In this post we are going to cover DLP, Insider Risk, DSPM, Audit and eDiscovery in Microsoft Purview: the tools that stop sensitive data leaving, spot risky users, show your security posture, record who did what, and hold data for legal. These are 7 real Purview interview questions, asked the way they come up on a real project, and the last one is a scenario where credit card numbers turn up in a data lake export and you walk through finding, labeling, alerting and stopping it.
These are the data security and risk side of Purview. Each one answers a different question: DLP asks "should this leave?", Insider Risk asks "is this person a risk?", DSPM asks "where are we exposed?", Audit asks "who did it?", and eDiscovery asks "what do we keep for the lawyers?". Interviewers ask about them because real incidents touch all five, and you need to know which tool does which job.
Part 9 of the Real Time Microsoft Purview Interview Questions and Answers series on TechBrothersIT.
- The short answer
- Question 1: A user tried to email a spreadsheet of credit card numbers outside the company. How does a DLP policy stop it?
- Question 2: Your Fabric admin asks if DLP works on semantic models and lakehouses. What can DLP for Fabric detect and do, and what are the limits?
- Question 3: HR suspects a departing employee is downloading customer files. What does Insider Risk Management do, and how does Adaptive Protection help?
- Question 4: The CISO asks where sensitive data is exposed, including in Copilot and other AI apps. What is Data Security Posture Management?
- Question 5: Security needs to know who opened a confidential file last month. What does Audit capture, and how long are records kept?
- Question 6: Legal asks you to place a former manager's mailbox and OneDrive on hold for a lawsuit. How does eDiscovery work now?
- Scenario 7: Credit card numbers turn up in a data lake export. Walk through how Purview finds it, labels it, alerts on it and stops it from leaving.
The short answer
DLP blocks sensitive data on the way out, and DLP for Fabric covers semantic models and lakehouses with tips, alerts and restrict access. Insider Risk Management and Adaptive Protection tighten controls for risky users, DSPM shows posture across data and AI, Audit records who did what, and eDiscovery holds and searches by case.
Keep that in mind. Every question below is one piece of it.
Question 1: A user tried to email a spreadsheet of credit card numbers outside the company. How does a DLP policy stop it?
A DLP policy has three parts: locations, conditions and actions. Let's build the one that stops this email.
- Location. Exchange, usually with SharePoint and OneDrive too, so the same file can't leave through a sharing link either.
- Condition. Content contains the built-in credit card number sensitive information type, and it's shared with people outside the organization. That type checks the number pattern and a checksum, so random digits don't match.
- Action. Block, or block with override, where the user types a justification.
Then the notifications. The user sees a policy tip in Outlook, the security team gets an alert in the Microsoft Defender portal, and every match is written to the audit log.
Here is the whole rule in one place:
| DLP policy rule | |
|---|---|
| LOCATION | Exchange, SharePoint, OneDrive |
| CONDITION | Credit card number type + shared outside the org |
| ACTION | Block, or block with override (justification) |
| NOTIFY | Policy tip in Outlook, alert in the Defender portal, audit log |
Run the policy in simulation mode first, tune it, then turn it on. It takes about an hour to take effect. And Exchange DLP checks mail in transit, not old mail already sitting in mailboxes.
Question 2: Your Fabric admin asks if DLP works on semantic models and lakehouses. What can DLP for Fabric detect and do, and what are the limits?
Yes, it does. DLP for Fabric covers more than people expect. Let's start with what it does:
- Semantic models, lakehouses and warehouses.
- KQL databases, mirrored databases, SQL databases and Cosmos databases.
- It detects sensitivity labels and a subset of sensitive information types.
- Actions: a policy tip and an alert.
- Restrict access, which is still in preview. It limits the item to its owners, or to people inside the organization.
Now the limits, which interviewers love:
- No exact data match, trainable classifiers or named entities.
- No templates, so you build a custom policy.
- Only Delta tables are evaluated.
- DirectQuery, live connection and streaming models aren't supported.
- Nothing is checked when a service principal owns or refreshes the model.
Then the capacity side. Workspaces must be on a Fabric or Premium capacity, and the evaluation uses that capacity. Semantic models are checked on publish and refresh, and other Fabric items when data changes.
DLP for Fabric detects and alerts. Workspace permissions still control access.
Question 3: HR suspects a departing employee is downloading customer files. What does Insider Risk Management do, and how does Adaptive Protection help?
Insider Risk Management correlates signals to find risks like data theft and data leaks. Let's walk through this case in order.
First, pick the policy. Here you use the data theft by departing users template. Set up the HR connector, so Purview knows the resignation date. The other trigger, account deletion in Entra ID, comes too late here.
Then it looks for activity like:
- Mass downloads from SharePoint.
- Copying to USB, and printing.
- Uploads to personal cloud storage.
- Fabric and Power BI activity, which can be indicators too.
Matches raise alerts, an analyst triages them, and a real one becomes a case that can go to eDiscovery.
Now Adaptive Protection. It closes the loop. It gives risky users an insider risk level, and DLP policies use that level as a condition:
| Risk level | DLP action (example) |
|---|---|
| Elevated | block copy to USB |
| Moderate | audit |
| Minor | audit |
So an elevated user is blocked from copying to USB, while moderate and minor users are only audited. When the case is resolved, the level resets.
Users are pseudonymized by default, and access is role based. Agree the policies with HR and legal before you turn them on.
Question 4: The CISO asks where sensitive data is exposed, including in Copilot and other AI apps. What is Data Security Posture Management?
