metadata can include:

Comments
Tags
Lineage
Storage location where applicable

What Microsoft currently documents as collected by the Microsoft Purview Azure Databricks Unity Catalog connector

Databricks Unity Catalog metadata

Collected into Purview?

Notes

Metastore

Yes

Represented in the Purview hierarchy

Catalog name

Yes

Unity Catalog catalog

Schema name

Yes

Unity Catalog schema

Table name

Yes

Creates/discovers the table data asset

View name

Yes

Views are supported

Column names

Yes

Schema/column metadata is collected

Table comment / description

Yes

Your observation is correct: Databricks table comments/descriptions can appear as the Purview Data Asset description

Column comments / descriptions

Yes

Microsoft explicitly states that Databricks column comments are displayed as column descriptions in Purview

Unity Catalog tags

Yes

Microsoft explicitly states that Unity Catalog tags are scanned into Purview Properties

Table/view lineage

Yes, subject to prerequisites

Extracted from Unity Catalog system lineage tables

Column lineage

Yes, subject to prerequisites

Supported, although there are lineage limitations

External tables

Metadata yes

External table metadata is supported; lineage for external tables is not supported

Microsoft's connector documentation currently lists the following core hierarchy and metadata as being extracted by the scan:

Metastore
Catalogs
Schemas
Tables and Columns
Views and Columns
Unity Catalog Tags

Data Asset descriptions

This behaviour appears to be genuine.

Microsoft specifically documents that a Databricks column comment can be used as the description displayed in Microsoft Purview.

Microsoft also notes that setting a Databricks table column comment to an empty string prevents the column description from being displayed in Purview.

For practical purposes, the relationship is:

Databricks comment or description
Purview scan
Microsoft Purview description

This is explicitly documented for column comments.

Table comments also appear to be surfaced as the Data Asset description through the connector, based on observed behaviour, although Microsoft's documentation is less explicit about this.

Has anybody seen this working consistently for table descriptions?

Unity Catalog tags

Unity Catalog tags are supported by the current connector.

Microsoft documentation states that tags from Unity Catalog are extracted during scanning and displayed within Microsoft Purview Properties.

There is a documented exception where tags are not supported when the scan uses the Kubernetes Self-hosted Integration Runtime option.

That exception should not apply where Kubernetes SHIR is not being used.

Storage location

The official connector documentation clearly documents the Unity Catalog hierarchy and the metadata listed above. However, it does not appear to explicitly list the table storage location or storage path as a guaranteed metadata element within the supported metadata capabilities. Storage location information may therefore appear for some Databricks objects, particularly external tables, but I would not currently treat it as guaranteed metadata from every Purview Unity Catalog scan without further testing.

My current understanding is that a Microsoft Purview scan of Azure Databricks Unity Catalog can collect:

Metastore

Catalog

Schema

Table

View

Columns

Table descriptions or comments

Column descriptions or comments

Unity Catalog tags

Table and view lineage where supported

Column lineage where supported

External table metadata

Storage location may also be visible where applicable, but this appears less clearly documented as a guaranteed field? Does this sound correct based on other people's experience of Microsoft Purview scans of Azure Databricks Unity Catalog data sources?

How can we identify the size of a Microsoft Purview DLP policy and individual DLP rules?

Afsar_Shariff — Mon, 20 Jul 2026 19:38:29 GMT

Hello Microsoft Community,

According to the Microsoft Purview DLP policy reference, the following platform limits apply:

Maximum size of a DLP policy: 100 KB
Maximum size of an individual DLP rule: 100 KB or 102,400 characters
Maximum number of rules within a policy: Limited by the overall policy size

I would like to understand how these limits are calculated and how administrators can monitor the current size of an existing DLP policy or rule.

Could someone please clarify the following?

What exactly is included when calculating the 100 KB DLP policy size?
Does the policy size include only policy-level configuration, such as locations, users, groups, administrative units, inclusions and exclusions, or does it also include the combined definitions of all rules associated with the policy?
What exactly is included in the 100 KB individual rule size?
- Sensitive information types and their GUIDs
- Condition groups
- Instance-count and confidence-level configurations
- Exceptions
- Endpoint DLP restrictions
- User notifications and policy-tip messages
- Override options
- Alert and incident-report settings
- Recipient lists
- Advanced rule configuration
For example, does it include:
The documentation describes the rule limit as “100 KB (102,400 characters).” Is the limit based on:
- The number of characters
- The UTF-8 or Unicode byte size
- The serialized JSON/XML representation
- An internally generated policy payload
Is there a supported method in the Microsoft Purview portal, Security & Compliance PowerShell, Microsoft Graph, or another API to display the current size of:
- A DLP policy
- Each DLP rule
- The remaining available policy capacity
Can the size be estimated by exporting the output from Get-DlpCompliancePolicy and Get-DlpComplianceRule? If so, which properties should be included in the calculation, and what encoding or serialization format should be used?
Does the 100 KB policy limit represent the combined size of the policy and all its rules, or are the policy and rule limits evaluated independently?
What error or warning is generated when a policy or rule approaches or exceeds the limit? Is there any notification before the limit is reached?

