DLP, sensitivity labels, encryption, retention policies, and audit-ready Microsoft 365 compliance controls.
Organizations purchase Microsoft 365 E3 or E5 and assume compliance features are on. They're not. Data Loss Prevention policies ship disabled. Sensitivity labels require planning before deployment. Retention policies applied incorrectly can suppress eDiscovery or create legal hold conflicts. Microsoft Purview is a capable compliance platform, but it needs to be configured to match your actual regulatory obligations rather than left in its out-of-box state.
This practice does Purview deployment starting from a compliance obligation inventory — what regulations apply, what data types require protection, what the audit log retention period needs to be — and works backward from there to configuration. The result is a Purview deployment that can be demonstrated to an auditor, not just enabled.
HIPAA compliance in Microsoft 365 starts with the Business Associate Agreement — Microsoft provides a BAA for covered Microsoft 365 services, and it needs to be executed before PHI enters the tenant. Beyond the BAA, HIPAA requirements map to specific Microsoft 365 configurations: access controls (Conditional Access, MFA, least-privilege admin roles), audit controls (unified audit log enabled with appropriate retention), transmission security (TLS enforced for mail flow, sensitivity labels for email encryption), and integrity controls (versioning and retention policies on SharePoint and OneDrive).
DLP policies for healthcare environments need to cover both structured PHI (Social Security numbers, medical record numbers, diagnosis codes) and unstructured content. Custom sensitive information types built with regular expressions and keyword dictionaries are commonly required for organization-specific identifiers not covered by Microsoft's built-in types.
DLP policies deployed directly in enforcement mode routinely block legitimate business workflows. A policy designed to prevent PHI from leaving the organization will, if improperly scoped, also block a doctor emailing a patient their own records. The standard deployment sequence is: audit mode first (two to four weeks), review of the policy match report, scope adjustments for false positives, then enforcement mode activation. This sequence is not optional — skipping it generates helpdesk tickets that undermine confidence in the compliance program.
Azure Information Protection (AIP) is the older labeling and protection platform. Microsoft has been migrating AIP functionality into Microsoft Purview Information Protection (unified labeling). For organizations that haven't deployed labels yet, starting with Purview sensitivity labels is the correct approach — they're managed from the Purview compliance portal, work natively in Microsoft 365 apps, and don't require the separate AIP unified labeling client for most scenarios.
Legal holds take precedence over deletion policies. Content under a hold will not be deleted even if a retention policy says it should be. However, a misconfigured retention policy with a short retention period and no understanding of existing legal holds can create gaps in the audit trail. The compliance configuration work here includes mapping existing legal holds against proposed retention policies before either is deployed or modified.