Manage compliance by using Microsoft Purview
Information protection
Sensitivity labels classify and protect content with encryption (including usage rights and offline access), content marking (headers, footers, watermarks), and auto-labeling - client-side in the app or service-side scanning of SharePoint, OneDrive, Exchange, and Teams. Labels reach users through label policies that set the included users, default label, mandatory labeling, and help link. Sub-labels inherit the parent's protection unless you deliberately change it, and encryption templates must let the service read content for DLP and eDiscovery to work.
Data lifecycle and DLP
Retention is applied either by retention policies (container-wide, all items) or retention labels (item-level, publishable, able to declare records and trigger disposition review from the file plan). Retention wins over deletion: if one source deletes an item and another retains it, the item is kept. Data Loss Prevention policies target locations (Exchange, SharePoint, OneDrive, Teams, endpoint devices), use rules with sensitive information types and conditions, and take actions such as audit, policy tips, block with override, or block. Always run a new DLP policy in simulation mode before enforcing it.
Discovery, audit, and insider risk
eDiscovery (Standard) provides cases, content search, and holds; eDiscovery (Premium) adds custodian holds, review sets, analytics, and export workflows. Audit (Standard) retains events for 180 days; Audit (Premium) adds high-value events, longer search jobs, and up to 10-year retention. Communication compliance, Insider Risk Management, Compliance Manager, Information Barriers, and Privileged Access Management complete the toolset.
Worked example: an item labeled "Retain 7 years, then delete" is covered by a tenant retention policy that deletes after 2 years. The label's retention wins, so the item stays for 7 years - check label-versus-policy precedence before assuming content is gone.
Traps: expecting auto-labeling without the right licensing tier, confusing retention policies with labels, and forgetting that DLP policy tips require configuration in the rule.