Concentric AI vs Microsoft Purview

This workflow has not been established in our research.

DLP policies can restrict access to sensitive SharePoint and OneDrive files for external users or for everyone. [5]

Blocking behavior depends on the rule. Microsoft documents a short guest-access window for the combination of externally shared content and Block everyone. Test the exact condition and action. [5]

This workflow has not been established in our research.

Data Map documents automatic classification for Amazon S3. [2]

The S3 connector does not apply sensitivity labels to Data Map assets or data policies. Classification alone does not establish transfer prevention. [2]

This workflow has not been established in our research.

The Data Map BigQuery connector provides metadata and lineage. [2]

The connector does not support automatic classification, sensitivity labels or data policies in the published capability matrix. [2]

This workflow has not been established in our research.

Purview Data Map documents automatic classification of Snowflake tables and views using a scan rule set. [2] [6]

Classification skips tables or views when their object, schema or database names contain special characters. Self-hosted scanning requires a supported integration runtime and JDK 11. Confirm warehouse access and key-pair authentication for the scan. [6]

This workflow has not been established in our research.

The Data Map Snowflake connector does not apply data policies in Microsoft's capability matrix. [2]

This limit concerns the Data Map connector. Its classification results do not establish Snowflake masking or other Purview workloads. Require a separate enforcement component if the evaluation needs query-time masking. [2]

This workflow has not been established in our research.

The Information Protection scanner can discover, classify and protect files on local and network shares. [4]

Discovery needs read permission. Applying classification and protection needs read, write and modify permissions. The scanner requires Windows Server, SQL Server and an information protection license for the service account. [4]

SharePoint and OneDrive discovery, access analysis and sharing-risk remediation are documented. [2]

DLP supports Exchange, SharePoint, OneDrive and Teams. Confirm licensing and access-governance requirements separately. [1]

The data-source catalog lists S3, RDS, Aurora, Redshift and FSx. Verify scan and remediation depth per connector. [1]

Data Map supports classification in Amazon RDS. Redshift metadata support does not include automatic classification in the reviewed matrix. [2]

BigQuery, Cloud SQL and Cloud Storage connectors are listed. [1]

Data Map lists BigQuery metadata and lineage but not automatic classification. Do not equate cataloging with content inspection. [2]

Snowflake and Databricks appear in the data-source catalog. [1]

Data Map classifies Snowflake and Azure Databricks Unity Catalog data with connector-specific limits. These connectors do not apply data policies. [2]

Windows file systems, NetApp and Dell EMC are listed. Confirm share protocols and collection requirements. [1]

DLP for on-prem file shares uses the Information Protection scanner. Deployment and supported file types need checking. [1]

The catalog lists Box, Dropbox, Google Workspace, Salesforce, Slack and Confluence. [1]

Connected non-Microsoft apps include Box, Dropbox, Google Workspace and Salesforce in preview. Browser and network controls have separate prerequisites. [1]

Purview deployment requirements differ by workload. The Information Protection scanner for on-prem files runs on customer-managed infrastructure. [4] [6]

On-prem infrastructure

The scanner requires Windows Server, a SQL Server configuration database and the Information Protection client.

Scanner identity

The documented setup uses an Active Directory service account synchronized to Microsoft Entra ID. Microsoft provides alternative configurations when this is prohibited.

Read versus change

Discovery-only scans need read access. Applying classification and protection to file shares requires read, write and modify permissions.

Snowflake scanning

The Snowflake Data Map connector needs warehouse USAGE and access to the scanned databases. Microsoft documents key-pair authentication with a self-hosted integration runtime. Confirm the current authentication requirements before provisioning the scan.

Pricing was not established in the reviewed sources.

Purview uses complementary per-user and pay-as-you-go billing models. [3]

Per user

Microsoft 365 and Windows/macOS endpoint capabilities depend on the licensed plan.

Consumption

Non-Microsoft 365 sources and certain other capabilities use Azure-linked consumption billing.

1. Use your own business documents to test classification without preassigned labels.
2. Show an access-remediation workflow and its approval and rollback controls.
3. Separate native actions from enforcement through Microsoft Purview or another product.

1. For each required control, identify the workload, licensed plan and enforcement component. Demonstrate the action on that workload.
2. For on-prem scanning, show the service account permissions in discovery mode and protection mode. Identify the Windows and SQL infrastructure the team must operate.
3. Separate existing entitlements, additional licenses and consumption charges in the quote. Repeat the estimate for a larger data estate and more frequent scans.