Microsoft Purview DLP: Business Premium, Purview Suite, and E5 License Matrix

Choosing the right license for Microsoft Purview DLP is not a trivial decision: poor calibration exposes the organization to protection blind spots, while over-licensing unnecessarily strains the budget. This article breaks down the official Purview DLP license matrix — seventeen capabilities, five functional families, three main offerings — to help administrators and security architects make informed decisions.

The three offerings at the heart of the comparison

Microsoft Purview DLP comes in three levels of functional access that determine what you can deploy in production:

• Business Premium: foundation for SMEs, covers DLP in basic Microsoft 365 workloads.
• Business Premium + Purview Suite: extension via add-on that unlocks advanced capabilities without requiring a complete switch to E5.
• Microsoft 365 E5 (or Microsoft 365 E5 Compliance): provides the most comprehensive coverage, natively integrated in the plan.

Five functional families, significant gaps

The matrix organizes DLP capabilities into five categories. Here's what each level actually covers.

Core DLP: the common denominator

The two fundamentals — Exchange DLP and SharePoint & OneDrive DLP — are included in all three offerings. This is the minimum floor for any Microsoft 365 organization.

By contrast, DLP for Teams Chat & Channel is only available with Purview Suite or E5. For organizations that use Teams as their primary internal communication channel, this gap is critical: without this capability, users can exfiltrate sensitive data via a Teams message without any policy being applied.

Endpoint & Web: the most structural gap

Endpoint DLP — which monitors actions on workstations (copying to USB, printing, uploading to third-party cloud services) — is completely absent from Business Premium. This is often the first argument that drives organizations to move to Purview Suite.

The Edge DLP on unmanaged cloud applications and Network Data Security capabilities adopt a PAYG (Pay-As-You-Go) model: they are not included in any plan, even in E5, but are billed based on usage. This point is regularly a source of budget surprises during deployment projects.

Copilot DLP: the new protection frontier

The emergence of Microsoft 365 Copilot in enterprise environments creates an unprecedented exposure vector: a user can query Copilot about sensitive data, and the AI can return confidential information in its response — without classic DLP policies being aware of it.

The matrix identifies two specific capabilities:

1. Protection of sensitive prompts: detects and blocks prompts containing sensitive data before they are processed. Available with Purview Suite or E5, but requires access to Microsoft 365 Copilot or Copilot Chat (explicit asterisk mention in the matrix).
2. Blocking Copilot processing of labeled files and emails: prevents Copilot from processing content bearing sensitivity labels. Available only with Purview Suite or E5.

These two controls are complementary: one acts on the input (the prompt), the other on the data sources that Copilot can access. For organizations deploying Copilot at scale, enabling them in parallel with a consistent labeling policy is the recommended posture.

Detection: classifiers reserved for higher tiers

The Detection family groups advanced sensitive data identification capabilities:

• Trainable Classifiers: custom ML models capable of recognizing specific business content categories (contracts, HR data, intellectual property). Reserved for Purview Suite and E5.
• Exact Data Match (EDM): exact matching with a structured data repository (for example, a list of social security numbers). Reserved for Purview Suite and E5.
• Advanced Sensitive Information Types (SIT): the matrix specifies a status "Standard only / limited" in Business Premium. Advanced SIT families — login identifier detection, credential scanning, complex named entities — require E5.

Management & Insights: visibility and alerting

DLP governance is not limited to blocking actions: it requires investigation and reporting capabilities.

• Activity Explorer and Content Explorer: available to varying degrees, but their full power (extended history, advanced filtering) requires Purview Suite or E5.
• Advanced aggregated DLP alerts: Business Premium is limited to basic alerts, restricted to workloads actually licensed. Aggregated and correlated alerts — essential for detecting exfiltration patterns — are reserved for higher offerings.
• DLP Analytics: unavailable in Business Premium.

Implementation: verify DLP coverage on your tenant

Before deciding on a license change, it is useful to audit the actual state of active DLP policies in your tenant and the workloads they cover.

Required module: ExchangeOnlineManagement (version 3.x minimum) Minimum permission: Compliance Administrator or Security Administrator role in Microsoft 365 Installation:

1Install-Module -Name ExchangeOnlineManagement -Scope CurrentUser -Force

The following script lists all active DLP policies, their target workloads, and their application mode (TestWithNotifications, TestWithoutNotifications, Enable):

