M365 PlaybooksPurview · SharePoint · Teams · Exchange· Maintain · Coverage reporting
Show label coverage to the people who own the data
Purpose
Put label coverage in front of the people who can act on it. Purview's own reports are built for admins; department heads and site owners rarely see them, yet they're the ones who know whether a site full of unlabelled files is a problem. A Power BI report, fed from Purview exports and the audit log and filtered so each owner sees only their own data, turns label coverage into a conversation with the people who own the data.
Overview
A Power BI report built from Purview exports and the audit log, with row-level security so each data owner sees only their own sites.
- Effort
- About 8 to 12 person-days, then light upkeep
- Duration
- 3 to 6 weeks
- Complexity
- Medium
- Who's in the room
- Security analyst, Power BI developer, Purview admin, department heads and site owners
- Beyond E5
- Nothing beyond Microsoft 365 E5.
Risk of not doing it
Coverage gaps stay visible only to admins, and the people who could fix them never see them.
Key activities
The plan in order: what must be true first, what to decide, then how to configure the pilot and production.
Prerequisites
Decide who needs to see what
Typical audiences: the security lead (everything), department heads (their department's sites), and site owners (their own sites). Be clear that the report itself is sensitive: it lists where labelled content sits and can show file names, so treat it as Highly Confidential from the start.
Decisions
Decision: Where does the data come from?
The Export-ContentExplorerData cmdlet exports what content explorer knows about labelled items, by workload, in pages of up to 10,000 records; sessions expire after about an hour, so scripts must resume from the page cookie. The Microsoft Graph audit log query API returns label events (applied, changed, removed), kept for a year for E5 users under Audit (Premium). Group labels come from Microsoft Graph, and site labels from SharePoint. The Graph action that reads a file's labels works one file at a time, so it suits spot checks rather than bulk reporting.
Options
- Purview portal only
- Scheduled exports from content explorer and the audit log into Power BI
Recommended default: Scheduled exports from content explorer and the audit log into Power BI
Decision: How does each owner see only their data?
Power BI row-level security restricts rows per user with a rule based on their sign-in, so one report can serve every owner. It only applies to people with the Viewer role; workspace Admins, Members and Contributors see everything, so give owners Viewer access.
Options
- A separate report per owner
- One report with row-level security, owners as Viewers
Recommended default: One report with row-level security, owners as Viewers
Pilot configuration
Build it for one department
Start with a department whose head wants it. Show coverage by site, unlabelled sensitive content, and downgrades over time. Ask the head what they'd do with each view; drop anything they wouldn't act on.
Protect the report itself
Label the report and its semantic model with your top label. In Power BI a label doesn't decide who can open the report (permissions and row-level security do), but it protects exports to Excel, PowerPoint and PDF.
Production configuration
Publish to owners on a monthly rhythm
Extend the report to other departments and site owners, and review it in the monthly Maintain review. Each finding gets an owner: label a library, move content, or set a library default.
Make it enforceable
Row-level security limits each owner to their own data, and the report carries the top label so exports stay protected. Acting on what the report shows still depends on owners, which is why it feeds the monthly review.
Partly enforced. The gaps are a risk until a mechanism covers them.
Operating rhythm
Rollout approachBy department or org unit · Pilot size: One department and its site owners
Owners need to trust the numbers before they act on them. One willing department first shows the value and the questions to expect.
Agree audiences and protectionChange: Inform
Who sees what, and the report treated as Highly Confidential.
Move on when: Audiences and access are approved
Build for one departmentChange: Explain
Exports, model, row-level security and the first views.
Move on when: The department head acts on at least one finding
Extend to other ownersChange: Explain
Add departments and site owners as Viewers.
Move on when: Owners see only their own data
Review monthlyChange: Sustain
Bring findings into the Maintain review.
Move on when: Findings have owners and dates
Common challenges
If youGive owners workspace Member access
What tends to happenRow-level security doesn't apply to them, and they see every department's data.
A better approachShare the report with owners as Viewers.
If youBuild a report nobody acts on
What tends to happenOwners open it once and never again.
A better approachKeep only views that lead to an action, and review them monthly.
If youTreat the report as ordinary
What tends to happenA list of where sensitive content sits becomes the easiest thing to leak.
A better approachLabel it with your top label and keep access tight.
Checkpoints
Pilot
- Does row-level security show each owner only their data?
- Is the report labelled and its access reviewed?
Production
- Do owners use the report monthly?
- Do findings have owners and dates?
Success measures
Capture a baseline before you start, or you won't be able to show the change.
| Measure | Where you see it | Good direction |
|---|---|---|
| Owners viewing the report each month | Power BI usage metrics | Up |
| Sites with unlabelled sensitive content | Coverage report | Down |
Ready-to-use text
Report pages
1. Coverage by department and site (labelled versus unlabelled). 2. Sensitive information found without a label. 3. Labels lowered or removed over time. 4. Sites whose label is lower than their content. 5. Actions agreed and their status.
Additional reading
Changelog
Changelog (1 version)
| Version | Date | Author | Change |
|---|---|---|---|
| 1 | Sev Derghazarian | First version. Facts checked against Microsoft Learn on 2026-10-15. |