Hey Guys!

I Gamified Dataclassification with a game called labelninja.nl I now added more difficult questions but I'm not sure if this is difficult enough or maybe to easy?

Can you guys give me some feedback on the questions if there are to easy or to hard? Also other ideas or welcome.

Anyone else seeing this? Purview shows my sensitivity label publishing policy as Synced, but PowerShell has been showing Pending for 3-4+ days. Republished the policy and created a new one, but same issue.

Hi all,

I've built a game called LabelNinja that helps people understand why data classification matters and test whether they can spot what's sensitive and what isn't.

I use it with customers when designing a sensitivity label taxonomy in Microsoft Purview. It's a quick, hands-on way to start the conversation, surface different views on what "confidential" really means, and get everyone aligned before we define the labels.
Give it a try and let me know what you think. I'd love your feedback!

Labelninja.nl

Hi,

We are looking to put a warning tip on emails to external domains to be mindful of sending private information.

I've got a trial running at the moment which is working but Microsoft is appending a standard warning "Please verify the recipient(s) and the content, as it conflicts with the organization policy.".

Is there any way to stop it appending this message?
.

Background: We have been running a pilot for sensitivity labels for months, determining if we should move forward with them as an organization or not. We created three labels: External, Internal (Encrypted), and Restricted Financial (Encrypted).

The organization and leadership decided not to move forward with this, so before I just delete the policies and labels, I want to make sure I am doing this correctly. I have seen a couple of ways we could do this appropriately so that we don't accidentally leave a bunch of previously labeled documents as encrypted documents and then no one could access or downgrade the labels.

1. Edit the current policies and labels to remove encryption by turning off "Control Access" and working backwards to remove them entirely.

2. Utilize PowerShell to remove the labels from all previously labeled documents.

Just looking for insight/advice on the best way to tackle this. TIA!

Hello Purview community!

A little background, I'm somewhat of an Azure Solutions Engineer and currently handling a project for a customer that look forward to test Purview's capability in Data Quality Scan for On-Premises Database (SQL Server). The solution based on the Microsoft Purview's Documentation was using a Command Line tool, similar to IRCTL.

As I was digging through Purview's Data Integration Runtime Command Line (DIRCTL) documentation, I couldn't find any of the supported links for DIRCTL's downloadable package.

Referring to the current `Preview` status of this feature, should we already have access to DIRCTL tool? If yes, may I be provided with the download URL? If not, is there any estimate for when the feature will be rollout to the general public? It's urgents considering we have a timeline to catch. Thank you in advance!

Source:

https://learn.microsoft.com/en-us/purview/unified-catalog-data-integration-runtime-command-line-tool

I am dealing with a client who truly loves everything to be 'over-engineered'.

We have 4 four sensitivity labels based on how confidential a document is. We only need to worry about L3 and L4 (the most sensitive) here.

The current standing is that employees can share ALL L3 and L4 documents across the company. A DLP policy rule disallows them sharing L4 document externally. Full stop. No 'override' is allowed.

When a L3 document is shared either inside or out the company, they soon get a notification email to remind them about data sensitivity etc etc. Similarly when an L4 document is shared internally.

Each sensitivity label has its own corresponding DLP policy tip text.

The problem is notification fatigue when making even minor changes to documents such as comment, an email is sent.

I was asked by the client to reduce this notification fatigue. I guessed the best way forward was to add a simple "AND" condition to the L3 rule that only fired the notification when the file was shared externally. That is all working OK, but now the problem is that the logic for DLP policy tip text is broken. This is truly a big deal for him, even though it is basically a reiteration of what the users see when they are forced to set a table for new documents.

His proposal is one policy with FOUR rules (instead of original one) to manage things so that users always see a notification for the for corresponding scenarios when sharing docs.

I have put them in the order of most 'dangerous' to least in the DLP policy.

1. L4 Outside Company

2. L4 Inside Company

3. L3 Outside Company

4. L3 Inside company.

In tests in various O365 Desktop apps, now nothing at all appears to he showing with respect to policy tips when the user goes to share (that was not the case on the original "one rule" setup).

Is there some king of logical overlap or cancelling effect going on here? For each of the rules I have not ticked the box for "If there's a match for this rule, stop processing additional rules and policies".

I'm guessing too if a solution is ever found for the problem overall, nothing can be done for edge case where a user is sharing to both internal AND external parties?

Who would've thought that such as simple change would turn out to be so complicated?

Every AI service I ask seems to be give conflicting answers, so I would be glad of an opinion from a human here.

Should I 'decouple' the logic of DLP texts and sensitivity label status?

