Microsoft Purview Information Protection
Sensitivity labels and encryption that travel with the file — and if you hold Microsoft 365 E3, you already own the foundation. In most estates we look at, it is sitting unconfigured. Check what you have before you buy anything else in this category.
Buy through TechBag
Same software. Better outcome — at a lower cost.
How it’s rated
Full scoreboard ↓Data residency & processing — not the same question
Where data lives
India IS available — under Advanced Data Residency
India is an eligible Local Region Geography, and Information Protection is within ADR scope as of February 2026. In a category where most vendors have no India region at all, that is a real differentiator. The conditions are strict: ADR must be purchased for ALL users in the tenant, and the tenant default geography must be India.
Where it is processed
Microsoft’s cloud — unless you use DKE
Residency governs where data rests, not who can decrypt it. If your requirement is that Microsoft itself must not be able to read the content, that is Double Key Encryption — you hold one of two keys — and its functional costs are severe. See the FAQ before planning around it.
Residency and decryptability are two different questions, and buyers routinely settle the first while assuming they have answered the second. ADR puts in-scope data at rest in India; it does not mean Microsoft cannot read it. Double Key Encryption does, at the cost of co-authoring, SharePoint and OneDrive processing, search, eDiscovery and Copilot — which makes it right for a small set of genuinely critical documents and wrong as a default posture. Decide which question your regulator is actually asking before you scope either.
Quick answer
The Microsoft platform family
This page covers Microsoft Purview Information Protection — the SIEM. The other pillars:
Quick facts
30-second orientation- Product
- Microsoft Purview Information Protection
- Former names
- Azure Information Protection → MIP → Purview IP
- Retired April 2024
- The AIP unified-labeling Office add-in
- In E3
- Manual sensitivity labels + RMS encryption
- Needs E5
- Auto-labelling, trainable classifiers, EDM, Double Key Encryption
- Published price
- $12/user/mo Purview add-on over E3; E5 $60 (July 2026)
- Data residency
- India IS an eligible Local Region Geography under ADR
- The condition
- ADR for ALL users, and tenant default geography = India
- Data processing
- Microsoft's cloud; DKE lets YOU hold the second key
- Protection travels
- Yes — the label and encryption follow the file
- Revocation
- PARTIAL — see the FAQ; it is not absolute
- Recipient software
- Mixed — one-time passcode for email, viewer for files
- Buy in India via
- TechBag — INR, GST, licence-entitlement audit first
Understand your licence entitlement before you buy it
Most product pages skip this. We start here — so you buy a capability, not a buzzword.
What is it?
Sensitivity labels plus encryption inside Microsoft 365 — a classification attached to the file itself, and protection enforced by Azure Rights Management wherever the file travels.
Manual labelling vs automatic labelling’s — the honest table
What consolidation actually replaces, dimension by dimension.
| Dimension | No / separate AI tool | Microsoft Purview |
|---|---|---|
| Pricing axis | Per device or per user | Per GB ingested per day |
| Microsoft logs | Paid like any other source | Azure Activity, M365, XDR alerts free |
| High-volume logs | Full rate or drop them | Data lake tier at a fraction of analytics |
| Infrastructure | Servers, storage, upgrades | SaaS on Azure — nothing to run |
| Where protection stops | At your network boundary | It travels with the file |
| Retention | Priced from day one | 90 days included, then charged |
| Honest caveat | — | Third-party ingest escalates the bill |
| Best fit | — | Microsoft-standardised estates |
Rights management for Microsoft estates — for non-Microsoft log volume, on-prem or air-gapped, weigh Splunk or Elastic (TechBag sells Splunk).
What does auto-labelling actually cost?
Vendors love diagrams; buyers need to know what they’re actually operating. Here’s the whole platform, demystified.
Sensitivity labels
A label records how sensitive something is and stays attached to the file. Users can apply labels on any Microsoft 365 licence; automatic labelling needs E5.
Azure Rights Management
This service enforces a label’s protection: it encrypts content and checks each time it is opened whether that identity is still permitted, wherever it is.