We are designing global Microsoft Purview DLP policies containing multiple Sensitive Information Types, condition groups and workload-specific rules. We need a reliable method to measure policy and rule sizes during design and ongoing policy governance.

Any official guidance, supported script, API property, or calculation method would be appreciated.

Acessos pastas SharePoint / SharePoint folder access

anderson2510 — Mon, 20 Jul 2026 12:19:38 GMT

É possível identificar somente acessos a pastas do SharePoint? Algumas informações internas da companhia foram vazadas e precisamos saber quem acessou a pastas do Sharepoint onde estavam essas informações. Outra situação, é que conseguimos identificar que nessa mesma pasta alguns arquivos foram baixados, mas no relatório o usuário aparece "app@sharepoint". Alguém saberia explicar?

It is possible to identify access to SharePoint folders? Some of the company's international information was leaked, and we need to know who accessed the SharePoint folders containing that data. Another issue is that we identified files being downloaded from that same folder, but the user appears as "app@sharepoint". Could anyone explain this?

Purview archive shipped. Delete policy is still armed.

Navan05 — Thu, 16 Jul 2026 16:20:42 GMT

Roadmap 561208 went GA over the last few weeks with very little noise. Purview retention policies in Data Lifecycle Management can now move inactive OneDrive and SharePoint content into Microsoft 365 Archive.

The framing is storage cost. I want to talk about something else, because I think there's a gap here that's going to catch people out, and I'd like to know whether anyone else is seeing it.

Archive is a storage tier. It is not a retention state. An archived SharePoint site stays fully in scope of every retention policy that applied to it while it was active. Nothing about archiving protects content.

Now layer that onto conflict resolution. Retention beats deletion, so a site policy set to delete after 2 years goes dormant while a label is retaining the item. Dormant, not cancelled.

So picture this:

A file carries a retention label with a 4-year retention period.
The site it lives on has a delete-after-2-years retention policy.
The label's end-of-retention action is deactivate retention settings.

For four years, everything looks correct. The label holds. The delete policy sits there doing nothing.

Then the label reaches end of retention and deactivates.

The shield is gone. The delete instruction wakes up, unopposed, two years overdue, and the file goes. Not to archive. Just gone.

The reflex here is "explicit wins over implicit." It doesn't apply. That principle only arbitrates between competing delete actions. A label that expires with no delete action of its own brings nothing to the contest. There is no explicit action to outrank the policy with.

"Do nothing" sounds like a safe default. It's actually a decision to stop defending the file.

Right now you cannot set a label to archive at end of retention. The options are deactivate, delete automatically, disposition review, or hand it to a Power Automate flow. Archive isn't on the list.

Microsoft shipped archive at the policy level and left the label level to flows and webhooks. That reads to me like they know the gap exists and haven't decided how to close it.

And here's my suspicion about why this shipped now. Archived content is excluded from Copilot indexing. That's Microsoft's own framing in the message center post. Which suggests this feature is going to evolve on Copilot's roadmap rather than records management's. The moment "archive" becomes the button you press to clean up Copilot's answers, people will press it constantly, at scale, without once checking what policy is sitting underneath.

Meanwhile Exchange has nothing. Purview retention still can't move mail into an archive mailbox, and we're all still running MRM tags next to Purview years after being told MRM was legacy.

Has anyone hit the deactivate-into-delete scenario in a live tenant, or is this still theoretical? And does anyone read the label-level gap differently than I do?

Genuinely open to being told I've got this wrong.

Published Glossary Terms Not Appearing When Editing Microsoft Purview Data Assets

sashakorniakUK — Thu, 16 Jul 2026 13:56:03 GMT

Help and Support for All

Problem

Published glossary terms were not available for selection when editing Data Map assets in Microsoft Purview.

Although the glossary terms had been created and published within Governance Domains, and the user had the appropriate permissions, the Glossary Terms dropdown remained empty. This prevented glossary terms from being assigned to data assets or individual columns.

