Guess what we're baaaaaack. December/January are rough here in Cleveland, man. But, I've got some updates pushed out for the Purview SIT Email Scanner Tool that you might want to check out 🙂 Shout out to Emily Spotts for her collaboration on this one. What was
AI is transforming industries worldwide, but it’s simultaneously creating one of the largest data risks we've ever seen. According to the Varonis 2025 State of Data Security Report, 95% of healthcare organizations have exposed sensitive cloud data, and 64% have employees using unverified AI tools. The same
Found this nugget buried in the Purview Blueprints Github repo. Figured I'd take a crack at integrating credential SITs into my EXO SIT Finder. The "All Credentials" Bundled SIT is multitudinous and complex, as you can see in the linked Learn Doc below. Current SITs being
This post is a continuation of a series. See part 1, here. Most enterprises already live in dual worlds. On one side, Microsoft Purview governs information inside Microsoft 365. But on the other, dedicated DLP platforms like Digital Guardian DLP control endpoints, networks, and file movement. So what's
As a consultant in the Microsoft Security & Compliance space, you learn that some projects are more like therapy sessions. Half the organization wants to migrate to Microsoft, and the other half, clutching their Varonis or Symantec licenses, waits in the shadows for their "I told you so"
I didn't have much of a following when I initially wrote about SIT-search limitations in mailbox data-at-rest. Since then, I've spoken with multiple clients and data security professionals who were under the mistaken impression that Purview could find that data. Since this limitation still exists, and
One of the lesser-known (and dare I say "quietly devastating") mechanics in Microsoft Purview Insider Risk Management (IRM) is how Collection Policies silently override your IRM policy logic. They don't cooperate and they especially don't warn you. If there's a conflict, the
I've been getting a lot of questions lately in follow-up to my 99% DLP policy post. I followed your advice and have this nifty DLP Policy broken into three rules. How on earth do I sort through all of the Activity Explorer hits and tune this thing? Well,
Turning on DSPM for AI’s one-click policies gets your dashboards populated, but it doesn't guarantee prompt and response bodies in Activity Explorer. Without a specific edit, you'll mostly see headers, counts, and detections (not the text you need). "One-click" creates the coverage that
Building Custom SITs is one of the most powerful things you can do for tenant-specific Data Security in Purview. In a previous post, I went over how to do exactly that. But, powerful can also mean dangerous. Enter: Character Proximity I could make this post really short by just saying
It's 7:59 AM, you're not even one cup of coffee deep, and the HR Director is pounding down your door because they're locked out of a critical personnel file...which was encrypted by a terminated employee account you deleted yesterday. Let me show
No DLP solution on the market, including Microsoft Purview, can guarantee 100% detection of sensitive data exfiltration. You could argue that Exact Data Match (EDM) solves the precision problem, but EDM requires exact input formatting, rigid schema alignment, and constant upkeep. Any drift between your real-world identifiers and the uploaded
my reaction when you're back to read another one of my blogs: Mapping the NIST AI Risk Management Framework onto compliance dashboards, DLP rules, policies, etc. is great; don't get me wrong. But, configuring controls isn't always enough. In this case, we need to
Hello again. Rapid AI adoption is really pushing security teams to prove control effectiveness. NIST’s AI Risk Management Framework (AI RMF) offers guidance around this, but you still need reliable tech to actually apply said guidance. I cobbled together a minimalist infographic that distills the match-up for Data Security
You may have noticed that the “Choose Protection Setting” dropdown is no longer functional when selecting “Encrypt email messages.” It's not a bug, just a shift in how Microsoft handles email encryption. The native DLP action now expects encryption to be managed via Sensitivity Labels, not legacy protection
After publishing my last write-up on the technical limitations of auto-labeling in Exchange Online, I received a ton of messages from security engineers, admins, and compliance leaders asking for the actual solution. So, here it is. Microsoft Purview currently doesn’t scan mailbox content at rest for Sensitive Information Types
Apparently you can change the default colors of your Information Protection Sensitivity Labels! This is great because, well...why burgundy? Using the following PowerShell cmdlets, I decided to change my "Highly Confidential" label to bright red: >Connect-IPPSSession >Set-Label -Identity "Highly Confidential" -AdvancedSettings @{color="
I decided to throw together a quick reference graphic for the high-level differences between E3 and E5 regarding Purview Data Security. Now of course, there is so much more nuance within Purview licensing that we could get into. That aside, these are the ones I get asked about the most.
Over the last few weeks, I’ve been leading a data security engagement for a customer struggling to meet a very specific compliance requirement: identify and delete emails containing U.S. Social Security Numbers (SSNs) already stored in Exchange Online mailboxes. Simple ask, right? Turns out, not so much. The
When Microsoft announced Data Security Investigations (DSI) under the Purview umbrella, it sounded like another incremental compliance feature. Another dashboard. Another portal. Another cost center. Look closer, though: this is a paradigm shift hiding in plain sight. DSI is not just another incident response tool. It quietly marks the first
I'm losing count of how many times I have to answer that question. And, since there are multiple pieces of documentation related to it, it's not a straightforward answer. We'll go through the multiple categories associated with this question, and I'll also
Purview can generate a significant number of false positives from its built-in Sensitive Information Types. Part of my job when running #datasecurity projects is to help resolve these and keep them from popping up again in the future. Some of this may be common sense, and some of it may
One of the most common issues I'm tasked with resolving for my Purview customers is the structure of the DLP Rules within their DLP Policies. You build a rule based on common sense understanding and find that common sense isn't always the right approach. It'