Auto-labelling
Labels applied by rule across Office, Exchange, SharePoint and OneDrive. This is the E5 feature that matters most, because manual labelling is inconsistent.
Trainable classifiers
Machine-learning classifiers recognise document types by example, such as contracts or source code, where content has no reliable pattern to match.
Double Key Encryption
Two keys protect content, one held by Microsoft in Azure and one by you, so neither can decrypt alone. It disables substantial functionality.
Advanced Data Residency
India is an eligible Local Region Geography, with Information Protection in scope from February 2026, but ADR must cover all users and the tenant default must be India.
One label that travels with the content — applied by rule or classifier, enforced by Rights Management wherever the file goes.
Ten capabilities. Classify, detect, respond.
Purview attaches a sensitivity label to a document and enforces encryption that travels with it — so protection survives the file leaving your organisation, which is the one thing location-based security cannot do.
Sensitivity labels
Attach a classification to a file or email that travels with it, rather than depending on where it is stored.
Manual labelling in E3
Users apply labels themselves — available on licences you very likely already hold, and applied about as often as you would expect.
Automatic labelling (E5)
Labels applied by rule in Office clients or service-side across Exchange, SharePoint and OneDrive, removing the dependency on users remembering.
Trainable classifiers (E5)
Recognise document types by example rather than pattern — useful where sensitive content has no reliable regular expression.
Exact Data Match (E5)
Match against your actual sensitive values rather than a generic pattern, which cuts false positives sharply.
Encryption via Azure RMS
Encrypt the content and re-check authorisation each time it is opened, wherever it has travelled to.
Usage rights
Control whether a recipient can edit, copy, print or forward — not merely whether they can open it.
Double Key Encryption (E5)
Hold one of two keys yourself, anywhere including on-premises, so Microsoft alone cannot decrypt the content.
Message Encryption
Send protected email to external recipients who authenticate with a one-time passcode and need no software installed.
Track and revoke
See who opened a document and attempt to revoke access after distribution — with real limits, set out in the FAQ.
AI works best where the work already happens.
Here’s what genuinely sets Purview apart (and where it does not) — starting with the fact that you may already own the foundation.
You may already own the foundation
Check this first: manual sensitivity labels and Rights Management encryption are included in Microsoft 365 E3. If you hold E3 or above it’s already paid for, and in most organisations we see, unconfigured. We would rather run that licence audit and sell you nothing than sell what you already pay Microsoft for.
Protection that travels, enforced per open
Rights management differs from encryption at rest: protection is attached to the file, not where it lives. A labelled document emailed outside, copied to a personal drive or forwarded stays encrypted, and every open triggers an authorisation check — something key management and disk encryption cannot do.
Automatic labelling is what turns a policy into a control
Manual labelling relies on users classifying correctly every time, so it reaches a minority of documents, inconsistently. Automatic labelling — E5, or the Purview add-on — applies labels by rule in the Office client and service-side across Exchange, SharePoint and OneDrive. That is the strong case for stepping up from E3.
A genuine India residency answer, with conditions
India is an eligible Local Region Geography under the Advanced Data Residency add-on, with Information Protection in scope as of February 2026 — rare in this category. The conditions are strict: ADR for all users in the tenant, and an India default geography. Confirm both, in writing if a regulator will ask.
The honest caveat: revocation is partial, and DKE is expensive in function
Revocation isn’t absolute: revoked files stay readable until the offline policy period expires, and files uploaded to SharePoint or OneDrive can’t be tracked or revoked. Double Key Encryption breaks co-authoring, search, eDiscovery and Copilot, skips Teams, and is Windows Office only — for a few critical documents, not a default.
The honest positioning
Purview fits a Microsoft estate whose documents are leaving: near-free starting licences, real India residency, unmatched app integration. Outside Microsoft the value collapses; Seclore’s format breadth including CAD is stronger; database and application key custody is Thales or Entrust. We sell all of them; the licence audit comes first.
The numbers behind the platform
What your Purview Information Protection rollout looks like
Audit what you already own
Manual labels and RMS encryption come with E3. Check what your licences already include and configure before buying more.