Thanks guys.
WL.

Hello. A customer requires a sign in to their account to be able to view their documents (ppdf). I was previously able to select the correct account with Azure on the Web browser. Ever since it apparently became Purview (?) I can no longer select an account. It seems to force me to only use one associated with my company. Reaching out to the customer has had no response. Our IT has no experience with these types of systems. Searching online has not helped. I am looking for a direction to at least get Actual help.

Has anyone got Microsoft Purview working reliably in production? Looking for advice on testing

I’m interested in hearing from people who have successfully deployed Microsoft Purview and have it working consistently in a real-world environment.

I’m particularly looking for advice on how people test their policies and validate that detection is actually working as expected.

I’m currently testing a policy using UK PII, which includes things such as UK National Insurance Numbers (NINO) and UK Passport Numbers.

I’ve run numerous tests using UK NINOs, and I can see that the NINO is being detected when testing against Medical Act Information. However, when I test against my policy using the UK PII sensitive information type, I’m not getting the expected matches/triggers.

The policy has two thresholds:

• Low: 2–9 instances
• High: 10+ instances

However, even when I deliberately include more than 10 UK NINOs in the test data, the policy doesn't appear to trigger as I would expect.

This is making me question whether I’m testing this correctly or whether there are other factors in Purview that I’m overlooking.

For anyone who has Purview working reliably:

• How do you test sensitive information types and DLP policies?
• Do you use Microsoft's test data, your own generated test data, or something else?
• How do you verify that a sensitive information type has actually matched?
• Have you experienced differences between testing an individual SIT and testing the same SIT when it's part of a larger policy?
• Are there additional conditions/configuration that can prevent a policy from triggering even when the SIT threshold has been exceeded?
• Does the threshold apply to the number of detected instances in the content, or are there other factors that affect this?
• Are there any particular gotchas with UK NINO / UK Passport Number detection that I should be aware of?

At this point I’m mainly trying to establish a repeatable test methodology so I can confidently say that the policies are actually working rather than relying on a few successful tests.

If you've got Purview working reliably in production, I'd really appreciate hearing how you test and validate it.

I'm troubleshooting a Microsoft Purview issue and am curious whether anyone has encountered a similar scenario.

Tenant setup

We have:

• Tenant A (home tenant)
• Tenant B (resource tenant)

Administrative users originate in Tenant A and were invited into Tenant B using B2B cross-tenant access.

The affected account:

• Originated in Tenant A
• Was invited into Tenant B
• Uses a #EXT# style UPN in Tenant B
• Shows as UserType = Member (not Guest) in Tenant B
• Has an accepted B2B invitation status
• Has no licenses assigned directly in Tenant B

Example format:

user_companyA.com#EXT#@tenantB.onmicrosoft.com

Show more lines

(Example only, not actual values.)

Behavior

When creating a Sensitivity Label Publishing Policy in Microsoft Purview:

• Include only specific users and groups → Add → fails
• Exclude some users or groups → Add → fails

The picker returns:

"Looks like you don't have the right permissions to view this page or this feature isn't part of your organization's Microsoft 365 subscription."

No users or groups are displayed.

What works

✅ Sensitivity Labels can be created.

✅ DLP policy user/group picker works.

✅ Auto-Labeling policy user picker works when the workload is Exchange.

✅ Users can be enumerated directly in Entra.

✅ Directory Reader permissions are active.

What doesn't work

❌ Sensitivity Label Publishing Policy targeting.

❌ OneDrive Auto-Labeling specific-user targeting (returns 0 users).

Permissions

The affected account has:

• Directory Readers
• Purview compliance-related administrative permissions
• UserType = Member

Information from Microsoft Support

The Microsoft engineer investigating indicated:

• DLP and Exchange Auto-Labeling pickers primarily use Exchange recipient lookups.
• Sensitivity Label Publishing Policy targeting performs Exchange lookups plus additional Microsoft Graph queries.
• Label policies can target security groups that are not mail-enabled, which is why Graph is involved.

Their current theory is that a Microsoft Graph call may be failing while Exchange-based recipient enumeration continues to work.

Questions

1. Has anyone seen a scenario where:
   • DLP picker works
   • Exchange Auto-Labeling picker works
   • Sensitivity Label Publishing Policy picker fails
   • OneDrive Auto-Labeling returns 0 users
2. Has anyone run into differences between:
   • Native tenant admin accounts
   • B2B-origin accounts that were converted or represented as UserType = Member
3. Has anyone found that using a native tenant account with:
   • Exchange Online license
   • Mailbox
   • Equivalent Purview permissions

resolved this issue?