1# Connection to Security & Compliance Center
2# Requires Compliance Administrator or Security Administrator role
3Connect-IPPSSession -UserPrincipalName admin@contoso.com
4 
5# Retrieve all DLP policies with their key properties
6$dlpPolicies = Get-DlpCompliancePolicy -ErrorAction Stop
7 
8if ($dlpPolicies.Count -eq 0) {
9    Write-Warning "No DLP policies found in this tenant."
10    return
11}
12 
13# Report construction
14$report = foreach ($policy in $dlpPolicies) {
15 
16    # Retrieve rules associated with each policy
17    $rules = Get-DlpComplianceRule -Policy $policy.Name -ErrorAction SilentlyContinue
18 
19    [PSCustomObject]@{
20        PolicyName        = $policy.Name
21        State              = $policy.Mode          # Enable / TestWithNotifications / TestWithoutNotifications
22        Enabled            = $policy.Enabled
23        # Workloads covered
24        Exchange           = $policy.ExchangeLocation.Count -gt 0
25        SharePoint         = $policy.SharePointLocation.Count -gt 0
26        OneDrive           = $policy.OneDriveLocation.Count -gt 0
27        Teams              = $policy.TeamsLocation.Count -gt 0
28        Endpoint           = $policy.OnPremisesScannerDlpLocation.Count -gt 0
29        # Number of rules and SITs used
30        NumberOfRules      = $rules.Count
31        SITsUsed           = ($rules | ForEach-Object { $_.ContentContainsSensitiveInformation.Name } | Sort-Object -Unique) -join "; "
32    }
33}
34 
35# Formatted display in console
36$report | Format-Table -AutoSize
37 
38# CSV export for archiving or analysis
39$exportPath = "$env:USERPROFILE\Desktop\DLP_Audit_$(Get-Date -Format 'yyyyMMdd_HHmm').csv"
40$report | Export-Csv -Path $exportPath -NoTypeInformation -Encoding UTF8
41Write-Host "Report exported: $exportPath" -ForegroundColor Green

Expected return value: a table listing each policy with its active workloads (value True/False), its mode, and the sensitive information types used. Policies in TestWithNotifications or TestWithoutNotifications mode do not block any actions — verify that no critical policy has remained in test mode.

Verify user licenses for Endpoint DLP

Endpoint DLP requires that each onboarded device be associated with a user with a Purview Suite or E5 license. The following script checks the assignment of relevant DLP service plans on your users:

1# Required module: Microsoft.Graph.Users and Microsoft.Graph.Identity.SignIns
2# Installation
3Install-Module Microsoft.Graph -Scope CurrentUser -Force
4 
5# Connect with minimum required scope
6Connect-MgGraph -Scopes "User.Read.All", "Organization.Read.All"
7 
8# Service plan corresponding to Information Protection for Office 365 - Premium (E5/Purview Suite)
9$targetServicePlan = "MIP_S_CLP2"
10 
11# Retrieve all licensed users
12$users = Get-MgUser -All -Property DisplayName, UserPrincipalName, AssignedLicenses, AssignedPlans
13 
14$licenseReport = foreach ($user in $users) {
15    $hasEndpointDLP = $user.AssignedPlans | Where-Object {
16        $_.ServicePlanId -eq $targetServicePlan -and $_.CapabilityStatus -eq "Enabled"
17    }
18 
19    [PSCustomObject]@{
20        User              = $user.DisplayName
21        UPN               = $user.UserPrincipalName
22        EndpointDLP_Active = [bool]$hasEndpointDLP
23    }
24}
25 
26# Display summary
27$licensed   = ($licenseReport | Where-Object { $_.EndpointDLP_Active }).Count
28$unlicensed = ($licenseReport | Where-Object { -not $_.EndpointDLP_Active }).Count
29Write-Host "Users with Endpoint DLP: $licensed" -ForegroundColor Green
30Write-Host "Users without Endpoint DLP : $unlicensed" -ForegroundColor Yellow
31 
32$licenseReport | Where-Object { -not $_.EndpointDLP_Active } |
33    Export-Csv -Path "$env:USERPROFILE\Desktop\UsersWithoutEndpointDLP.csv" -NoTypeInformation -Encoding UTF8

Troubleshooting common errors

Trade-off: which offering for which organization profile?

Key takeaways

• Business Premium covers Exchange, SharePoint, and OneDrive DLP — sufficient for basic protection, insufficient once Teams or endpoints come into play.
• Endpoint DLP and Teams DLP are the two capabilities that most often drive the move to Purview Suite or E5.
• Edge DLP and Network Data Security capabilities are PAYG even in E5 — factor this cost into your budget estimates.
• Copilot DLP (prompt protection + blocking on labeled content) requires Purview Suite or E5 and an active Microsoft 365 Copilot license.
• DLP alerts in Business Premium are restricted to workloads licensed to the source user — a blind spot to document in your risk analysis.
• Before any licensing decision, audit your existing policies with Get-DlpCompliancePolicy: you will avoid paying for capabilities already partially covered or not yet deployed.

If your organization is about to deploy Microsoft 365 Copilot or expand hybrid work on unmanaged devices, the move to Purview Suite represents the most rational entry point — E5 being justified only if you simultaneously need all Microsoft compliance capabilities (eDiscovery Premium, Insider Risk Management, Communication Compliance).