Settle the residency conditions
India qualifies under Advanced Data Residency, but only with ADR for all users and India as tenant default. Confirm both.
Design the label taxonomy before deploying it
Too few labels and nobody classifies accurately; too many and nobody classifies. Four or five is usually right.
Pilot auto-labelling before rolling out manual
Pilot automatic labelling first: it shows what rules catch and miss, which is the evidence for the E5 or add-on spend.
Reserve DKE for the documents that genuinely warrant it
Double Key Encryption disables co-authoring, search, eDiscovery and Copilot, so limit it to a few critical documents.
The review scoreboard
Modelled on Gartner Peer Insights structure. *Counts and breakdowns are illustrative pending verified review collection.
Quick poll — what’s driving your evaluation?
Talk to an advisor“We were about to buy a rights-management product and discovered E3 already included the basics. Nobody had switched it on.”
“Auto-labelling is the whole product. Manual labelling got applied to maybe one document in ten.”
“Double Key Encryption works and it costs you co-authoring, search and Copilot. Use it on the few files that warrant it.”
“Advanced Data Residency answered our India question, but read the conditions — it has to be every user in the tenant.”
“Revocation is not what people assume. Test the SharePoint case specifically before you promise it to anyone.”
Where everyone sits — the grids
Analyst firms bury this view behind paywalls, and review-site grids score satisfaction, not fit for your estate. So here’s TechBag’s synthesis of the endpoint-security (EDR/XDR) market — tap any vendor to see why it sits where it does.
TechBag Data Protection Grid
Execution strength vs product vision — the classic market map, minus the paywall.
Native to the estate; you may already own it.
Key Custody × Document Protection
The grid nobody publishes — The grid nobody publishes — how much key custody and encryption control you keep vs how deep the document protection goes.
Deepest inside Microsoft 365; narrower outside it.
Positions are TechBag’s illustrative synthesis of public review-platform data and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
Microsoft Purview vs the field
The rights-management field — honest lanes; the edge is free first-party ingest + one incident queue with Defender. Deepest search, or on-prem? Splunk. We say so (and sell it).
| Dimension | Microsoft Purview | Seclore | Thales | Entrust | Trellix |
|---|---|---|---|---|---|
| What it actually is | Document rights management inside Microsoft 365 | India-built EDRM | Key management and hardware custody | HSM, private PKI and identity | Endpoint and database encryption |
| Protection travels with the file | Yes — label and encryption follow it | Yes, with stronger revocation | No — protects infrastructure, not documents | No | No — at rest on the device |
| Revocation after distribution | PARTIAL — offline window; lost on SharePoint upload | Documented | Not applicable | Not applicable | None |
| Already in your licences? | Manual labels + RMS are in E3 — check first | Separate purchase | Separate purchase | Separate purchase | Separate purchase |
| Published pricing | $12/user/mo add-on over E3; E5 $60 | Quote (INR) | Quote-only | Quote-only | Quote-only |
| Who holds the keys | Microsoft — unless you use Double Key Encryption | Either — SaaS or self-hosted | You, in hardware if you want | You, in hardware | You |
| India data residency | India is an ADR Local Region Geography | India-built; SaaS or self-hosted | On-premises — no India SaaS region | On-premises — no India SaaS region | Unverified |
| Format breadth | Strong on Office and PDF; narrower beyond | Office, PDF, CAD and arbitrary formats | Any — it encrypts storage, not documents | Any | Any |
| Best fit | Microsoft estates — start here, you may own it | Broad formats, India-built, stronger revocation | Key custody for databases and applications | Where BIS certification is a procurement gate | Endpoint and database encryption at rest |
Does Microsoft Purview fit you?
Honest fit signals — because the fastest way to lose your trust is to pretend one product wins every scenario.
