Microsoft Purview is the compliance and data protection layer of Microsoft 365 — sensitivity labels, data loss prevention, retention, eDiscovery, audit, and insider risk. It is the control plane that determines whether your data is actually protected or merely described as protected in a policy document.
Most organizations own Purview and barely use it. Labels exist but are not applied. DLP policies sit in audit mode. Retention is a schedule nobody enforces. The gap between policy and enforcement is exactly what auditors look for — and exactly what Copilot will expose.
The business problem underneath is proof. A policy document states intent; an auditor, a regulator, a board member, or opposing counsel asks for evidence that the control operated on real content, over time. When Purview is only partly configured, that evidence does not exist. In a compliance review, what cannot be demonstrated is treated as not done.
Leaving that gap open carries compounding cost. Over-retained content widens discovery and breach exposure, because data that should have been disposed of is still sitting in mailboxes and sites. Under-retained content creates the opposite exposure, when a record the organization was obliged to keep is gone and no disposition record explains why. DLP left in audit mode means the first person to learn that sensitive data left the tenant may be someone outside it. And once Copilot is switched on, every labelling and permissions gap becomes searchable.
HarjTech implements Purview properly, and starts from obligations and real data flows rather than from tool toggles: a label taxonomy people will use, DLP tuned to real data flows, retention that actually disposes, eDiscovery configured for legal teams, and audit logging that produces evidence on demand. Policies are phased in with measurement before enforcement, exceptions are documented and approved, and ownership is assigned so the controls keep operating after handover. The result is a compliance posture your auditors can verify, the data protection foundation that safe AI deployment stands on, and an operating rhythm — reviews, disposition decisions, and evidence production — that your teams can run without outside help for every request.
You get the same operating model — prime accountability, senior-led delivery, fixed-scope proposals — without the Big Four rate card or the junior-staff lottery. Every engagement is led at the principal level, and the people in your scoping call are the people who do the work.
The second angle is focus. Purview work sits at the intersection of compliance, legal, security, and user behaviour, and generalist firms tend to treat it as a configuration task. We treat it as a control program: obligations first, data flows second, tool configuration third, and ownership and evidence throughout. That ordering is what keeps the controls operating after the consultants leave.
Consider an organization that has already had a Purview deployment that produced policies but no evidence. Expect senior people who will ask about your obligations and your audit history before they open the admin centre, and who will tell you plainly when a control is not worth building. We are deliberately focused on the Microsoft stack. Book a scoping call and judge the difference yourself.
DLP is configured around your real data: sensitive information types, the locations that matter (SharePoint, OneDrive, Teams, Exchange, endpoints), and policies tuned to reduce false positives. We start in audit mode to measure impact, then enforce — with exceptions documented and approved.
The second angle is behavioural: DLP fails when it becomes something staff work around. A policy that blocks ordinary sharing teaches people to move files to personal accounts or unsanctioned tools, which is worse than the original risk. Tuning is therefore treated as the core work, not a finishing touch — reviewing what audit mode actually caught, separating genuine risk from everyday collaboration, and writing policies that match how teams really share.
Consider a finance analyst who legitimately sends a payroll file to an external auditor, or a project team sharing designs with a joint-venture partner. Both look like exfiltration to a blunt policy. Expect us to walk through those flows with the teams involved, confirm which ones are legitimate, and document approved exceptions before enforcement is switched on. DLP that blocks everything gets bypassed; DLP that blocks nothing is decoration. The tuning is the work. Book a scoping call to assess your DLP coverage.
Many organizations own Purview but barely use it: labels exist but are not applied, DLP policies are in audit mode, retention is a schedule nobody enforces. We implement Purview properly — a label taxonomy people will use, DLP that blocks, retention that disposes — and the governance to keep it running.
The pattern is common: Purview was switched on during a migration, a few policies were created with default settings, and nobody owned it after that. The fix starts with an honest baseline — what is configured, what is in audit mode, what has never been touched — measured against your obligations, rather than a rebuild of everything at once.
