Microsoft Purview Reviews
Most organisations running Microsoft 365 have access to Microsoft Purview. Most have not configured it effectively, and some have not configured it beyond the defaults.
The compliance problem is not always visible. Purview contains the controls for data classification, retention, data loss prevention, and audit logging across your Microsoft 365 environment. If those controls are absent or misconfigured, there is a gap in your compliance position that does not show up in a surface-level review.
The incident response problem is more immediate. When a personal data breach occurs in a Microsoft 365 environment, the question is what data was accessed, by whom, and what can be evidenced. Organisations with a well-configured Purview environment can answer it. Organisations without one often cannot. The ICO notices the difference.
Clark & Company reviews your Purview configuration against your data protection obligations and returns a clear report of gaps, risks, and recommended actions. The review is scoped to what you are licensed for. No E5 assumptions are made.
What a Purview Review Covers
The scope is determined by your current licensing. Core Purview features are available at Microsoft 365 A3 and E3. Advanced features require E5, A5, or the Purview Suite add-on. The review covers what you have access to.
Data classification and sensitivity labels. Whether classification policies and labels are configured, whether they reflect your data types and risk profile, and whether they are being applied consistently.
Retention policies. Whether retention policies are in place for key data types, whether they reflect your legal obligations, and whether gaps exist that could result in data kept beyond what is required or deleted when it should be preserved.
Data loss prevention. Whether DLP policies are configured to prevent inappropriate sharing of personal data or special category data, and whether those policies are enforcing consistently across your environment.
Audit logging. Whether logging is enabled, what activities are being captured, and whether the audit trail is sufficient to support investigation of a breach or a subject access request.
Communication compliance and insider risk. Where advanced features are licensed, whether they are configured proportionately and defensibly under data protection and employment law.
Licence position. Which Purview features are available under your current licence, which are not, and whether material compliance gaps exist as a result of licensing constraints.
What is Included
Configuration review. A structured review of your Purview configuration, conducted remotely with read-only access. No changes are made to your environment during the review.
Gap and risk report. A written report identifying configuration gaps, misconfigured controls, and areas where the current setup creates compliance or incident response risk. Findings are prioritised by significance.
Recommended actions. For each finding, a specific recommended action with enough detail for your IT team to implement. Where actions require tenant administrator access, they are documented clearly for handover.
Licence mapping. A summary of which features are available under your current licence, which are not, and whether the gaps are significant.
Senior practitioner delivery. The review is delivered by a practitioner with direct experience of Purview in education and public sector Microsoft 365 environments. Findings are interpreted in context.
Frequently Asked Questions
What access do you need?
Read-only access to the Microsoft Purview compliance portal. We will provide the specific roles or permissions required. No changes are made to your tenant configuration during the review.
We are on A3 or E3. Is the review still useful?
Yes. A3 and E3 include audit logging, basic DLP, sensitivity labels, and retention policies. The review identifies how effectively those features are configured and whether your compliance obligations are being met at your current licence level.
Can you implement the changes as well?
Implementation is outside the scope of the review. The report provides specific guidance for your IT team. Where implementation needs further support, Clark & Company can scope that separately.
How does this relate to data protection compliance?
Purview is a set of technical controls, not a compliance product in isolation. What those controls need to do is determined by your UK GDPR obligations. The review is conducted with that context in mind. The question is whether Purview is configured in a way that supports your compliance position, not just whether it is switched on.
Will this help us respond to an ICO inquiry?
A well-configured Purview environment strengthens your ability to respond to subject access requests, demonstrate compliance with retention obligations, and reconstruct events after a personal data breach. The review identifies where your current configuration would undermine that.