Choose Purview Information Protection if…
- ✓You are a Microsoft estate — the integration and the entitlement both favour starting here
- ✓Manual labels in E3 are already yours, and you want to find out what you own before buying
- ✓Your documents are mostly Office and PDF, which is where Microsoft’s coverage is strongest
- ✓India residency matters and you can meet the ADR conditions — all users, tenant geography India
Choose Seclore instead if…
- ✓You need revocation that is documented rather than partial
- ✓Your formats go beyond Office and PDF — CAD and engineering files especially
- ✓You want an India-built vendor with the keys, the support and the invoicing in-country
Choose Thales or Entrust if…
- ✓Your problem is key custody for databases and applications, not documents leaving
- ✓A regulator asked who can decrypt, and you need hardware you own to answer it
- ✓Entrust specifically where Bureau of Indian Standards certification is a procurement gate
Buy nothing yet if…
- ✓You have not audited what your existing Microsoft licences already include
- ✓Nobody has switched on the manual labelling you are already paying for
- ✓TechBag will run that audit and tell you if the answer is that you need nothing
Microsoft Purview Information Protection is one of 22 encryption & rights management products TechBag carries. The encryption & rights management guide narrows them to a shortlist and shows the reasoning. →
What will your ingest actually cost?
You already own manual labelling if you hold E3, so the only question worth modelling is whether automatic labelling justifies the step up. Move the second slider honestly: manual labelling typically reaches a small minority of the documents that need it, because it depends on a person classifying correctly while doing something else. The published rate is $12 per user per month for the Purview add-on over E3, against $60 for full E5. Indicative INR conversion at 83.
Free first-party sources — Azure Activity, Microsoft 365 audit logs and Defender XDR alerts — are excluded from both figures, so count only your billable GB. The commitment rate applies at 100 GB/day and above. Illustrative: your TechBag quote models your real sources.
Three ways to consume it
Purview has published pricing, which is rare in this category: the Microsoft 365 E5 Compliance add-on is $12 per user per month over E3, and full E5 is $60 following the July 2026 increase. What matters more than either number is what you already hold — manual sensitivity labels and RMS encryption are in E3, so the real question is whether automatic labelling justifies the step up. TechBag runs that entitlement audit before quoting anything.
Analytics tier — pay-as-you-go
Best for starting out or low volume
- ~$4.30/GB ≈ ₹361/GB ingested (East US)
- 90 days retention included, then charged
- No commitment; switch to a tier any time
Analytics tier — commitment
Best above ~69 GB/day
- ~$2.96/GB ≈ ₹249/GB at the 100 GB/day tier (~31% off)
- Tiers run to 50,000 GB/day (~$2.05/GB at the top)
- Break-even vs pay-as-you-go is ~69 GB/day
Data lake tier
Best for high-volume, low-value logs
- ~$0.05/GB ≈ ₹4/GB to ingest; ~$0.026/GB/month to store
- Storage billed on a 6:1 compression basis
- KQL queries ~$0.005/GB scanned
Buy it for less — TechBag pricing beats list
Whatever the list prices above, TechBag negotiates a significantly better deal — with GST-compliant INR invoicing and local support. Ask us for your discounted quote.
Get an India-ready quote
Tell us your requirements and current tools — we’ll model it against what you spend today.
The 10 questions to ask every data-protection vendor
Take this into your next vendor call — including ours.
What do our existing Microsoft licences already include, and is any of it configured?
Do we need auto-labelling enough to justify E5 or the $12 add-on over E3?
Have we purchased ADR for ALL users, and is our tenant default geography India?
Have we tested revocation on a file uploaded to SharePoint, where tracking is lost?
Which specific documents warrant DKE, given it disables search, Copilot and co-authoring?
How many labels? Four or five usually works; more than that and nobody classifies.
Do our recipients need software? Email uses a one-time passcode; files need the viewer.
Does Microsoft cover the file types we actually need protected, including any CAD or engineering formats?
Is our problem documents leaving the organisation, or key custody for databases? Different products.
Who drives labelling — automation, or users remembering? The second one does not work.
Questions buyers ask
Ready to evaluate Microsoft Purview?
Find out what your Microsoft licences already include before you buy anything. We will run the audit and tell you if the answer is that you need nothing.
Stats, ratings, review counts and pricing are illustrative and sourced from public materials; verify before purchase.