A year ago, after spending a couple of years playing golf, I joined Infotechtion. Previously, I spent a couple of decades working mainly on SharePoint content governance and records management. In 2023, I worked with large organizations on Proofs of Concepts and Pilots applying Microsoft Purview for the governance of content in Microsoft 365, Azure, and Network File Shares.
This blog is about the differences between working on Microsoft 365 and cloud content governance compared to working on SharePoint records management. Here is what I learned in 2023:
Proofs of Concept and Pilots
Many people have misconceptions about what happens during Microsoft Purview PoC’s and Pilots. There is almost no software development in a PoC. It is a guided tour of the capabilities and choices in Purview and how to configure Purview to be useful at scale for content governance and records management. A Pilot is all about configuring the capabilities of Microsoft Purview according to the choices made during the PoC along with an information architecture to demonstrate Purview’s capabilities in a Microsoft 365 tenant.
Proof of Concept
The purpose of a PoC is to get people familiar with the features and capabilities of Purview. Most organizations have defined use cases that they want to see demonstrated in their PoC. Typically, all use cases can be demonstrated by out-of-box configuration of Purview. If it hasn’t been done already, we group the use cases into user personas so that we can narrow the audience for each workshop in the PoC. We host workshops to demonstrate the capabilities of Purview to address each use case for each persona and discuss the configuration choices that need to be made.
Some of the use cases are “Hands-on”, meaning that during the workshop, clients can test the capabilities in the PoC tenant themselves using instructions that we provide. These capabilities are straightforward and mostly business-facing.
Some of the use cases are “Show and Tell” due to their complexity. We demonstrate these capabilities in the workshop. Typically, these use cases are for IT or Records Management administrators and leverage the Purview Portal. Examples include:
- Disposition Review – Show how it looks to the Business. Show how it looks to Records Managers.
- eDiscovery/Legal Review – Show eDiscovery and Legal Review in the context of a matter.
- Provisioning – How to create sites and containers with rules built-in for compliance, retention, classification and security.
Pilot
The purpose of a Pilot is to design a Purview solution that works with the feature set that was identified and selected in the PoC and to show the user group how an Information Architecture supports the solution. We then explain how to make the information architecture sustainable by baking it into the solution design. The client can then replicate the solution design across new instances.
A second key objective of the Pilot is to make sure that the records-related workload of the user community is as small as possible. The goal is for most of the classification, declaration and disposition processes to be transparent to the users. One of our large clients has disposed of billions of documents and emails through the establishment of rules for autoclassification, rules for disposition, and zero review of most disposition actions. This requires rules that everyone understands the processes based on training, keeping it simple, and building trust through consistency of process enforcement.
Purview Extensions
Purview was built by (Microsoft) IT people for (Client) IT people. Configuring Purview in large organizations for efficient disposition without extensions like ours is difficult. The following table provides a summary of the key feature gaps in Purview and how they are fulfilled via the
Infotechtion-ARM (I-ARM) add-ons to deliver a more complete solution to meet requirements for regulated and non-regulated records management.
Our goal with these extensions is to simplify the process of working with Purview and to make Purview a platform that is more consistent with the systems and process that records managers have traditionally worked with. What makes this so important is that most of the records management requirements that we see for Purview are the same from organization to organization. The big difference between Purview and prior generations of SharePoint governance is that Purview is exactly the same in every tenant. The only way to interact with Purview is through the Graph API’s and tools like Power BI that present Purview data in dashboards and reports. The result is that Purview extensions typically work without modification. There are some gaps in Purview where actual software development is required.
Software Development vs. Prebuilt Extensions to Purview
Filling these gaps in Purview solutions requires either software development or prebuilt extensions to Purview. The gaps least susceptible to prebuilt extensions are usually related to integrations to third party systems, dashboards and/or reporting. Examples of these include:
1. Integrations to Products:
- ERP Systems for Events (e.g., Dynamics 365)
- ERP Systems where the systems store records in SharePoint (e.g., SAP S/4 HANA)
- XML Wrappers for retention of objects from Structured Data Processing tools (e.g., Workday, SailPoint)
- Retention Schedule management tools (e.g., Access Corporation’s Virgo, Iron Mountain Policy Center)
2. Dashboards, Reports and Analytics. Microsoft 365 and Purview expose their data to tools like Power BI and Power Automate but have limited dashboards and reporting in their products. Additionally, we have found that the Purview Audit Log is not as complete as it could be to support the full range of dashboards, reports, and analytics that our clients need, and the audit log requires extensions. While the need for extensions is consistent, most organizations have their own requirements for how they want to see the information reflected in dashboards and reports.