Symptoms

The following behaviour was observed:

Published glossary terms existed within Governance Domains in the Unified Catalog.
User permissions had been verified and were correctly configured.
The Glossary Terms field was visible when editing a Data Map asset.
The dropdown opened successfully but did not display any available glossary terms.
Glossary terms could not be associated with data assets or columns.

Root Cause

The issue occurred because Asset Curation had not been enabled in Microsoft Purview.

Although glossary terms had been created and published within Governance Domains in the Unified Catalog, the Data Map asset curation experience had not been configured to use Unified Catalog glossary terms.

As a result, the Glossary Terms field was displayed when editing an asset, but no terms were available for selection. Microsoft Purview requires Asset Curation to be enabled and configured before Unified Catalog glossary terms can be assigned to Data Map assets and columns.

Resolution

The following steps resolved the issue:

Confirmed that no Classic Glossaries, Classic Glossary Terms or Term Templates existed in the Purview account.
Enabled Asset Curation (Preview).
Configured Microsoft Purview to use Unified Catalog Glossary Terms.
Completed the Asset Curation configuration wizard.
Edited a Data Map asset and verified that published glossary terms were now displayed.
Successfully assigned glossary terms to both Data Map assets and individual columns.

Because no Classic Glossary content existed, there was no glossary content that required migration.

Outcome

After Asset Curation was enabled and configured, published Unified Catalog glossary terms became available in the Glossary Terms dropdown when editing Data Map assets. Glossary terms could then be successfully assigned to both assets and columns.

Key Takeaway

Creating and publishing glossary terms within Governance Domains is not sufficient on its own.

To use Unified Catalog glossary terms when curating Data Map assets and columns, Asset Curation must also be enabled and configured to use Unified Catalog Glossary Terms.

Missing activity names from Audit Log documentation

underQualifried — Tue, 14 Jul 2026 20:18:31 GMT

We all know that the documentation team is A-tier and amazing at what they do and isn't just copy and pasting marketing materials. But I've noticed that some really obscure functionalities like 'user registered a device' or 'user joined a device' or about half the other things a user can do, are not documented on this list of activity names. The ironically named 'friendly' list doesn't work. So I actually can't audit the unfamiliar devices under our tenants?

It appears that this KB is actually locked down, so more can't be added when they are discovered.

How are we supposed to use the tool Microsoft has forced everyone towards, when the Documentation team is too bad to document anything, so they outsource it to the community (Microsoft victims), but then they lock down contributions (presumably, because they have some metric that keeps them from being useful - atleast based on my interactions with them).

Documentation seems to be a massive fail on Microsoft's part. How did it get this way? Is there a reliable way of finding the activity name - one that ISN'T some preview Graph endpoint that I can't teach my techs to use, because I'm not teaching my techs to program?

Identifying removed Fabric Assets

Ifevadia — Wed, 08 Jul 2026 09:19:43 GMT

Is there any way for a data steward to identify a deleted physical asset ingested from Fabric into Purview. The original asset has been deleted in Fabric and another has been created with the exact same name, both assets now show in the catalogue and there doesn't seem to be a way to distinguish clearly which is the deleted and which is the current.

Struggling with running DQ Scans (Long queuing and Retry Count Error Issues)

lsims — Tue, 07 Jul 2026 06:47:25 GMT

Hi everyone,

I have been exploring Microsoft Purview Data Quality quite extensively. At this point, I have configured more than 4,000 data quality rules across more than 10 Microsoft Fabric capacities, each with a minimum capacity of F16. Fabric is the source for all assets registered in Purview.

I have identified several issues with the product, but the two that are currently impacting me the most are the following:

DQ scans failing with a generic error“Max Retry Count Reached. Ending Workflow. Current Task HandleError”The challenge is that the error message does not identify which rule is causing the failure. As a result, I have to troubleshoot manually by disabling groups of rules, rerunning the scans, and repeating the process until I find the problematic rule. This trial-and-error approach is very time-consuming, especially at this scale.
This seems to be caused by issues in some of the DQ rules, even though all rules are marked as “Good to go” in Purview.
When running Data Quality scans, I often receive the following error:
DQ scans remain queued for a long timeI am not sure why this happens or what resource, orchestration, or scheduling constraint is causing the delay.
Whenever I run these DQ scans, they remain in a Queued state for at least 10 minutes, even when there is nothing running on the Fabric capacities.

Has anyone experienced similar behavior with Purview Data Quality at this scale?

Specifically, I would appreciate any guidance on:

How to identify which DQ rule is causing a scan failure
Why scans remain queued even when Fabric capacity appears to be idle
Whether there are known limitations or best practices for running thousands of DQ rules in Purview

Thank you.