DSPM answers four questions: what sensitive data do we have, where is it, who can access it, and how is it protected? Today that means the new Data Security Posture Management experience, which brings DSPM and DSPM for AI together.
Let's look at how it works, step by step:
- Signals. It pulls insights from sensitivity labels, DLP, insider risk and data security investigations into one view.
- Objectives. You pick an objective, like prevent oversharing, and DSPM gives recommendations.
- Remediate. It points you to fixes, such as removing public links or applying a DLP policy.
Then the AI part, which is what the CISO really asked about. DSPM shows how Copilot, agents and third-party AI apps like ChatGPT and Gemini touch sensitive data. Copilot can return anything the user can already access, so oversharing is the real AI risk, and data risk assessments find it.
Two practical points:
- The classic DSPM and DSPM for AI experiences retire between November 30 and December 31, 2026, so set up the new experience now.
- Non-Microsoft sources like Snowflake and Databricks come in through partner solutions, which are in preview.
Question 5: Security needs to know who opened a confidential file last month. What does Audit capture, and how long are records kept?
Audit records user and admin activity across Microsoft 365 in the unified audit log: files accessed, shared and downloaded, label changes, DLP matches, mailbox actions, Copilot interactions and Fabric activity. It's on by default.
Let's answer the question, step by step:
- Open Audit in the Purview portal and start a new search.
- Pick the activity called Accessed file (
FileAccessed). - Set the date range, and filter by the file name or site.
- Export to CSV. You can also script it with PowerShell or the Audit Search Graph API.
Retention is always the follow-up question:
| Audit (Standard) | Audit (Premium) | |
|---|---|---|
| RETENTION | 180 days | 1 year: Entra ID, Exchange, SharePoint, OneDrive |
| LONGER | - | up to 10 years with an add-on |
| INSIGHTS | - | MailItemsAccessed |
| LICENSE | E3 level | E5, Purview Suite or add-on |
So Audit Standard keeps 180 days. Audit Premium, at the E5 level, keeps the core workloads for one year by default, up to ten years with an add-on, and adds insights like MailItemsAccessed.
If legal needs more than the default, the retention policy and licenses must be in place before the event. Set up audit retention policies on day one, not after the incident.
Question 6: Legal asks you to place a former manager's mailbox and OneDrive on hold for a lawsuit. How does eDiscovery work now?
First, the history. The classic eDiscovery experiences, including classic content search, retired on August 31, 2025. Today there is one eDiscovery experience in the Purview portal, and everything starts with a case.
Let's do it in order:
- Create a case.
- Add the former manager as a data source, which brings in the mailbox and OneDrive.
- Create a hold policy in the case.
- Search with KQL conditions, and check statistics and samples.
- Export when legal asks.
Then licensing. Holds, search and export are standard features at the E3 level. The rest are premium:
| Standard (E3) | Premium (E5) |
|---|---|
| Holds | Review sets |
| Search, KQL | Analytics, threading |
| Export | OCR, decryption |
Review sets, analytics like near duplicates and email threading, OCR and decryption need E5, the Purview Suite, or the eDiscovery and Audit add-on.
Confirm the hold is applied before the account is deleted. The mailbox then becomes an inactive mailbox, kept while the hold lasts.
And for automation, use Microsoft Graph, because app-only sign-in for the eDiscovery PowerShell cmdlets is no longer supported.
Scenario 7: Credit card numbers turn up in a data lake export. Walk through how Purview finds it, labels it, alerts on it and stops it from leaving.
Let's build it in four steps: find, label, alert, stop.
- Find. Register the ADLS Gen2 account in the Data Map and scan it with a scan rule set that includes the credit card number classification. The scan samples the data and tags the matching files and columns.
- Label. An auto-labeling policy for non-Microsoft 365 locations maps that classification to Highly Confidential, applied on the next scan. Be clear here: Data Map labels are in preview and are metadata only. They don't encrypt the file.
- Alert and stop on storage. DLP doesn't scan ADLS. For the storage account, a protection policy, in preview, denies access to labeled assets except allowed groups. If the export lands in a Fabric lakehouse, Fabric DLP can tip, alert and restrict access.
- Stop it leaving. If someone copies the file to a laptop or email, Endpoint DLP and Exchange DLP block USB, uploads and external sharing.
Here is which control applies where:
| Where the data is | Control |
|---|---|
| ADLS Gen2 | Protection policy (preview): deny all but allowed groups |
| Fabric lakehouse | Fabric DLP: tip, alert, restrict access (preview) |
| Laptop | Endpoint DLP: block USB, upload, paste into AI apps |
| Email, SharePoint | DLP: block external sharing |
Around all of that, DSPM shows the exposure, and Audit shows who touched it.
Purview finds it and limits the damage, but the real fix is masking the column in the pipeline, so the card numbers never land in the export.
Key points to remember
- DLP: locations, conditions, actions; simulate first
- DLP for Fabric: labels + info types; Delta only, no DirectQuery
- Insider risk + Adaptive Protection tighten DLP for risky users
- DSPM: posture across data and AI; classic retires end of 2026
- Audit 180 days / 1 year+; eDiscovery is case-based
Part 10: Real-World Manager Scenarios
Part of the Real Time Microsoft Purview Interview Questions and Answers series on TechBrothersIT. Product names, features and their status (GA or preview) are current as of October 2026. Microsoft changes Purview every month, so check the Microsoft Learn page for anything you quote in an interview.
No comments:
Post a Comment
Note: Only a member of this blog may post a comment.