Compliance

Purview Secure by Default: 5 Critical Layers

A practitioner's guide to Purview secure by default for banks and credit unions: the 5 config layers to lock in before Copilot goes live. Book a call.

August 31, 20269 min read

Purview Secure by Default: 5 Critical Layers

Quick answer

Purview secure by default means Microsoft Purview controls apply automatically by policy, fail closed, and produce audit evidence, rather than depending on users to classify content. For banks and credit unions preparing for Copilot, a Purview secure by default baseline requires five layers: an NPI/PII sensitivity label taxonomy, DLP scoped to financial data types, service-side auto-labeling for SharePoint and OneDrive, communication compliance for regulated roles, and audit log retention aligned to FFIEC expectations. Build all five before Copilot licenses activate.

A Purview secure by default baseline is the set of Microsoft Purview configurations a bank or credit union puts in place before Copilot indexes a single SharePoint site: a sensitivity label taxonomy mapped to NPI and PII, DLP policies scoped to financial data types, auto-labeling running in SharePoint and OneDrive, communication compliance for regulated roles, and audit log retention aligned to FFIEC expectations. Get those five layers right and Copilot inherits your controls. Skip them and Copilot inherits your oversharing, at machine speed, with a friendly chat interface on top.

This is written for the IT Director or Information Security Officer who will actually own the project at a 100 to 500 user institution, not for the steering committee deck.

What Purview secure by default actually means in a regulated tenant

Microsoft 365 does not ship secure. It ships collaborative. Default tenant settings favor sharing links, personal OneDrive sprawl, and open Teams sites. In a commercial tenant that is a productivity feature. In a tenant holding loan files, member account numbers, and BSA case notes, it is an examination finding waiting to happen.

Purview secure by default means the protective control is applied automatically by policy, not by a user remembering to click something. Three tests tell you whether a control qualifies:

It applies without user action. Auto-labeling, default labels, and container-level policies count. A label a loan officer is asked to select does not.
It fails closed. Unknown or unclassified content gets the more restrictive treatment, not the permissive one.
It produces evidence. Every enforcement event lands in the unified audit log with retention that outlives your exam cycle.

Why Copilot changes the math

Microsoft 365 Copilot respects existing permissions. That sentence gets repeated in every vendor briefing and it is technically true, which is exactly why it is dangerous. Copilot honors permissions you already have, including the ones nobody remembers granting. The HR site shared with Everyone Except External Users in 2021. The old commercial lending folder inherited from a merged branch. The OneDrive full of exported core system reports.

Before Copilot, discovering that content required a user to know it existed and search for it. After Copilot, a teller asks "what is the average balance on our jumbo CD holders" and semantic search does the discovery work. Copilot also propagates sensitivity labels: content generated from labeled source material inherits the most restrictive label. That behavior only helps if labels exist in the first place, which is why Purview secure by default work has to land before the Copilot licenses do.

Layer 1: A sensitivity label taxonomy aligned to NPI and PII

Start here, because every other layer references labels. The most common failure at community banks and credit unions is a taxonomy with 14 labels and 6 sublabels that nobody can explain in an elevator.

Four top-level labels is usually right:

Public: marketing, rate sheets, published disclosures.
Internal: default label for all new content. Encrypts nothing, marks everything.
Confidential: sublabels for Member/Customer NPI, Employee PII, and Vendor and Contract. Encryption on, co-authoring enabled, external sharing blocked by policy.
Restricted: sublabels for Board and Executive, BSA/AML Investigations, and Examination Materials. Explicit user groups only, no external recipients, no printing for the exam sublabel.

Set Internal as the default label for documents and email, and set label ordering so that the most restrictive is highest priority. Turn on mandatory labeling for Office apps only after auto-labeling is producing accurate results, otherwise you train people to click the first option. Microsoft's sensitivity label documentation covers scope and precedence rules in detail.

Map labels to regulation, not to feelings

Write a one-page mapping that ties each label to GLBA Safeguards, NCUA Part 748 Appendix A, and your incident response plan. Examiners ask how classification connects to your written information security program. Having that mapping ready shortens the conversation considerably.

