Getting Started with Microsoft Purview: A Practical Walkthrough for Your First Day

Introduction

You just got access to Microsoft Purview. Maybe your organization is rolling out Microsoft 365 compliance tools, or you are taking over data governance responsibilities. Either way, you are staring at the compliance portal wondering where to actually start. This walkthrough takes you through exactly what to do on your first day – no fluff, just the steps that matter.

What Microsoft Purview Actually Is

Microsoft Purview is a unified data governance and compliance platform. It brings together what used to be separate tools – Azure Purview for data governance and Microsoft 365 compliance center for risk and compliance – into a single experience. You use it to understand what data your organization has, where it lives, how it is classified, and whether it complies with regulations.

It covers data cataloging, information protection, insider risk management, data loss prevention, eDiscovery, and audit logging. For most people starting out, the core workflow is: register your data sources, scan them, classify the data, and then act on what you find. You access Purview through the Microsoft Purview compliance portal at compliance.microsoft.com or through the governance portal at purview.microsoft.com for the data catalog side.

Navigating the Portal So You Do Not Get Lost

When you first log into the Microsoft Purview compliance portal, the left navigation can feel overwhelming. Here is what matters right now. Under Data classification you find the sensitive information types and trainable classifiers that Purview uses to identify regulated data like credit card numbers or medical records. I cover these in depth in the trainable classifiers guide.

Under Information protection you manage sensitivity labels and label policies – this is where you define what labels exist and who can apply them. Data loss prevention houses the DLP policies that prevent sensitive data from leaving your organization through email, Teams, SharePoint, or endpoints. Insider risk management monitors user activity patterns for data theft or policy violations. Audit gives you searchable logs of user and admin activity across Microsoft 365. For your first day, spend time in Data classification and Information protection – these are foundational to everything else.

If you are also using the Purview governance portal for data cataloging, the left navigation has Data map where you register and manage sources, Data catalog where you browse and search discovered assets, and Data estate insights which gives you summary reports on your entire data landscape. Start in Data map – you cannot browse a catalog until something has been scanned.

Setting Up Permissions So You Can Actually Work

Nothing is more frustrating on day one than clicking around and seeing access denied messages. Purview permissions are managed through role groups in the Microsoft Purview compliance portal – not through Azure AD roles, which trips people up constantly. Go to Roles and scopes and select Permissions. You will see role groups like Compliance Administrator, Compliance Data Administrator, Information Protection Analyst, and others.

For most day-one work, you need at least the Compliance Data Administrator role if you are managing data classification and information protection. For data catalog scanning and source registration in the governance portal, you need Data Curator role on the Purview collection you are working with. If you run into access problems later, the common configuration mistakes guide covers permission issues and how to fix them.

A common setup issue is that global admin accounts are not automatically granted Purview admin access – Microsoft decoupled these for security reasons. If you cannot see certain features, ask your global admin to add you to the appropriate Purview role groups. Permissions can take up to an hour to propagate after changes, so make this step one.

Your First Data Source and Scan

If you are working in the Purview governance portal, the most impactful thing you can do on day one is register a data source and run a scan. Go to Data map, select Sources, and click Register. You can register Azure Blob Storage, Azure Data Lake, SQL databases, Amazon S3 buckets, and on-premises SQL Server – among many others.

For a quick start, pick an Azure Blob Storage account you know contains some data. Give the source a name, select the subscription and resource, and create it. Then on the source tile, click New scan. Select the authentication method – managed identity is easiest if your Purview account has access to the data source. Choose the default classification rules. Purview includes over 200 built-in patterns for identifying credit card numbers, passport numbers, and GDPR-relevant data.

Run the scan and wait. Depending on data volume, this can take minutes or hours. When it finishes, go to Data catalog and browse what was discovered. Each asset will show its schema, lineage if available, and any classifications that were automatically applied. If you are focused on the compliance side rather than data cataloging, your first scan equivalent is reviewing existing sensitive information types under Data classification and enabling Content explorer. I cover this in detail in the Content Explorer and Activity Explorer guide.

Creating Your First Sensitivity Label

Sensitivity labels are how Purview applies protection to your data. A label can encrypt content, apply visual markings like headers and watermarks, and set conditions for access. To create one, go to Information protection and select Labels. Click Create a label, give it a name that users will understand – something like Confidential – and provide a description that tells people when to apply it.

The wizard walks you through scope: you can protect files and emails, meetings, and even schematized data assets in the data map. For a basic first label, select files and emails, enable encryption, and choose the permissions model. The simplest approach is to let the label auto-assign permissions so only people inside your organization can access labeled content. On the content marking page, you can add a visible watermark or header that prints Confidential on every page of a labeled document. For a complete walkthrough including auto-labeling and advanced encryption, see the sensitivity labels guide.

What to Tackle on Day Two and Beyond

Once you have permissions set, a data source registered and scanned, and a basic sensitivity label published, you have the foundation in place. On day two, dive into Content explorer under Data classification to see the sensitive information types already detected across your environment – this often reveals surprises about where sensitive data is hiding.

Review the Activity explorer to see how labels are being applied and used across your organization. If you are on the governance side, explore the scanned assets in Data catalog and use the search to find specific data by keyword, classification, or glossary term. A good next step is setting up a simple Data Loss Prevention policy – start with the built-in template for GDPR or financial data, scope it to Exchange and OneDrive, and run it in simulation mode first. Simulation mode gives you confidence in the policy before you enforce it.

You may also want to look at Insider risk management if your organization deals with intellectual property or regulated data. Start with a pre-configured policy template for data theft by departing users. Like DLP, run it in audit mode initially so you understand the signal before taking action. The key is incremental progress – each day you add a small capability and validate it before moving forward. Once everything is running, use the monitoring dashboards to track your compliance posture from a single view.