Consider the scenario that usually triggers the call: an audit is scheduled, or a Copilot pilot is planned, and someone asks whether sensitive data is protected. No policy document answers that question. It needs label coverage, DLP enforcement, retention evidence, and audit logs. Expect a phased engagement — baseline first, then label and DLP work, then retention and eDiscovery, each with evidence for an auditor. The result is protection that holds up in an audit and underpins safe AI deployment. Book a scoping call to assess your Purview posture.
Purview audit logging is the evidence layer: who accessed what, who changed what, when. We configure audit retention and monitoring so the evidence exists when you need it — for incident response, for compliance, and for audits.
The second angle is retention of the evidence itself. Audit records are only useful if they still exist when the question is asked, and the default retention window is shorter than the timeline of many investigations and audits. Configuring audit retention deliberately — aligned to your obligations and to how long incidents actually take to surface — is what turns logging from a checkbox into evidence.
Consider a security incident discovered weeks after it began, or an auditor asking for access records from a prior quarter. If audit retention was never extended and nobody was reviewing the logs, the answer is a gap rather than a record. Expect us to configure retention, confirm which activities are logged, and set up a review routine so anomalies are noticed in the normal course of work, not only after an incident. Audit logging that nobody configured is the gap auditors find most often. Book a scoping call to check your audit coverage.
Yes — structured transitions are one of our most common engagement starts. We assess the current state, document what exists, stabilize what is fragile, and give you an honest read on what is worth keeping. No rip-and-replace unless rip-and-replace is actually warranted.
The second angle is continuity: a transition should not create a gap in protection while the new provider gets up to speed. That means the first work is inventory and stabilization — confirming which policies are enforcing, which are in audit mode, which labels are applied, and where retention or audit coverage has holes — before any redesign begins.
Consider a compliance team mid-way through an audit cycle, or an organization whose previous provider documented little. Expect a documented baseline, a stabilisation pass on the fragile controls, and a candid recommendation on what to keep, what to retune, and what to rebuild. Book a scoping call to discuss your transition.
Yes. Diagnostics and assessments are fixed-scope — you know the deliverables and timeline before we start. Implementation packs are fixed-scope with phased deliverables, so budget never drifts silently. Managed services run on a defined monthly arrangement.
The second angle is phasing by risk. A Purview program does not have to be delivered as one large project: a diagnostic and baseline can stand alone, label and DLP work can follow as its own phase, and retention and eDiscovery can be sequenced after that. Each phase closes with evidence — a baseline report, a label taxonomy, enforced policies, a disposition record — so the organization can pause or continue with something concrete in hand.
Expect the scoping call to establish which phase matches your situation, and what each phase would deliver. Investment is confirmed on the scoping call, after we understand your compliance obligations and estate. We do not publish prices, because the same engagement costs different amounts depending on scope and complexity.
Retention labels, disposition review, and records handling are configured so the retention schedule is enforced by the platform, not by memory. Content is retained for its required period, then disposed of with review where the obligation demands it.
The second angle is that retention is as much about disposal as it is about keeping. Keeping everything indefinitely feels safe, but it inflates discovery scope, breach exposure, and storage, and it leaves the organization unable to explain why content that should have been disposed of is still present. A defensible retention program disposes on schedule and keeps the record of the disposal.
Consider a records manager facing an audit of financial or HR records, or a legal team that needs to show a litigation hold was honoured while routine disposition continued elsewhere. Expect the engagement to map each record type to its obligation, translate that into retention labels and disposition review steps, and produce evidence that the schedule operated. This is one of the first things auditors examine — and one of the most commonly missed. Book a scoping call to review your retention coverage.
A working session, not a sales pitch. We map your current Purview state — labels, DLP, retention, audit — against your obligations and your AI plans, then define the outcome you are buying and the fastest path to it. You leave with a clear point of view on your situation, whether or not we work together.
The second angle is that the call is diagnostic, not generic. We come with questions about your obligations, your data types, your existing policies, and your Copilot timeline, because the right Purview program for a regulated organization with a Copilot pilot is materially different from the right program for an organization whose main exposure is client data shared through Teams.
Expect to walk through your current configuration, your audit or regulatory drivers, and the outcomes that would make the engagement worthwhile — for example, an auditor-ready evidence pack, enforced DLP on the highest-risk data flows, or a label taxonomy staff will actually use. If there is a fit, a fixed-scope proposal follows within days. Book a scoping call and see for yourself.