We found that the need for connectors, dashboards and reports is mostly the same from client to client. The differences primarily relate to the technical architecture of the systems that need to be integrated with Purview. It is possible for consultants to build solutions uniquely for your requirements; however, these capabilities are often available pre-built for a small fraction of the cost of building them on a custom basis for your projects. The key is to evaluate the pre-built extensions that are available and deciding whether they are a good fit with your requirements and use cases.
Where to Host a PoC or Pilot?
In your partner/integrator’s tenant?
We have seen a variety of scenarios in terms of where our PoC’s are conducted. The simplest alternative is often to host the PoC in your partner/integrator’s tenant. A significant fraction of the effort in a PoC is getting set up in your environment to understand (hands-on) the choices that need to be made. The more use cases you want to evaluate, the more set up can be required. Frequently, your partner will have a fully configured PoC environment. Additionally, there is usually no need to include any real documents or data in your partner’s tenant as the documents can be dummy documents. However, many large organizations are not comfortable with hosting PoC’s outside of their own infrastructure.
In your test tenant?
Conducting a PoC in an organization’s test tenant is an attractive alternative as long as the organization has the capacity and capabilities to do this. We have seen several PoC’s delayed because their IT departments weren’t ready to host a PoC; there is a lot of set up required. If any Purview extensions are required, it can take months to get all the Information Security and IT approvals and access permissions that are needed. On the other hand, if an organization is committed to Purview for content governance and records management, then installing the software in the client tenant will be required anyway, so why not start there?
The Future of Purview
Here is what I think about the future of Purview based on this year:
1. Purview is Microsoft’s approach to records management and content governance for Microsoft 365, Azure, and Network File Shares. It is also Microsoft’s answer for security, identity, privacy, sensitivity, data loss prevention, risk, compliance, data classification, eDiscovery, and lots more. It will become harder for Microsoft 365 customers to avoid needing to acquire E5 (and Purview) as time goes on. Purview is a very strategic product for Microsoft, and it is important to know that it is an E5 capability and won’t support records management in E3 well in 2024.
2. If you are currently implementing Purview out of the box, it will be more complicated to implement it at scale later. Here are some things that you can do to reduce this complication:
- Provisioning sites with governance built in is really important. Retrofitting existing sites is harder once they have been created. The provisioning of sites can be implemented somewhat independent of Purview records management governance as long as an effective information architecture is established.
- Whenever possible, it is important to clean up your content on Azure, network shares, and inside Microsoft 365 using your current tools.
- Don’t worry so much about backup and archival of Microsoft 365 information. Entirely new tools to perform these functions inside Microsoft 365 will be available by the end of 2024.
- The more mature your retention schedule is, the less it will change when Purview is integrated into a retention schedule tool such as Virgo or Iron Mountain Policy Center. Changing Labels is possible, but it is a pain to accomplish.
3. Microsoft is changing Purview rapidly. The principles that will be applicable a year from now will be the same, however the configuration choices will be sufficiently different to the degree that it makes little sense to do workshops today for a 2025 implementation. Purview Workshops are really about choices in how to plan, design, configure, and implement Purview and you will forget this information if you don’t try to implement Purview for another year.
4. Microsoft has left a lot of white space for partners to fill with services and product extensions for content governance and records management and is moving somewhat slowly to fill this white space. Most of this current white space will likely still exist in 18 months or 3 years. However, Microsoft Partners need to carefully follow the Purview rules to avoid conflicting or competing with them. Purview is a fairly closed system. Extensions to Purview are either done through the Graph APIs or with tools like Power BI or Power Automate.
5. The learning curve for Purview is long and steep. As you try to address the gaps and challenges in a Purview PoC, try to find partners who have done it before, such as:
- Experts in Records Management
- Experts in Purview RM
- Have done Purview RM at scale, multiple times
- If partners come with pre-built Purview extensions, so much the better. This might save half of the work in a PoC or Pilot. Extensions to Purview that have worked in one Purview tenant will generally work in other similarly-licensed Microsoft 365 tenants.
Mike Alsup can be reached with comments or scathing remarks at mike.a@infotechtion.com.
