Microsoft Purview Data Security Investigations
AI-powered departing-employee exfiltration investigation — scoped evidence collection, generative AI categorization, natural-language search and deep content examination inside Microsoft Purview.
Difficulty
Advanced
Environment
Microsoft 365 / Purview
Deployment
Home Lab
Est. Implementation
1 week
Executive Summary
This project built an end-to-end Microsoft Purview Data Security Investigations (DSI) case modeled on a departing-employee insider-risk scenario, using the built-in "Surface employee data exfiltration" template to scope, collect and analyze evidence for a single user.
Evidence was collected across Exchange/SharePoint (Audit) and Windows endpoint (Endpoint DLP) sources, then run through DSI's generative AI stages: automatic content categorization, natural-language AI Search, and deep AI Examination of the single highest-risk document.
The investigation traced a confirmed high-risk file — containing nine payment card numbers — from initial collection through AI-assisted triage to a completed entry in the Mitigation list, with every stage logged in a timestamped Activities audit trail.
Business Problem
A departing employee may access, copy or export confidential company data before their last day, and security teams have no fast way to reconstruct exactly what that employee touched across mailbox and file storage, or what kind of regulated data it actually contains.
Manually opening and reading every collected file to classify it does not scale, and traditional keyword search can confirm a document exists without revealing what regulated data it holds or at what risk level — a gap that matters most in the narrow window between resignation and exit.
Business Risks
- Undetected exfiltration of financial, personal or proprietary data by a departing employee
- No structured way to triage which collected files actually contain regulated data types
- Findings escalated to HR or legal without a defensible, auditable evidence trail
- Delayed response caused by manually reviewing every collected item by hand
Compliance Concerns
- Insider risk / data exfiltration investigation practice
- Auditability and chain-of-custody for HR and legal handoff
- Regulated data identification (payment card and personal data)
Solution Overview
The investigation was built using Microsoft Purview's "Surface employee data exfiltration" template, scoped to a single departing user's mailbox and SharePoint/OneDrive sites, then carried through AI categorization, natural-language search, targeted AI examination and mitigation tracking inside one investigation workspace.
Architecture
Architecture diagram placeholder
Technology Stack
Microsoft Purview Data Security Investigations
Generative AI-powered investigation workspace — Identify, Analyze, Mitigate
Audit (Unified Audit Log)
Exchange, SharePoint and OneDrive evidence collection source
Endpoint DLP
Data-loss activity evidence from managed Windows devices
Categorize with AI
Generative AI classifier assigning content categories per collected item
AI Search (preview)
Natural-language question-and-answer search over the evidence set
Examine
Deep AI content examination extracting and risk-rating specific data types
Lab Environment
- Tenant
- securem365lsb.onmicrosoft.com (Microsoft 365 lab tenant)
- Investigation
- Test User 1 - Data exfiltration investigation
- Template
- Surface employee data exfiltration
- Subject user
- testuser1@securem365lsb.onmicrosoft.com
- Data sources
- Audit, Endpoint DLP
- Items collected
- 10 (Word, Excel, .cmd, .zip)
Implementation
A phased, expandable walkthrough. Screenshots and evidence can be attached to each phase.
Open DSI from the Purview Solutions menu and complete the required setup tasks before first use.
- Confirm pay-as-you-go billing for data storage is configured
- Provision AI capacity units for the AI-powered stages
- Confirm Admin/Investigator/Reviewer roles are assigned
Screenshots for this phase can be added here.
PowerShell
Illustrative example snippets — copy or download each script. Production values are placeholders.
Reconstruct the audit search window used by the investigation template
# Illustrative scaffold mirroring the "Surface employee data exfiltration" template scope
Connect-IPPSSession -UserPrincipalName admin@yourtenant.onmicrosoft.com
.Get-DSIAuditActivity.ps1 `
-UserPrincipalName "testuser1@securem365lsb.onmicrosoft.com" `
-StartDate (Get-Date).AddDays(-7) `
-EndDate (Get-Date) `
-Operations "FileAccessed","FileCopied","FileDeleted","FileDownloaded","FileMoved","FileRenamed","FileUploaded","SensitivityLabelChanged","SensitivityLabelRemoved","Send"Configuration Screenshots
Click any tile to open the lightbox. Real screenshots will replace these placeholders.
Phase 1
Phase 2
Phase 3
Phase 4
Phase 5
Phase 6
Validation
Investigation Created
Investigation created from the "Surface employee data exfiltration" template with auto-filled AI context and date range.
Sources Scoped
Subject user's mailbox and site confirmed via Manage sources.
Endpoint DLP Configured
Endpoint DLP search tab configured with a matching date range and subject user.
Evidence Collected
Audit search completed; 10 items added to scope and prepared for AI.
AI Categorization
Categorize produced 11 distinct content categories across the 10 items.
AI Search Accuracy
Natural-language query correctly cited the 2 files that actually contained card numbers.
AI Examination
Examine extracted 9 risk-rated payment card numbers from the highest-risk file.
Mitigation Tracked
High-risk file tracked in the Mitigation list through to Completed status.
Full Audit Trail
Activities tab recorded timestamps, duration and performing account for every action.
Challenges
AI output is an accelerant, not a verdict
Purview explicitly flags Categorize and Examine output as AI-generated and possibly incorrect, so every high-risk finding was treated as a lead requiring human confirmation before any HR or legal action.
No published PowerShell equivalent for the AI stages
Categorize, AI Search and Examine are portal/Copilot-driven with no direct cmdlet equivalent, so automation was scoped to the evidence-gathering side using Search-UnifiedAuditLog.
Lessons Learned
- AI capacity and pay-as-you-go billing are hard prerequisites — Categorize, AI Search and Examine will not run without both provisioned first.
- Templates auto-fill context that should be reviewed, not assumed, especially the lookback window against an employee's actual notice period.
- Categorize and Examine are complementary: Categorize triages breadth across the whole evidence set, Examine gives depth on the highest-priority file.
- The Activities tab is the definitive, exportable audit trail for any investigation that could become an HR or legal matter.
Business Impact
10 files triaged to 1 in minutes
Investigation Turnaround
9 card numbers, High risk
Regulated Data Found
Completed status, fully audited
Mitigation Tracked
Mailbox + endpoint evidence
Insider Risk Coverage
Skills Demonstrated
Related Certifications
Certifications this project maps to are highlighted.
Related Blog Articles
Placeholder cards — future TechCertGuide integration.
GitHub Repository
lokeshm-it/Microsoft-Purview-Data-Security-Investigations
PublicAI-powered departing-employee data exfiltration investigation built on Microsoft Purview Data Security Investigations.
Download Center
Project Case Study
PDF · Available soon
Architecture Diagram
PDF · Available soon
PowerShell Scripts
ZIP · Available soon
Technical Documentation
PDF · Available soon