BEARCLAVE

Microsoft Purview — data classification and loss prevention

From finding out where classification stands today, through a plan on paper, to implementation and a gradual rollout into production. The aim is for data to carry labels that make sense to the business, and protection that people can live with.

Analysis price

from 60,000 CZK

Implementation price

from 150,000 CZK

Output

analysis within 4 weeks, implementation by scope

Options are set by

Business Premium, E3, E5 or E5 Compliance

Book an intro call How it runs from start to finish

How it runs

How it runs from start to finish

The service has three phases and you can stop after any of them. You either get only a picture of the current state, or a complete design, or the whole implementation right into production.

1. What is configured todayWe find out whether any labels and data loss prevention policies exist at all, how many there are and whether anyone uses them. If nothing is configured, that is fine — it gets built from scratch according to what the licence allows.
2. Licence optionsBusiness Premium, E3, E5 or E5 Compliance. The difference is fundamental: manual labelling works everywhere, service-side automatic labelling and endpoint protection only from the higher tiers. This is settled before anything is promised.
3. Where the data sitsSharePoint, OneDrive, Exchange, Teams and endpoints. Without that the policies would be configured blind.
4. The classification plan on paperTogether we set the boxes data is sorted into — typically public, internal, confidential and highly confidential. Three to four levels, because a more complex taxonomy does not take hold in practice.
5. The range of platformsOn which platforms classification is to be enforced and where not yet. Going platform by platform is safer than everything at once.
6. What it protects againstFor every label we decide what is to be watched, which sensitive information types are recognised and whether the policy only warns or blocks outright.
7. Implementation and testingConfiguration of labels, publishing policies, recognition rules and loss prevention policies. Protection runs in warning mode first, for at least four weeks, and only the results decide what actually gets blocked.
8. Gradual rollout into productionA pilot group across departments, evaluation, adjustments and only then the rollout to the whole company. The configuration is created in version-controlled code.
What the service does not include

The decision about what is sensitive in your company, and setting the retention periods. Both are your decision and they are an input, not an output. Nor does it cover data migration, classification outside the Microsoft environment and full-scale user training.

Inputs

What we need from you

  • An account in your environment — either a guest invited into your tenant, or one you create in it. One is enough, it has read access only and you remove it at handover.
  • Read access in the Purview environment, enough for the analysis phase.
  • Read access in device management, if endpoint protection is in play.
  • A pilot group of ten to twenty people, by name and across departments, not only from IT.
  • Two hours with someone from the business who decides what is sensitive. The most frequent reason a project stalls.
  • Retention periods in writing from the legal or compliance function, if retention is to be part of it.

How we treat your environment and data →

Two hours with someone from the business is a condition, not a wish. Without a decision on what is sensitive, the technical configuration has nothing to stand on.

Deliverables

What you get

  • A picture of the current state — what is configured, what is used and where the data really sits.
  • The classification plan on paper — the boxes, the platforms, the recognition rules and what is to be watched.
  • Configured labels and publishing policies according to the approved plan.
  • Data loss prevention policies for Exchange, SharePoint, OneDrive, Teams and endpoints, as far as the licence allows.
  • An evaluated pilot and a plan for the rollout to the whole company.
  • Configuration in version-controlled code, a PDF report, a simple summary for the board and a handover record.
Download a sample deliverablePDF in Czech, based on an anonymised environment

How it runs

How it runs

Intro call

Thirty minutes. We get to know each other and go through the licences you have bought, the current state of labelling and where the data sits.

Analysis

A picture of the current state and the licence options. No impact on operations.

Plan and implementation

The classification plan on paper, its approval and the configuration that follows. Protection only warns at first.

Pilot and rollout

Evaluation of the pilot, adjustments and a gradual rollout into production.

Frequent questions

What people ask most often

Will it stop people working?
No, if it is rolled out properly. Loss prevention always goes into warning mode first, for at least four weeks. Only its results decide what actually gets blocked. Going straight to blocking is the fastest way to get the whole service thrown out of the company.
How many labels will we have?
Three to four levels, typically public, internal, confidential and highly confidential. We refuse to grow it to twenty levels, and that is part of the service, not a limitation. An overly complex taxonomy is the most frequent reason classification fails — more frequent than any technical problem.
Does it catch national ID and document numbers?
The built-in sensitive information types are weak on Czech identifiers. Custom patterns are therefore expected, and that is extra work which gets priced openly rather than hidden.
We introduced labels once and nobody uses them.
That is the most common starting point. Usually the reason is not technical but too many levels, unclear rules and a missing decision from the business. The analysis starts exactly there and the plan on paper is made again rather than built on the old one.
We have Microsoft 365 Business Premium. What is possible?
Manual labelling, yes. Service-side automatic labelling, endpoint protection and trainable classifiers only from E5 or the E5 Compliance add-on. This comes up on the first call, so that nothing is promised that would mean buying licences.

Related

What it leads on to

NIS2 and DORA — compliance of the Microsoft environmentClassification is what you evidence your handling of data with. Hardening M365 and AzureData protection only makes sense over an environment that has been put in order.

Not sure what your licence allows? That is settled straight away

Which licences you have bought is the first question and it sets the whole scope. On the call the answer comes within a minute.

Book an intro call Back to the services