Purview Deployment Framework — visual model
An interactive, at-a-glance model of how this toolkit deploys the Microsoft Purview Data Security baseline — from pre-deployment preparation, through the safe + simulated deployment run, to post-deployment promotion and operation.
It exists so that anyone — a deployment lead, a reviewer, or a customer stakeholder — can understand the method and the goal in one screen, without reading the scripts: deploy safe, simulate, and only promote to enforcement after a human passes a Day-30 gate.
🎫 License-aware scope. Business Premium is the baseline floor, not the ceiling. The toolkit auto-detects the tenant’s licensing and applies the controls that licence supports. A BP tenant gets Exchange + SharePoint/OneDrive DLP and the core baseline; on an E5 / Microsoft Purview Suite tenant license detection automatically adds Endpoint DLP (device copy / print / USB, created in simulation) and AI governance (Copilot DLP). Higher-SKU extras like Premium Audit (
-EnablePremiumAudit) and retention (-ApplyRetention) stay opt-in. E5-only workloads are soft-skipped (not failed) on BP, and-BPOnlyhard-skips them even when the SKU is present.
Open the framework full-screen ↗ Download the standalone file ↗
💡 The framework below is a single self-contained HTML file (
Products/Purview/docs/Deployment-Framework.html). It has its own theme and needs no server, so you can share it on its own — email it, drop it in a deck appendix, or open it offline — and it still works.
What the model shows
The framework breaks the deployment into seven phases across three stages:
| Stage | Phases | What it means |
|---|---|---|
| 🟡 Pre-deployment | 0 · Prepare | Scope, prerequisites, pilot plan, customer change-management, and offline Deployment Plan review. No tenant changes yet. |
| 🔵 Deployment | 1 · Connect → 2 · Assess → 3 · Configure → 4 · Soak & Simulate | The app run. Zero-Trust connect, license-aware gating, idempotent baseline, and DLP created in simulation mode with zero user impact. |
| 🟢 Post-deployment | 5 · Promote → 6 · Adopt & Operate | The Day-30 human gate that promotes DLP from simulation to enforcement, then end-user adoption and ongoing operation. |
Click any phase in the framework to expand what happens, how the app does it (the method), the safety gate, and the rollback path.
At run start, the toolkit writes an offline Deployment Plan before
authentication. Its HTML and JSON files summarize config intent, compare
actions with the supplied Good, Better, and Best SMB guide, and retain the
Microsoft Learn Lightweight guide as a separate supporting reference. The
short plan reference identifies one artifact pair. The deterministic
fingerprint identifies equivalent intent. The plan does not inspect the tenant
or replace the tenant-aware -WhatIf review. Its JSON also carries a sanitized
intended-state snapshot as a stable handoff artifact for the dependent
tenant-validation feature. That feature is not an available operator workflow
until its stacked PR is reconciled with the finalized schema. The snapshot uses
Microsoft365Copilot for the documented public Copilot destination, records
privacy-safe classes and digests for custom AI locations, records only supported
retention destinations as deployable scope, records unsupported destinations
separately, and rejects invalid built-in label signatures before authentication.
The signature method
The whole model is built around one idea that makes tenant-wide change safe for an SMB:
DLP ships in simulation and only enforces after a Day-30 promotion gate.
Every phase also obeys five cross-cutting principles — idempotent read-modify-write, simulation-before-enforcement, least-privilege Zero-Trust auth, every-disposition-audited reporting, and irreversible-operations-are-opt-in. These are the same conventions the codebase itself is held to.
Where the detail lives
The framework is a map, not the territory. Each phase links to the authoritative docs:
- Scenarios & Capabilities — what every task does and what’s out of scope.
- Configuration Reference — every
PurviewConfig.psd1knob and how to change it. - Change-Management Playbook — the day-by-day delivery runbook.
- DLP Simulation Exit Runbook — the Day-30 promotion gate.
- Retention Default — Risk Note — before you pass
-ApplyRetention. - End-User Adoption Guide — the T-7 / T-0 / T+30 comms.
- Configuration Validation: read-only post-deployment readback against a Deployment Plan.