ON-DEMAND CLASSIFICATION  |  MICROSOFT PURVIEW

Bridging the decision gap between protecting sensitive data and pay-as-you-go costs

Compliance admins knew sensitive data was likely sitting untouched across their environment, but scanning to find it came at a real cost. This case study is how I designed the experience that let admins see both the impact and the cost, and act with confidence.

MY ROLE

Lead product
designer

THE TEAM

2 Product Managers

4 Engineers

1 Researcher

1 Content Designer

TIMELINE

2 months

Live in Microsoft Purview · June 2025

320+

billed tenants (past 6 months)

3K

scans created (6 months)

$700K

revenue generated (1 month)

01/ CONTEXT

Before we dive in

What's Microsoft Purview?

Microsoft Purview is Microsoft's compliance suite for enterprises, a set of tools that help organisations protect sensitive data and meet regulations like HIPAA, GDPR, and others.

What's Data Classification?

Imagine you're moving houses and you're packing your things in boxes.

  • Some boxes contain expensive plates, others important files, etc.
  • After closing the boxes you don't know what's inside the boxes.
  • To help you handle and transport these boxes carefully you'd label certain boxes as fragile, important, books, donate etc.
  • Labels help you give appropriate attention to the box.

Purview's Data Classification does the same for organisational data. It scans files and emails, 'labelling' them based on sensitive content like credit card numbers or employee IDs. This labelling tells other compliance tools how to treat each file.

Data classification is a foundational step many other Purview tools rely on.

Items you need to relocate

Packed within boxes

Boxes with appropriate labels

DATA CLASSIFICATION

Scan data in the environment

Apply sensitivity marker

Other Purview tools apply protections to data marked sensitive.

02/ THE PROBLEM

Classification is necessary, but scanning data at rest has cost implications.

Microsoft Purview data classification system is forward looking

Not onboarded to Purview

Lots of data already generated in the system

Onboarded to Purview

Files generated or used start getting classified.

Old files not used from day 1 remain unprotected

Created a new classifier.

Files generated or used after 'day n' start getting classified.

Old files not used from 'day n' do not get checked for new classifier

The concerns

Compliance risk.

Without data at rest classification, admins had no full picture of the sensitive data sitting across their environment.

Blocker to AI adoption.

Copilot could potentially read unclassified data contents and surface them to any employee who was never meant to see that information.

Blocker for migrating to Purview.

Old files remaining unprotected was blocking for adopting Microsoft Purview.

HIPAA regulation says we must protect all patient data, not just new patient data."
- St. Luke's Hospital

LabCorp and Novant Health raised similar concerns.

National Bank of Australia wants to ensure that secret/highly confidential emails in top managers' mailboxes are not processed by Copilot M365.
- NAB

BNP Paribas and Marriott raised near-identical concerns.

Existing untouched data on 45k machines protected by Symantec should continue to remain protected after moving to Microsoft Endpoint DLP
- Progressive (on migrating from competitor to Purview)

The Challenge

Costly scan process about $20 per 10k files.

Need approvals from finance/leadership teams

How might we help compliance admins make the choice to scan data confidently?

...within Microsoft generally you can enable and turn everything on and it looks great, sounds great, but then once you get the bill, you know, you're scared to death."
- NET

03/ THE PROCESS

Decisions that shaped the experience

This project came to me after the first cut was designed and first round of user testing was done.

I took the research insights and evaluated the designs.

01| Splitting the scan into distinct steps

02| Making progress visible

03| Surfacing the right information

01

Splitting the scan into distinct steps

INITIAL HYPOTHESIS

Admins would prefer to start classification of data directly as the benefits are obvious.

RESEARCH INSIGHTS

  • 5 of 5 users said that they would want 'simulation' first and not directly classify data
  • Approvals from finance or leadership would be required before deploying a pay-as-you-go capability.