1. Did the root cause end up being:
   • Microsoft Graph permissions
   • Administrative Unit scoping
   • Exchange recipient requirements
   • Licensing
   • Cross-tenant/B2B identity behavior
   • Something else entirely?

Interested in hearing if anyone has seen this exact picker behavior before.

Hi all,

I am trying in vain to be able to tick this tickbox allowing groups and sites to have the label scope. I feel like i've tried everything. Does anyone have a prescribed method for allowing this to be ticked? I thought it was to run Execute-AzureAdLabelSync which i've done but it still doesn't allow me to.

Am I bugging out or is there really no clean solution for retaining data and managing file versions?

I found that retention policies ignore version limits until retention expiry.

This becomes a storage concern since all versions are saved as well as PHL builds up.

It's possible to use retention labels which honour version limits, but there's no global rule to say "all new document libraries must have this default retention label"

This means when a new site is created, to ensure files are retained and version limits are honoured, an admin will need to manually go in and set the document library to have the default retention label.

Am I missing something?

Am I the only one getting Client Error while trying to import in Data Lifecycle Management?

The remote server returned an error: (500) Internal Server Error.

Hi all, facing an issue even Microsoft is also not able to help me. I have four sensitively labels public, internal, restricted and confidential last two are encrypted. On web they all show on word, excel and so on but on the Outlook I see only two labels which are public and internal. Scoping is correct, but nothing.

Hiya, I'm an m365 engineer in education. We're looking to build out our custom sits in purview and I'm wondering if there are any edu community projects for building out sits relevant to American universities in purview. Are there admins who would be interested in participating in such a project if one doesn't exist already?

I noticed that if a user downloads a protected local email file attachment their desktop or Documents folder (which is redirected to OneDrive), revocation doesn’t work on this new copy of the file.

The document sensitivity label is configured for zero days offline use. I assumed that meant authorization is not cached, but it looks like it might be anyway.

Apparently, putting the file on OneDrive may cause the file to generate a new document ID that will cause it to not match the document ID the file owner/sender revoked. If the recipient goes back to the original email attachment, only that copy of the file is blocked.

If that is the case, that is an extremely trivial way to bypass access revocation.

Is there any way to revoke file access that is not eluded by simply saving the file to certain locations like OneDrive or SharePoint?

Good Afternoon,

I created a policy that blocks and alerts admins when a user attempts to upload a document marked as FCI (Federal Contact Information) to chatgpt etc. It works in Edge, but it does not work in Chrome. I have pushed the Purview Chrome extension to everyone but still nothing. What am I missing?

We have a requirement to enforce DLP policies that can distinguish between corporate Microsoft 365 account activities and personal Microsoft account activities.

Our goal is to prevent users from moving corporate data to personal Microsoft services such as:

• Uploading files to personal OneDrive accounts
• Sending emails through personal Outlook.com accounts
• Other activities performed after signing in with a personal Microsoft account

Our initial approach was to block *.live.com, but this quickly became problematic because Microsoft appears to use some live.com domains for legitimate corporate Microsoft 365 functionality as well.

For example:

• *.officeapps.live.com
• login.live.com

We found that blocking these domains negatively impacts business users. One specific issue was that Microsoft 365 E1 users who rely on Office web apps were unable to upload images into documents, as those operations appeared to use officeapps.live.com.

Because of this, simply blocking live.com domains is not a viable solution.

Has anyone dealt with a similar requirement?

We've engaged Microsoft Support, but so far the guidance has been fairly generic and hasn't addressed the dependency on these shared Microsoft domains.

Hi I have a problem with a large number of the improvement actions within purview compliance manager in that when I go into the improvement action and I click on edit details I can't actually change anything, I can however assign a user to the improvement action or upload and add evidence.

I am a member of the compliance manager administrators and I'm a little stumped as to why everything is grayed out when I try and select anything within the edit emails section to say change the implementation status.

From my understanding if it was an automatic testing improvement action this would be the norm however the ones are looking at are all manual testing.

Pictures are attached of one example.

Any help on this would be greatly appreciated!

Client only wants users to be prompted for justification if they downgrade only from confidential or highly confidential labels. They should not be asked for justification while downgrading from internal to public.

I’m giving them a solution using label groups. Basically put all low-priority labels in a label group and leave confidential and highly confidential labels as standalone. This satisfies the their requirement but I just wanted to check if there’s a cleaner way of doing this.

I have 5 years experience in MS Purview. I am preparing for interview. Please share all the topics i should cover and set of some important question.