Layer 2: DLP policies scoped to financial data types

Out-of-the-box DLP templates are too broad and generate noise that kills the program in week three. Scope tightly instead.

The sensitive information types that matter for depository institutions: US Bank Account Number, ABA Routing Number, SWIFT Code, Credit Card Number, US Social Security Number, US Individual Taxpayer Identification Number, and Drivers License Number. Add Exact Data Match against an extract of your core account master if you want single-instance precision instead of pattern matching. EDM is the single biggest false-positive reducer available and most institutions never turn it on.

Layer 3: Auto-labeling for SharePoint and OneDrive

Client-side labeling depends on users. Service-side auto-labeling does not, which is what makes it the load-bearing wall of any Purview secure by default baseline.

Create auto-labeling policies that target your document libraries and all OneDrive accounts, using conditions built on the same financial sensitive information types from Layer 2 plus trainable classifiers for loan documents and financial statements. Run every policy in simulation mode through at least two full scan cycles. Review the matched items list personally. You will find at least one library where a legitimate business process trips the policy, and you want to know that before content starts encrypting.

Two practical notes. First, auto-labeling applies to files at rest, so budget calendar time for the initial scan across a multi-terabyte tenant. Second, pair auto-labeling with SharePoint Advanced Management's Restricted Content Discovery to exclude sensitive sites from Copilot's index while remediation is underway. That combination buys you a safe Copilot pilot without waiting for a full permissions cleanup.

Layer 4: Communication compliance for regulated roles

This layer gets skipped most often and it is the one that shows up in exam scope. Communication compliance monitors Teams, Exchange, and connected channels for policy violations across defined user groups.

Scope it to roles, not to everyone: lending officers, wealth and investment staff, BSA and fraud analysts, collections, and anyone with broker-dealer or insurance licensing. Start with three policies: sensitive information leaving the institution, inappropriate content and conflict of interest language, and regulatory conduct for licensed staff.

Configure dual-review so a single administrator cannot investigate and close their own alerts, and pseudonymize usernames during initial review. Get HR, legal, and your employee handbook aligned before you turn it on. Monitoring employee communications without documented notice creates a labor problem faster than it solves a compliance one.

Layer 5: Audit log retention aligned to FFIEC expectations

Audit (Standard) retains most activity for 180 days. That is shorter than the interval between many exam cycles and far shorter than the retention periods your record schedule likely requires for BSA-related activity. Audit (Premium), included with E5 and available as an add-on, extends Exchange, SharePoint, and Entra ID sign-in activity to one year, and to ten years with the additional license.

Build explicit audit log retention policies rather than relying on defaults. Prioritize file access and download events on Restricted-labeled sites, mailbox access by non-owners, label downgrade and justification events, DLP overrides, and eDiscovery activity. Microsoft's audit log retention policy documentation shows how to scope by record type and user. Cross-reference your retention decisions against the FFIEC IT Examination Handbook so the rationale is documented, not improvised in front of an examiner.

Sequencing a Purview secure by default rollout that does not stall

Order matters more than speed. The sequence that works: labels first, then DLP in test mode, then auto-labeling in simulation, then enforcement, then communication compliance, with audit retention configured on day one because it is cheap and retroactive gaps cannot be fixed later.

Four weeks is a realistic window for a 100 to 500 user institution with a clean-ish tenant. Week one is discovery and taxonomy design. Week two builds labels and DLP in test. Week three runs auto-labeling simulation and Copilot oversharing assessment. Week four enforces, documents, and hands off. The NIST SP 800-53 Rev. 5 control families give you a defensible structure for the documentation package your auditors will ask for.

Where the broader AI ecosystem fits

Copilot is not the only AI touching your data. Staff are pasting into Claude, ChatGPT, Gemini, and whatever tool their trade association demoed last month. A Purview secure by default baseline has to account for that.

DSPM for AI in Purview gives visibility into prompts and responses for Copilot and connected AI applications, and endpoint DLP can block uploads or clipboard pastes of Confidential content to sensitive service domains including generative AI sites. That is your control point for unsanctioned use.

