docs(audit): Microsoft Purview pattern catalog (closes #335) — completes v3.4.0 audit umbrella#371
Merged
Merged
Conversation
Fourteenth and FINAL domain audit under v3.4.0 umbrella (#326). Resolves spike #335. docs/audits/purview.md catalogs 27 unique patterns across 5 sub-domains (DLP policy coverage, sensitivity labels / MIP, retention, eDiscovery + Insider Risk, anti-patterns). Maps against 16 existing M365-scope Purview-related checks across PURVIEW-*, COMPLIANCE-*, plus cross-domain Power BI sensitivity labels. Surfaces: - 14 gap CheckIDs covering DLP template currency, custom sensitive info types, Endpoint DLP location coverage, DLP rule action progression, sensitivity label encryption + defaults + auto-labeling gap, retention legal hold + records management, eDiscovery RBAC + Premium feature, Insider Risk Management policies + analyst assignments, audit log retention period, encryption offline-access duration - 4 cross-spike CheckID consolidations: - Site-protection labels ↔ #337 (SPO/OneDrive) - Teams sensitivity labels ↔ #340 (Teams) - Copilot grounding labels ↔ #336 (Power Platform) - PBI sensitivity labels (already covered, with #336 dedup) - 3 narrative-refresh chore: candidates Threat-pattern map covers data theft by departing employee, outbound DLP via email, sensitive label content cached on personal device, Teams chat data loss without retention, MIP without auto-labeling, eDiscovery role over-permissioning, Insider Risk alerts going nowhere, audit log retention insufficient for IR, endpoint DLP gap, custom org data not protected by templates. Detection appendix documents 8 cmdlet patterns + 8 edge cases across Security & Compliance PowerShell + Exchange Online connector. Like #332 (MDO) and #336 (Power Platform), Purview lives almost entirely outside Microsoft Graph. Specific edge cases: - Multiple PowerShell modules required (S&C + ExchangeOnline + ComplianceCenter) - Policy Mode enum (Enable, TestWithNotifications, etc.) - Sensitivity labels are 3 distinct artifacts (label store + label policies + auto-labeling policies) — reconciliation required - Retention labels vs retention policies (don't conflate) - Endpoint DLP requires onboarded devices (#334 cross-domain) - Insider Risk + Premium eDiscovery are E5+ addons (license-gated) - Auto-labeling scope is per-location (Exchange / SPO / OneDrive each) - Records management vs retention labels (immutable-vs-flexible distinction) V3.4.0 AUDIT UMBRELLA COMPLETE: this is the fourteenth and final domain audit. All 14 spikes (#327-#340 inclusive) resolved. Doc includes a completion summary mapping each spike to its merged PR + 4 cross-cutting themes surfaced across the audit work for v3.5 consideration: 1. AZ-namespace boundary issues (5+ Entra controls in AZ namespace) 2. Namespace duplications (DEFENDER/EXO 3 pairs, PBI/POWERBI 11 pairs, plus implicit COMPLIANCE-DLP / proposed PURVIEW-DLP overlap) 3. Canonical data file pattern — 4 proposed: - data/role-tiers.json (#328) - data/microsoft-first-party-appids.json (#361) - data/transport-rule-actions.json (#339) - data/power-platform-connectors.json (#336) 4. Detection-method surface diversity — 5 distinct contracts: - Microsoft Graph - Exchange Online PowerShell - Security & Compliance PowerShell - MDCA REST API (per-tenant URL) - Power Platform admin PowerShell Same template as #327, #328, #329, #330, #331, #332, #333, #334, #336, #337, #338, #339, #340. Closes #335 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This was referenced Apr 30, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Resolves spike #335. Fourteenth and final domain audit under v3.4.0 umbrella (#326). Ships
docs/audits/purview.md— 404 lines.This PR completes the v3.4.0 audit umbrella. All 14 spikes resolved.
Coverage matrix
v3.4.0 audit umbrella — complete
Four cross-cutting themes for v3.5 consideration
The audit work surfaced themes that warrant coordinated treatment in a v3.5 release:
AZ-namespace boundary issues —
AZ-IDENTITY-015/016/030/039/041are Entra controls in the AZ namespace. Filed as boundary chores in spike: research token + session security patterns (CAE, sign-in frequency, Token Protection) #331, spike: research external collaboration patterns (B2B, cross-tenant access, guest controls) #333, etc. Worth a unified reconciliation.Namespace duplications —
DEFENDER-* ↔ EXO-*(3 pairs from spike: research Defender for Office preset policy detection (Built-in / Standard / Strict) #332 MDO),PBI-* ↔ POWERBI-*(11 pairs from spike: research Power Platform tenant isolation + DLP patterns #336 Power Platform), plus the implicitCOMPLIANCE-DLP-* ↔ proposed PURVIEW-DLP-*overlap from this audit. ~14 dedup pairs total.Canonical reference data file pattern — 4 proposed across the audit work:
data/role-tiers.json(spike: research privileged access patterns (PIM, role assignments, emergency access) #328 PIM)data/microsoft-first-party-appids.json(data: introduce data/microsoft-first-party-appids.json (canonical Microsoft owner-tenant + AppId allowlist) #361, M365-Assess #887)data/transport-rule-actions.json(spike: research mail flow patterns (transport rules, connectors, forwarding, inbox rule audit) #339 mail flow)data/power-platform-connectors.json(spike: research Power Platform tenant isolation + DLP patterns #336 Power Platform)Worth coordinating as a v3.5 release theme: "canonical reference data layer for cross-consumer M365 governance."
Detection-method surface diversity — 5 distinct detection contracts surfaced across audits:
Worth a
docs/CONSUMER-GUIDE.mddocumenting these contracts for downstream consumers.Threat-pattern map highlights
Files
docs/audits/purview.md— 404 lines (the audit + completion summary)CHANGELOG.md—[Unreleased]/ Documentation entryTest plan
tests/registry-integrity.Tests.ps1+tests/framework-definitions.Tests.ps1— 268/268 pass locallydata/registry.jsonOut of scope
After this merges
The v3.4.0 milestone is ready for the next phase: filing the spawned-issue backlog. Across all 14 audits the spawned issues total approximately:
feat:gap CheckIDschore:narrative-refreshMechanical batch work; happy to file in chunks once given the green light. Or close out the milestone first and start v3.5 with the cross-cutting themes as the planning input.
🤖 Generated with Claude Code