Microsoft Purview for Small Business: What You Get

Microsoft Purview is the set of data protection and compliance tools inside Microsoft 365: sensitivity labels, data loss prevention (DLP), retention, audit logs, and eDiscovery. A small business on Microsoft 365 Business Premium already has the core of it: manual sensitivity labels, DLP for email and files, retention policies, email encryption, and a 180 day audit log. The automatic and advanced features need an add-on or an enterprise plan.

What Is Microsoft Purview?

Purview is a brand name covering a family of tools, all managed from the Microsoft Purview portal at purview.microsoft.com. Microsoft has retired the older Microsoft Purview compliance portal, so guides that point to compliance.microsoft.com are out of date.

The tools answer four practical questions:

• What sensitive data do we have, and how should it be handled? Information Protection, which is where sensitivity labels live.
• How do we stop it leaving by mistake? Data Loss Prevention.
• How long do we keep things? Data Lifecycle Management, which means retention policies and retention labels.
• Who did what, and can we find it later? Audit and eDiscovery.

The wider suite also includes Insider Risk Management, Communication Compliance, Records Management, and more. Those are built for organizations with compliance staff, and most small offices can set them aside.

Which Purview Features Does Business Premium Include?

Licensing is the confusing part. This table is drawn from Microsoft’s Purview service description as of September 2026.

Feature	Business Basic and Standard	Business Premium	Needs an add-on or enterprise E5 plan
Audit (Standard): searchable activity log, 180 days	Yes	Yes	One year and longer retention is Audit (Premium)
Manual sensitivity labels, with optional encryption	No	Yes
Automatic sensitivity labeling	No	No	Yes
DLP for Exchange email, SharePoint, and OneDrive	No	Yes
DLP for Teams chat and channel messages	No	No	Yes
Endpoint DLP (copying to USB, printing, uploads from a PC)	No	No	Yes
Organization-wide retention policies	Teams messages only	Yes	Adaptive scopes need E5-level licensing
Retention labels	No	Yes	Event-based and other advanced options need more
Microsoft Purview Message Encryption	No	Yes	Advanced Message Encryption needs more

The add-on Microsoft points small businesses to is Microsoft Purview Suite for Business Premium (also sold combined with the Defender suite). The service description says these add-ons require a Business Premium base license and are capped at 300 seats. We have left the price out because we could not confirm a current list price on a Microsoft page. Check Microsoft or your licensing reseller.

If you are on Business Standard and want these controls, the plan difference is covered in our Business Premium vs Standard comparison.

What Do Sensitivity Labels Do?

A sensitivity label is a tag that a person applies to a document or email from a button in Word, Excel, PowerPoint, or Outlook. The label is stored in the file, so it stays with the file if it is emailed, downloaded, or copied to a USB drive.

Depending on how you configure it, a label can:

• Simply classify the item, with no restrictions, so you can see and report on what is sensitive.
• Add a header, footer, or watermark such as “Confidential”.
• Encrypt the item so only the people or groups you specify can open it, even after it leaves your organization.
• Apply to containers such as a Teams team or SharePoint site, to control privacy and external sharing for everything inside.

With Business Premium, labeling is manual: people choose the label. You can make that easier by publishing a default label so most items need no action. Having Microsoft 365 detect content and label it automatically is one of the features that needs the add-on or an E5-level plan.

One caution. Encryption is powerful and easy to overdo. A label that encrypts too broadly can block the people you work with outside the company, and some third-party apps cannot open encrypted files. Start with labels that only classify and mark, and add encryption to one label once people are used to the system.

What Does Data Loss Prevention Do?

DLP policies scan content for patterns (Microsoft calls them sensitive information types), such as Social Security numbers, credit card numbers, bank account numbers, and health terms. When a match is about to be shared in a way your policy does not allow, DLP can:

• Show the sender a policy tip explaining the problem.
• Require a business justification to continue.
• Block the email or the sharing link.
• Alert an administrator and log the event.

With Business Premium, DLP covers Exchange email and files in SharePoint and OneDrive. Microsoft’s service description notes that this includes files stored through Teams, since those live in SharePoint and OneDrive. Scanning the chat messages themselves is a separate, higher license.

Microsoft supplies ready-made policy templates, including U.S. Financial Data, U.S. Personally Identifiable Information (PII) Data Enhanced, U.S. Health Insurance Act (HIPAA) Enhanced, U.S. Gramm-Leach-Bliley Act (GLBA) Enhanced, and U.S. State Breach Notification Laws. For most small offices a template is a better starting point than a custom policy.

DLP matches patterns, so it produces false positives. A nine digit invoice number can look like a Social Security number. That is why Microsoft provides simulation mode, which runs a policy and reports matches without affecting anyone.

What Do Retention and Audit Give You?