For sanctioned use, pick the tool on merit. Anthropic's Claude Opus and Sonnet models are strong at long-document reasoning, which fits policy review and loan file analysis. OpenAI's models are widely integrated and often the pragmatic choice for developer tooling. Open-weight models like Llama and Mistral, hosted in Azure AI Foundry or another controlled environment, make sense when data residency rules out a public API entirely. The classification and DLP work you do for Copilot is what makes any of those options governable.

What Purview secure by default looks like when it is working

New documents carry a label within minutes of creation without anyone choosing one. External sharing of member NPI is blocked at the point of attempt, with a policy tip explaining why. Communication compliance alerts arrive at a manageable weekly volume and get reviewed by two people. Audit queries return results from 18 months ago. And when Copilot is enabled, the answers it returns are the answers that user was always entitled to see, nothing more.

That is a repeatable configuration, not a research project. The institutions that struggle are the ones treating Purview secure by default as a tooling exercise instead of a classification exercise with tooling attached.

Talk to CollabPoint

Want a second set of eyes?

Our team works with mid-market IT leaders to capture the upside of AI and the Microsoft cloud without the compounding risk. Start with a focused conversation.

Frequently asked questions

How long does it take to build a Purview secure by default baseline?

For a 100 to 500 user institution with a reasonably clean tenant, four weeks is realistic: one week for discovery and taxonomy design, one to build labels and DLP in test mode, one for auto-labeling simulation and a Copilot oversharing assessment, and one for enforcement and documentation. Tenants with heavy permission sprawl or unmigrated file shares should plan for six to eight weeks.

Do we need Microsoft 365 E5 for this?

Service-side auto-labeling, communication compliance, Audit (Premium), and endpoint DLP require E5 or the E5 Compliance add-on. Manual sensitivity labels and basic DLP for Exchange, SharePoint, and OneDrive are available in E3. Most banks and credit unions deploying Copilot end up on E5 Compliance because auto-labeling is the control that makes Copilot defensible.

Should we finish Purview before enabling Copilot, or can we run a pilot in parallel?

You can run a controlled pilot in parallel if you scope it. Use SharePoint Advanced Management Restricted Content Discovery to exclude sensitive sites from the Copilot index, limit the pilot group to 15 to 25 users in low-risk departments, and complete the labeling and DLP layers before any broad rollout. Enabling Copilot tenant-wide before classification exists is the mistake to avoid.

How many sensitivity labels should a credit union create?

Four top-level labels with two to three sublabels each. Public, Internal, Confidential, and Restricted covers nearly every scenario in a depository institution. Taxonomies with more than about eight total options see user selection accuracy collapse, which is another argument for auto-labeling doing the work.

What sensitive information types matter most for financial services DLP?

US Bank Account Number, ABA Routing Number, SWIFT Code, Credit Card Number, US Social Security Number, ITIN, and Drivers License Number. Adding Exact Data Match against an extract of your core account master dramatically reduces false positives compared to pattern-based detection alone.

How long should we retain Microsoft 365 audit logs for FFIEC purposes?

Audit (Standard) keeps most activity 180 days, which is generally too short. Audit (Premium) extends key record types to one year, with a ten-year add-on available. Set explicit retention policies for file access on Restricted sites, non-owner mailbox access, label downgrades, DLP overrides, and eDiscovery activity, and document the rationale against your record retention schedule.

Does Purview help govern non-Microsoft AI tools like Claude or ChatGPT?

Partially. DSPM for AI provides visibility into Copilot and certain connected AI applications, and endpoint DLP can block uploads or clipboard pastes of labeled content to generative AI domains in supported browsers. Full prompt-level governance of third-party models depends on the vendor's enterprise controls, so pair Purview endpoint policies with an approved-tool list and clear acceptable use guidance.

What is the most common mistake IT Directors make with this project?

Turning on enforcement before running simulation. Auto-labeling and DLP both support test modes for a reason. Skipping two full simulation cycles means the first time you learn a policy misfires is when a lender cannot email a closing package, and that single incident sets the program back months.