Skip to content
All projects
Compliance · Insider RiskHome Lab

Microsoft Purview Communication Compliance

Policy-driven detection of sensitive information and code-of-conduct risk across Exchange, Teams and Viva Engage, with a full reviewer investigation and remediation workflow.

Microsoft PurviewCommunication ComplianceInsider RiskExchangeMicrosoft TeamsViva Engage

Difficulty

Advanced

Environment

Microsoft 365 / Purview

Deployment

Home Lab

Est. Implementation

1 week

Related certifications:SC-400MS-102
GitHub
Overview

Executive Summary

This project implemented Microsoft Purview Communication Compliance to automatically detect code-of-conduct and regulatory violations in internal and external communications, replacing manual review with policy-driven detection and a dedicated reviewer queue.

A "Detect sensitive info types" policy was configured to scan Exchange, Microsoft Teams and Viva Engage for the India Unique Identification (Aadhaar) Number sensitive information type, scoped to all users with a 100% review rate.

A test message containing a sample Aadhaar Number and VID was sent between two lab accounts, correctly detected by the policy, and routed to the Pending review queue where the full reviewer remediation workflow was exercised end to end.

Context

Business Problem

Employees exchange sensitive personal identifiers and other code-of-conduct-risk content over email and chat with no systematic oversight, and compliance teams cannot manually review the full volume of internal and external communications.

Without an automated detection and escalation path, code-of-conduct violations and confidential data leakage are discovered only after the fact, and organizations lack the documented review process auditors and regulators expect.

Business Risks

  • Undetected sharing of regulated personal identifiers over email, chat or Viva Engage
  • No automated escalation path between a detected violation and a human reviewer
  • Code-of-conduct and harassment violations discovered too late to limit damage
  • No evidentiary record of proactive communication monitoring for audit purposes

Compliance Concerns

  • Code-of-conduct and insider risk monitoring practice
  • Regulated personal identifier detection (national ID formats)
  • Auditable reviewer decision and remediation trail
Approach

Solution Overview

The solution used Microsoft Purview Communication Compliance's "Detect sensitive info types" template to build a single policy spanning Exchange, Teams and Viva Engage, scoped to all users, with a 100% review rate for a high-sensitivity national ID sensitive information type, and a dedicated reviewer investigating each match through to remediation.

Design

Architecture

Architecture Diagram
100%

Architecture diagram placeholder

Exchange, Teams and Viva Engage communications are scanned by a single Communication Compliance policy; matches route to a reviewer queue offering resolve, dismiss, escalate, notify, tag, remove and automate actions.
Stack

Technology Stack

Microsoft Purview Communication Compliance

Policy-driven detection, review and remediation workspace

Sensitive Information Types (SITs)

India Unique Identification (Aadhaar) Number classifier

Exchange Online

Email monitoring location

Microsoft Teams

Chat/channel monitoring location

Viva Engage

Enterprise social monitoring location

Reviewer Queue

Pending / Resolved / Exports investigation workflow

Environment

Lab Environment

Tenant
Microsoft 365 lab tenant
Policy name
Sensitive information
Policy template
Detect sensitive info types
Sensitive info type
India Unique Identification (Aadhaar) Number
Scoped locations
Exchange, Microsoft Teams, Viva Engage
Reviewer
admin365 lab
Build

Implementation

A phased, expandable walkthrough. Screenshots and evidence can be attached to each phase.

  1. Open Communication Compliance from the Purview Solutions menu and confirm licensing and role prerequisites.

    • Confirm a Communication Compliance license (E5, E5 Compliance add-on, or standalone add-on)
    • Confirm the account holds a Communication Compliance Admin or Analyst/Investigator role
    • Assign a reviewer account before policy activation
    Screenshots for this phase can be added here.
Automation

PowerShell

Illustrative example snippets — copy or download each script. Production values are placeholders.

List Communication Compliance policies and create a sensitive-information policy

Get-CommunicationCompliancePolicy.ps1
# List all Communication Compliance policies and health status
.Get-CommunicationCompliancePolicy.ps1

# Create a new sensitive-information policy
.New-CommunicationComplianceSensitiveInfoPolicy.ps1 `
  -PolicyName "Sensitive information" `
  -SensitiveInfoType "India Unique Identification (Aadhaar) Number" `
  -Reviewers "admin365lab@yourtenant.onmicrosoft.com" `
  -ReviewPercentage 100
Evidence

Configuration Screenshots

Click any tile to open the lightbox. Real screenshots will replace these placeholders.

Phase 1

Phase 2

Phase 3

Phase 4

Phase 5

Proof

Validation

  • Solutions Menu Access

    Communication Compliance accessible from the Microsoft Purview Solutions menu.

  • Template List

    Policy template list displays all available detection templates.

  • Policy Created

    "Detect sensitive info types" policy created with Aadhaar Number SIT, all-users scope and admin365 lab reviewer.

  • Auto-Filled Settings Confirmed

    Exchange/Teams/Viva Engage scope, In/Out/Internal direction, 100% review, OCR disabled, email blast filter enabled.

  • Policy Activated

    Policy transitioned from Activating to Active with Healthy status.

  • Test Message Detected

    Message containing an Aadhaar Number and VID correctly detected and routed to the Pending queue.

  • Reviewer Pane Verified

    Detail pane displays detected conditions, message content and the full remediation action set.

Reality

Challenges

Auto-filled defaults still need sign-off

Selecting a template pre-fills scoped locations, direction, review percentage, OCR and email blast filtering; these defaults were explicitly validated against the intended scope rather than accepted blindly.

Activation delay before alerts appear

A newly created policy shows an Activating status before scanning begins, so validation testing had to wait for the policy to reach Active/Healthy before sending test messages.

Insight

Lessons Learned

  • Auto-filled settings still require review — scoped locations, direction, review percentage, OCR and email blast filtering should be validated against organizational policy, not accepted by default.
  • Policies take time to activate — alerts will not appear until the policy reaches Active/Healthy status.
  • Microsoft ships a default "User-reported messages" policy automatically, alongside any custom policies an administrator creates.
  • Sensitive Information Types are locale-specific — selecting the correct regional SIT (e.g., Aadhaar Number for India) is essential for accurate detection.
  • The reviewer workflow is action-rich by design, spanning a soft dismissal through hard remediation (message removal) and downstream investigation handoff.
Outcome

Business Impact

Exchange + Teams + Viva Engage

Detection Coverage

100% for high-sensitivity SIT

Review Rate

Active — Healthy

Policy Health

9 remediation actions available

Reviewer Actions

Capability

Skills Demonstrated

Microsoft Purview Communication ComplianceSensitive Information Type (SIT) policy configurationMulti-workload compliance monitoring (Exchange, Teams, Viva Engage)Reviewer investigation and remediation workflowInsider risk / code-of-conduct detection methodologyPowerShell reporting for Security & Compliance
Mapping

Related Certifications

Certifications this project maps to are highlighted.

MS-102SC-200SC-300SC-400AZ-900AZ-500SC-100
Reading

Related Blog Articles

Placeholder cards — future TechCertGuide integration.

Source

GitHub Repository

lokeshm-it/Microsoft-Purview-Communication-Compliance

Public

Enterprise Communication Compliance implementation across Exchange, Teams and Viva Engage with a full reviewer investigation workflow.

— —
View RepositoryREADMEDocumentation
Resources

Download Center

Project Case Study

PDF · Available soon

Architecture Diagram

PDF · Available soon

PowerShell Scripts

ZIP · Available soon

Technical Documentation

PDF · Available soon