Retention policies tell Microsoft 365 to keep content for a period, delete it after a period, or both. If a user deletes something that is under retention, a preserved copy is kept in a hidden location until the period ends. That supports record keeping, but it is not a point-in-time restore. The differences are explained in our guides to Microsoft 365 backup and email archiving.

Audit (Standard) is enabled by default and keeps records for 180 days. It records events such as file access, sharing, mailbox sign-ins, and administrator changes. You do not look at it often, but it is the first place to go after a suspected account compromise or when someone asks who shared a file. If you need more than six months of history, that requires Audit (Premium) licensing or exporting the logs elsewhere.

A Sensible Starter Setup on Business Premium

This is a reasonable order for an office with no compliance staff. Plan a few hours of setup spread over a few weeks of observation, not a one-afternoon project.

1. Confirm licenses and roles. Check that the users you want covered have Business Premium. In the Purview portal, give one or two people the compliance roles they need instead of doing everything as a global administrator.
2. Confirm audit is on. In the Purview portal open Audit and run a search for the last week. If results appear, it is working.
3. Create four or five labels. Microsoft’s default label set uses Personal, Public, General, Confidential, and Highly Confidential, which is a sound model. Write a one line description for each in your own words.
4. Publish the labels with a default. Set General as the default for documents and email. Do not turn on encryption yet.
5. Show people the button. Ten minutes on where the Sensitivity button is and when to choose Confidential is enough.
6. Create one DLP policy from a template. Choose the template that matches your biggest exposure (financial data, PII, or HIPAA), apply it to Exchange, SharePoint, and OneDrive, and run it in simulation mode for two to four weeks.
7. Review the matches. Tune out the false positives, then switch to policy tips that warn the sender. Move to blocking external sharing of high-volume matches only after the warnings have been quiet for a while.
8. Set retention after deciding the periods. Agree on how long you keep email and files, ideally with your accountant or attorney, then create the retention policy. Be careful with any setting that deletes.
9. Add encryption last. Turn it on for the Highly Confidential label, test it with an outside contact who agrees to help, and document how recipients open protected mail. Our email encryption guide covers the recipient side.
10. Put a review on the calendar. Every quarter, look at DLP alerts, label usage, and whether new staff were covered.

When You Do Not Need Purview

If your business holds little personal or financial data, shares few files outside the company, and has no regulator or contract asking for these controls, your time is better spent first on multi-factor authentication, device protection, and backup. Audit logging is already on and costs nothing to leave alone.

Purview also does not make a business compliant on its own. HIPAA, the FTC Safeguards Rule, and similar requirements are about policies, risk assessments, training, and contracts as well as technology. Purview supplies some of the technical controls. Our overviews of HIPAA IT requirements and the FTC Safeguards Rule explain the wider picture. This article is IT guidance, not legal or compliance advice.

Common Mistakes

• Turning on blocking DLP rules on day one, without a simulation period.
• Creating a dozen labels. People stop choosing when the list is long.
• Encrypting by default and then finding that outside partners cannot open files.
• Assuming Teams chat is covered by a Business Premium DLP policy.
• Setting a retention policy that deletes content before checking what must be kept.
• Assigning Purview features to users who do not hold the license that grants them.

Common Questions

Is Microsoft Purview included in Microsoft 365 Business Premium?

The core is. Business Premium grants manual sensitivity labels, DLP for email, SharePoint, and OneDrive, retention policies and labels, Message Encryption, Audit (Standard), and Compliance Manager. Automatic labeling, Teams chat DLP, endpoint DLP, and Audit (Premium) require the Purview Suite add-on for Business Premium or an enterprise E5-level license.

Does Business Standard include any Purview features?

A few. Per Microsoft’s service description, Business Basic and Standard include Audit (Standard) with 180 day retention and retention policies for Teams messages. They do not grant sensitivity labels, DLP, or organization-wide retention policies for mail and files. Those start at Business Premium.

Will sensitivity labels slow people down?

A little at first. With a default label applied automatically, most documents need no action, and people only change the label for sensitive items. The larger adjustment comes with encryption, because recipients outside the company may need to verify their identity to open a file. That is why encryption belongs at the end of the rollout.

Is Purview the same as the Azure data governance product?

Microsoft uses the Purview name for both its Microsoft 365 compliance tools and its data governance tools for databases and analytics platforms. They now share one portal. A small business using Microsoft 365 only needs the first group: Information Protection, Data Loss Prevention, Data Lifecycle Management, Audit, and eDiscovery.

How We Can Help

Coastal Growth Co. can check which Purview features your licenses grant, set up labels and a first DLP policy in simulation mode, review the results with you, and configure retention once you have decided the periods. Scope and price are agreed before any paid work. See our cloud, email, and Microsoft 365 services, our work with legal and accounting firms, or get in touch.