DECISION

Make On-demand scanning a 2 step process

  1. Estimation
  2. Classification

REASONING

  • Compliance admins have a mental model of 'simulating' policies as first step before deploying it in other Purview workflows.
  • Admins could not proceed until they knew how much it would cost.

OUTCOME

Estimation was made compulsory.

This would ensure transparency making admins aware of the costs before committing to a scan.

TRADEOFF

Admin needs to initiate classification after estimation is complete.

V1 scan review screen

Estimation as an option in the final step of scan creation

02

Making progress visible

CONTEXT

  • Admins need to initiate classification
  • Classification is where the business makes money
  • Users needed to know clearly which phase they were in to initiate the next phase.

USER TESTING

I explored different ways to show the user which phase of the scan they were in based on what was available in the design system and modifying existing components to create a custom component.

DECISION

Made the two phases explicit in the interface.

EXPLORATION 1

Based on the audited pattern used in Microsoft Privacy.

VERDICT: Dropped

REASON:

  • Failed to scale to the various states that were required to be shown.
  • Failed to communicate that the next step was needed to be taken by the user.

EXPLORATION 2

Based on Purview header component showing state of page.

VERDICT: Dropped

REASON:

  • 2 of 5 users could not clearly understand that they needed to take action to go to the next step from this status alone.

EXPLORATION 3

Custom component I created by modifying existing component

VERDICT: Used in experience

REASON:

  • 5 of 5 users could clearly decipher what part of the scan process they were in.

NOTE:

'Step 1' and 'Step 2' made explicit by content designer following feedback from user research.

03

Surfacing the right information

PROCESS

Heuristic evaluation of V1 designed by previous designer.

  • The cost information and the scan information were divided.
  • The metrics on the screen were difficult to understand

ADDED CONTEXT

Product requirement to add more information to the classification phase metrics.

ANALYSIS

User research analysis surfaced the top needs of the user:

  • What needs to be scanned
  • How much cost am I expecting
  • How long will it take?

DECISION

Refine information architecture and use card component to surface and segregate information.

Drag to compare BEFORE and AFTER

Some rejected information architecture explorations:

Information architecture used in the final cards

Estimation phase scan overview information design

  • Most important information to decide if scan is required
  • Added scan progress to indicate how many more assets could be expected
  • Pushed for the time information to be added so users could estimate in how much time they should come back to the scan flow to proceed to the next step
  • Added cost estimation last for ease of reading and retaining
  • Matched most important action for user with the information.

Classification phase scan overview information design

  • Added info-tips wherever required after multiple iterations to minimise their use with content team on the titles.
  • Added total and estimated cost beside each other to remind user of the estimated cost. Transparency builds trust, and brings delight when estimation cost matches actual cost.

Devices scan details information design

Requirement to show lots of metrics for Devices

 

Insights from users backed having a lot of metrics as they mentioned 'the more information the better'.

 

Discussions with PM to show the most important metrics still led to a very long list.

 

I reduced cognitive load by grouping information and increasing the dimensions of the card.

Cloud locations scan details information design

With fewer metrics to show for SharePoint scan details, I combined it with the Items found, scan progress and cost estimations.

04/ IMPACT

From uncertainty to a confident decision

The final experience gives admins a clear view of the information they require to make the case for the requirement of the scan for their data at rest thereby improving the organisation’s security posture.

Feature GA'd in June 2025 post private and public previews.

IN THE PAST 6 MONTHS

  • 320+ billed tenants
  • 3k+ scans executed
  • 700k+ revenue generated in the last 30 days

...I can see the cost, I can download the report and show whoever is going to do the approvals and justify the need for scan..."
- EY

05/ PUTTING IT ALL TOGETHER

06/ TAKEAWAYS

Clarity is key

It was interesting to know that in the face of sensitive information, costs are still a big factor. Bringing transparency and confidence is more important even if the tradeoff is more clicks for the user.

Working within the design system

Leveraging and modifying existing components to create a custom component gets buy-ins readily and is a smaller cost and effort for developers.