Microsoft Purview Best Practice Toolkit · Delivery Edition

Change-Management Playbook

The script handles the engineering. This playbook is what makes it safe in production. Several defaults have customer-visible consequences the moment they take effect — silent labelling on every new document, 7-year mail deletion, DLP blocking external sends. Follow this timeline so the deploy lands as a planned change, not a help-desk ticket generator.

Audience: the deployment lead (a partner/MSP consultant or in-house IT). For the end-user-facing companion (what employees see + ready-to-send comms), see the End-User Adoption Guide.
Deploy-team action Needs business input Decision gate
📋
Phase 0 · T-7 days

Pre-deploy — plan the change

Nothing touches the tenant yet. This phase exists to make the rest predictable.

  • Confirm tenant SKU — Business Premium vs E5 / Purview Suite. Decides whether -BPOnly is needed; AI governance is default-on for E5 / Purview Suite.Deploy team
  • Confirm vertical & regulatory framework — decides whether to enable retention and at what duration (7-year delete is opt-in).Deploy + business
  • Inventory current Purview state — existing labels / DLP / retention. Decide -AdoptExisting vs rename/archive.Deploy team
  • Identify B2B guest exposure — routine external guests change the encryption scope picture.Deploy + business
  • Pick a pilot mailbox / site for retention & DLP simulation review.Deploy + business
  • Schedule the deploy window AND the day-30 review in the same calendar invite.Deploy team
  • Draft user comms — sent the day before deploy.Deploy team
  • Review the offline Deployment Plan generated before authentication. Confirm scope, opt-ins, conditional licensing, and Good / Better / Best guide coverage.Deploy team + reviewer

Decisions to lock before you run the script

  • -BPOnly · -SkipAIControls · -ApplyRetention (+ duration) · -SkipContainerLabels
  • -EnablePremiumAudit (+ mailboxes) · -EnableLabelCoAuthoring (one-way!)
  • EnableContentMarking in config — leave $false for initial deploy; flip after day-30
🚀
Phase 1 · T-0

Day-of deploy

Preview, apply during the agreed window, and verify simulation mode before anyone notices.

  • Save the Deployment Plan HTML + JSON written before authentication. Keep the plan reference, sanitized intended-state snapshot, primary SMB tier, and supporting Microsoft Learn comparisons. It describes config intent, not tenant state.
  • Run with -WhatIf first; capture the full transcript.
  • Diff the preview against the Phase 0 inventory — nothing unexpected created/adopted.
  • Run in apply mode during the agreed window.
  • Save the deploy log + preflight banner to the customer record (audit trail).
  • In the Purview portal, confirm objects exist and are stamped [Managed by SMBTool Purview Toolkit].
  • Verify DLP simulation mode — one policy should read "Test with notifications off". Zero user impact day one.
  • Send the "deploy complete" comms.

Common day-of surprises

  • Connect-SPOService clashes when EXO/Graph/Az/PnP are pre-loaded — pass -SharePointAdminUrl on vanity-UPN tenants.
  • Set-Label -Priority throws on pre-existing top-level labels — audit existing labels in Phase 0.
  • IPPS can report success before settings are live — wait 5–10 min and refresh; the script retries known races.
🔎
Phase 2 · Day 1–5

Soak & monitor

Labels are live; DLP only observes. Watch the signals before anything enforces.

  • Day 1 AM: check the helpdesk queue for Purview-related tickets.
  • Day 1: confirm General \ Anyone (unrestricted) is the Outlook default and Confidential\AllEmployees the Office default.
  • Day 1–3: pilot owner sends a labelled doc externally — confirm the hit shows in Activity Explorer (no block — simulation).
  • Day 3: review Activity Explorer for unexpected match patterns (often a customer process, not a bug).
  • Day 5: spot-check audit-log entries to confirm UnifiedAuditLog captures label events.

What the customer sees this week

  • Users will see new labels in Outlook / Word / Excel / PowerPoint on day 1.
  • They will not be blocked from anything yet (DLP is in simulation).
  • Footers / watermarks are not shown unless EnableContentMarking = $true (off by default until day-30).
🚦
Phase 3 · Day ~30 · THE GATE

Promote-from-simulation gate

The conversation most deploys skip — and the one that decides whether DLP becomes real protection or shelfware.

Inputs to the conversation

  • DLP Activity Explorer report — "what would have been blocked" (see the DLP Simulation Exit Runbook).
  • Helpdesk ticket count related to labels / DLP since day-of.
  • Pilot feedback — any complaints about labels, footers, or anything else?
DecisionOptionsHow to action
Promote DLP out of simulation?Promote / extend / refine firstFlip DlpStartInSimulation = $false & re-run, or toggle per policy in portal
Turn on content marking?Yes / noFlip EnableContentMarking = $true & re-run
Tighten Endpoint DLP (E5)?Audit → Block / WarnEdit EndpointDlpRestrictions[].Value & re-run
Reconfirm retentionEnable / keep off / change duration-ApplyRetention on re-run, or edit Retention.DurationDays
Add SPO / OneDrive to retention?Yes / noAdd to Retention.Locations

Output (don't skip)

  • A signed-off "Phase 3 outcome" note on the customer record listing the decisions + the timestamp of the re-run. Without it, nobody can later answer "is this tenant production-grade Purview, or still in simulation?"
✅
Ongoing

Operate & re-run

The deployment is idempotent — re-run any time to verify or extend the baseline.

  • Send the Day +30 adoption comms (enforcement is now live for promoted policies).
  • Keep the deploy reports as the configuration baseline + audit trail.
  • Any future change re-enters this same simulate-then-promote method.

Known sharp edges — cover these in Phase 0

Not bugs — defaults that are correct technically but need a customer conversation.

Encrypted-label rights are tenant-scoped, not retroactive

The {TenantDomain} token scopes HC encryption rights to your tenant's users only (excludes external B2B guests). Tightening the template does not revoke access on files labelled earlier — owners must re-apply the label.

"Trusted People" / "Specific People" labels prompt the user

The two UserDefined sub-labels (Confidential\TrustedPeople, Highly Confidential\Specific People) apply UserDefined encryption — the author picks recipients each time (Trusted People: Encrypt-Only, recipients can reshare; Specific People: Do Not Forward). Expect a prompt; it's by design.

Co-authoring is a one-way switch

-EnableLabelCoAuthoring moves label metadata out of custom properties. Disabling later is PowerShell-only and loses labels on unencrypted Office files; older AIP scanner / OneDrive sync / MIP SDK / custom scanners break. Only enable after confirming none are in use.

Mandatory labelling prompts on save/send

Every Office app prompts for a label before saving a new doc or sending new mail. This closes the untagged-content hole DLP/Copilot rely on — but tell users first (training beats surprise).

Full detail, including the rights bundles and mitigations, is in the text version below this guide.