Microsoft 365 data governance checklist — DLP, sensitivity labels, retention, eDiscovery

← All articles

Why data governance matters in Microsoft 365

Microsoft 365 is where most organisations store their most sensitive data — contracts, financial records, personnel files, customer information, strategic plans. The platform provides the tools to protect, classify, retain, and audit that data through Microsoft Purview. The problem is that most of those tools ship unconfigured and require deliberate activation before they do anything.

The result is that data governance in most Microsoft 365 tenants exists on paper — the licences are in place but the policies, labels, and retention rules have never been created. A regulatory inquiry, a legal hold request, or a data loss incident then reveals the gap that was quietly there the whole time.

Data Loss Prevention (DLP)

DLP policies in Microsoft Purview detect and prevent the sharing of sensitive content — credit card numbers, national insurance numbers, health data, confidential documents — across Exchange, SharePoint, OneDrive, Teams, and endpoints.

Key things to check:

• DLP policies should cover all workloads, not just Exchange. Many tenants create one email DLP policy and leave SharePoint and Teams uncovered
• Endpoint DLP (for devices managed by Intune) is a separate feature that requires explicit configuration
• Policies in simulation mode provide visibility but do not prevent anything — check how many policies are enforced versus monitoring only

Sensitivity labels

Sensitivity labels let you classify documents, emails, and meetings according to their confidentiality level — Public, Internal, Confidential, Highly Confidential. Labels can apply encryption, access restrictions, and watermarks automatically when content is classified.

Key things to check:

• Labels must be published to users before they appear in Office apps — creating labels in the Purview portal is not sufficient
• Auto-labelling policies can classify existing content in SharePoint and Exchange based on sensitive information type detection, but must be configured separately from manual label policies
• Copilot interactions can be scoped by sensitivity label — ensuring Copilot cannot access highly confidential content requires label-based access controls to be in place first

Retention policies

Retention policies define how long content is kept and when it is deleted. Microsoft 365 content that is not subject to a retention policy follows no structured lifecycle — it can be deleted by users at any time and is gone permanently once removed from the recycle bin.

Key things to check:

• Exchange email retention should cover at minimum 1 year for most regulated industries
• Teams chat messages and channel messages require separate retention policies from Exchange — a common gap is email covered but Teams conversations not retained
• SharePoint and OneDrive require their own policies — document retention is separate from email retention
• Retention labels (applied per document) and retention policies (applied by location) serve different purposes — both should be in use for a complete strategy

Audit logging

Unified audit logging in Microsoft 365 records admin and user activity across Exchange, SharePoint, OneDrive, Teams, Entra ID, and other services. It must be explicitly enabled — it is not on by default in all tenant configurations.

Microsoft 365 E5 or Purview Audit (Premium) extends audit log retention from 90 days to 1 year and adds additional log categories including Copilot AI interaction logs. Without the premium tier, audit logs are deleted after 90 days.

eDiscovery

eDiscovery Standard (included from E3) allows content search across Exchange, SharePoint, and Teams and supports legal holds — preserving content that would otherwise be deleted or modified. eDiscovery Premium (E5) adds custodian management, predictive coding, and case analytics.

Key things to check:

• eDiscovery cases should be created before you need them — trying to configure eDiscovery during an active legal matter is significantly harder
• Legal holds must be applied to custodians explicitly — retention policies and legal holds are separate mechanisms
• Verify that eDiscovery administrators are configured — the default Global Administrator access to eDiscovery is not always appropriate for separation of duties

What M365Clarity checks in the Data Governance tab

The Data Governance tab in M365Clarity runs 23 checks across DLP policies, sensitivity label publication, auto-labelling, retention label and policy coverage, eDiscovery case and hold status, audit log activation, audit retention tier, insider risk management policies, and Compliance Manager score. Each finding is rated Red, Amber, or Green with plain-English remediation guidance.

Related articles