Tool profile
Microsoft Purview: cost, fit and limits
Microsoft Purview is a data security and compliance suite made by Microsoft whose data loss prevention component applies policies to Exchange, SharePoint, OneDrive, Teams, Windows and macOS devices, on-premises file shares and web traffic. It is licensed through Microsoft 365 plans and the Purview Suite and managed from the Purview portal.
What to know first
Microsoft Purview DLP is best understood as a policy layer that follows Microsoft 365 workloads. Its documentation is public and detailed, down to which locations are in preview and how long alerts stay in each dashboard. The difficult part is not technology but licensing, since the DLP page sends readers to Microsoft 365 enterprise plans and service descriptions rather than showing a price for the component.
Microsoft Purview at a glance
| Maker | Microsoft, Not verified |
|---|---|
| Free plan | Free trial only |
| Entry price | Quote only |
| API access | No |
| Category | Best AI Data Loss Prevention Software in 2026, rank 9 of 10 |
| Website | microsoft.com/en-us/security/business/microsoft-purview |
Who Microsoft Purview is best for
Microsoft 365 E5 customers
The Purview overview points to Microsoft 365 E5 and the Purview Suite as licensing routes, so organizations already on E5 may hold DLP rights without a new contract.
Teams that need a safe rollout path
Policies can run in simulation mode, where actions are not applied, so the effect on users can be measured before warnings or blocks start.
Security operations centers on Defender
DLP incidents can be investigated in the Microsoft Defender portal, where alerts stay for six months, which keeps data loss and threat investigations in one queue.
Organizations governing Copilot use
The documentation lists Microsoft 365 Copilot and Copilot chat as a preview location for DLP policies, alongside web destinations such as ChatGPT and Gemini.
Microsoft Purview plans and pricing
| Plan | Price | What it includes |
|---|---|---|
| Microsoft 365 E5 | Priced by Microsoft; not shown on the Purview pages | One of the licensing routes named on the Purview overview page for the data security and compliance suite. |
| Purview Suite | Not shown on the pages read | Described as the fit for user-based protections; the DLP documentation refers readers to Microsoft 365 licensing guidance for exact entitlements. |
| Pay-as-you-go | Metered; rates not shown on the pages read | Described on the overview page as the fit for data estates, analytics and AI apps rather than per-user protections. |
Checked November 2026.
What Microsoft Purview does
- Policy locations
- A DLP policy can target Exchange email, SharePoint sites, OneDrive accounts, Teams chats, Windows 10 and 11 devices, the three latest macOS versions, on-premises file shares, and Fabric and Power BI workspaces.
- Inline web and AI coverage
- Edge for Business and network options cover ChatGPT, Gemini, DeepSeek and Microsoft Copilot, and the network option reaches over 35,000 apps in the Defender for Cloud Apps catalog.
- Protective actions
- Policies can show a tip, block with a justified override, block outright, quarantine data at rest or hide sensitive text in Teams chat. Every monitored activity lands in the Microsoft 365 audit log.
- Simulation mode
- Rules can run without enforcement, with results reviewed before enabling. The documentation notes that policies generally take effect about an hour after being turned on, so tuning cycles are not instant.
- Copilot in Purview
- Copilot in Microsoft Purview lets an analyst use natural language to uncover risks and investigate issues, according to the overview page. Its licensing needs were not detailed on the pages read.
How Microsoft Purview handles your data
The DLP documentation states that all monitored activities are recorded to the Microsoft 365 audit log and that alerts stay 30 days in the Purview alerts dashboard and six months in the Defender portal. Activity Explorer shows the last 30 days. The privacy statement names Microsoft Corporation in Redmond and, for the EEA, UK and Switzerland, Microsoft Ireland Operations Limited as controller. Tenant data residency, retention beyond these windows and AI training terms were not covered on the pages read, so the vendor's policy was not checked for this.
Where Microsoft Purview falls short in practice
- Licensing is spread over several documents. The DLP page defers to Microsoft 365 enterprise plans and service descriptions. A buyer has to map which of E5, the Purview Suite or pay-as-you-go covers endpoint DLP, alerts and Copilot locations.
- Several locations are still in preview. Non-Microsoft connected apps such as Box, Dropbox, Google Workspace and Salesforce, plus Copilot coverage, carry a preview label. Production policies should not rest on them until the status changes.
- Existing mail is not scanned. The documentation says DLP does not scan or match email items already stored in a mailbox or archive; it only evaluates new messages. SharePoint and OneDrive items are scanned retroactively.
- Platform support is narrow on devices. Endpoint policies list Windows 10, Windows 11 and the three latest macOS versions. Linux laptops are not listed, so mixed fleets need a second control.
Works with
Alternatives to Microsoft Purview
Microsoft Purview: common questions
Does Purview DLP cover ChatGPT and Gemini?
The documentation lists OpenAI ChatGPT, Google Gemini, DeepSeek and Microsoft Copilot as inline web destinations, reachable through Edge for Business or network data security. Over 35,000 further cloud apps are reachable through the network option only. Confirm which option your browsers and network allow.
What does Microsoft Purview DLP cost?
The pages read show no price for DLP. The overview names Microsoft 365 E5, the Purview Suite and pay-as-you-go as routes, and the DLP page refers to Microsoft 365 licensing guidance. Ask a Microsoft partner to map your current licenses to the features you plan to enable.
Can Purview DLP run without blocking users at first?
Yes. Simulation mode evaluates a policy and records matches without applying its actions, and Microsoft advises testing there before moving to restrictive modes. The documentation says policies usually take effect about an hour after they are turned on. Review the preview labels on each location before relying on it.
How long are Purview DLP alerts kept?
Alerts stay for 30 days in the Purview DLP alerts dashboard and six months in the Microsoft Defender portal. Activity Explorer shows the last 30 days of events. If your audit needs longer evidence, plan an export to a SIEM such as Microsoft Sentinel.
Which devices does Purview endpoint DLP support?
The documentation lists Windows 10, Windows 11 and the three most recent versions of macOS for device policies. Linux is not listed. Windows devices that are not onboarded can still be covered inline through Microsoft Edge for Business. Check the supported macOS versions before rollout.