Microsoft Purview vs Netwrix

DLP policies can restrict access to sensitive SharePoint and OneDrive files for external users or for everyone. [5]

Blocking behavior depends on the rule. Microsoft documents a short guest-access window for the combination of externally shared content and Block everyone. Test the exact condition and action. [5]

This workflow has not been established in our research.

Data Map documents automatic classification for Amazon S3. [2]

The S3 connector does not apply sensitivity labels to Data Map assets or data policies. Classification alone does not establish transfer prevention. [2]

This workflow has not been established in our research.

The Data Map BigQuery connector provides metadata and lineage. [2]

The connector does not support automatic classification, sensitivity labels or data policies in the published capability matrix. [2]

This workflow has not been established in our research.

Purview Data Map documents automatic classification of Snowflake tables and views using a scan rule set. [2] [6]

Classification skips tables or views when their object, schema or database names contain special characters. Self-hosted scanning requires a supported integration runtime and JDK 11. Confirm warehouse access and key-pair authentication for the scan. [6]

This workflow has not been established in our research.

The Data Map Snowflake connector does not apply data policies in Microsoft's capability matrix. [2]

This limit concerns the Data Map connector. Its classification results do not establish Snowflake masking or other Purview workloads. Require a separate enforcement component if the evaluation needs query-time masking. [2]

This workflow has not been established in our research.

The Information Protection scanner can discover, classify and protect files on local and network shares. [4]

Discovery needs read permission. Applying classification and protection needs read, write and modify permissions. The scanner requires Windows Server, SQL Server and an information protection license for the service account. [4]

This workflow has not been established in our research.

DLP supports Exchange, SharePoint, OneDrive and Teams. Confirm licensing and access-governance requirements separately. [1]

SharePoint Online, OneDrive for Business and Exchange Online are supported classification sources. This does not establish equivalent access remediation. [1]

Data Map supports classification in Amazon RDS. Redshift metadata support does not include automatic classification in the reviewed matrix. [2]

Data Map lists BigQuery metadata and lineage but not automatic classification. Do not equate cataloging with content inspection. [2]

Data Map classifies Snowflake and Azure Databricks Unity Catalog data with connector-specific limits. These connectors do not apply data policies. [2]

DLP for on-prem file shares uses the Information Protection scanner. Deployment and supported file types need checking. [1]

CIFS/SMB and NFS shares are supported. CIFS/SMB is the preferred protocol in the reviewed documentation. [1]

Connected non-Microsoft apps include Box, Dropbox, Google Workspace and Salesforce in preview. Browser and network controls have separate prerequisites. [1]

Box, Dropbox Business and Google Drive are supported sources, with account-edition requirements. [1]

Purview deployment requirements differ by workload. The Information Protection scanner for on-prem files runs on customer-managed infrastructure. [4] [6]

On-prem infrastructure

The scanner requires Windows Server, a SQL Server configuration database and the Information Protection client.

Scanner identity

The documented setup uses an Active Directory service account synchronized to Microsoft Entra ID. Microsoft provides alternative configurations when this is prohibited.

Read versus change

Discovery-only scans need read access. Applying classification and protection to file shares requires read, write and modify permissions.

Snowflake scanning

The Snowflake Data Map connector needs warehouse USAGE and access to the scanned databases. Microsoft documents key-pair authentication with a self-hosted integration runtime. Confirm the current authentication requirements before provisioning the scan.

Purview uses complementary per-user and pay-as-you-go billing models. [3]

Per user

Microsoft 365 and Windows/macOS endpoint capabilities depend on the licensed plan.

Consumption

Non-Microsoft 365 sources and certain other capabilities use Azure-linked consumption billing.

Pricing was not established in the reviewed sources.

1. For each required control, identify the workload, licensed plan and enforcement component. Demonstrate the action on that workload.
2. For on-prem scanning, show the service account permissions in discovery mode and protection mode. Identify the Windows and SQL infrastructure the team must operate.
3. Separate existing entitlements, additional licenses and consumption charges in the quote. Repeat the estimate for a larger data estate and more frequent scans.

1. List the exact product editions needed for classification, audit and access remediation.
2. Demonstrate the permissions and network access required to scan one representative file share.
3. Test classification updates appearing in Auditor reports after a file changes.