Course 02 · Available now
Nine modules on the Purview stack most tenants misconfigure. Sensitivity label anatomy, container vs file labels, auto-labelling caps that stop policies at 100k/day, custom SITs, DLP for the Copilot location (custom-only, disables all other locations, four-hour propagation), and the default DLP policy Microsoft ships in every tenant.
CA$99 one-time · lifetime access · verified against Microsoft Learn
Enrolment
Lifetime access · no subscription · no renewals
Bundle all 6 courses · CA$399 (once Courses 3-6 ship)
Why this course exists
The single most common finding on a Copilot readiness assessment: the client "has sensitivity labels." Which means they published four labels in Purview and never got them applied to any actual files. Copilot reads unlabelled files. Copilot does not care that you have a label taxonomy sitting in a policy centre.
This course teaches the parts of Purview that survive contact with real tenants. Container labels that don't propagate down to items (the mistake everyone makes). Auto-labelling policies that respect the 100,000-files-per-day tenant cap. DLP for the Copilot location — custom-only template, all other locations disabled when you select it, up to four hours to propagate a policy edit. And the default DLP policy Microsoft already pre-created in your tenant that you probably haven't touched.
Every claim in the course cites its Microsoft Learn source. No war stories, no vendor speculation — just the parts of Purview that matter for Copilot, sourced from the documentation.
Curriculum
Each module includes written reference, callouts for the traps, tables for the licensing / role / permissions matrices, and a knowledge-check quiz. Complete all nine plus the final exam to earn CCPP certification.
The mental model — Copilot honours labels at grounding time via EXTRACT usage rights. The one control that doesn't exist: blocking Copilot from processing unlabelled files. Why coverage IS the control.
Scopes (Files / Emails / Meetings / Groups & Sites). Priority ordering. Encryption vs content markings. Sub-labels (one level deep, no grandparents). Why user-defined-permission labels silently break Copilot agents.
Set-SPOTenant enablement. PDF support (16.0.24211.12000+ shell). Multi-Geo enablement per satellite. Signed PDF gotcha. Why "DLP isn't inspecting labelled files" is a Module 3 question first.
The rule everyone gets wrong: items don't inherit container labels. What container labels DO control (privacy, external access, unmanaged devices, discoverability, shared channels). Shared-channel inheritance. Set-SPOSite for bulk.
Client-side vs service-side. The 100,000-per-day tenant cap and how to sequence around it. Simulation mode. Failure taxonomy (labelling vs system). The zero-byte trap that leaves you stuck at 98%.
Three custom-SIT creation paths (UI, EDM, PowerShell). Boost.RegEx 5.1.3 engine — not PCRE, not .NET. Confidence levels + character proximity. DBCS languages. When to use trainable classifiers instead (and why they can't be retrained).
Custom template only. Selecting Copilot disables all other locations. Three protections: block SITs in prompts, block labelled files from processing, block web-search grounding. Emails supported only from 2026-01-01. Up to 4-hour propagation. Least-privilege role.
Microsoft pre-creates it in every tenant. Ships in simulation mode. Detects ~91 SITs in prompts. Four edits every consultant should make. When to delete it entirely.
90-day rollout in four phases. The licensing table (E3 vs E5 vs Purview add-on — DLP for prompts works on ANY M365 Copilot licence). The four rollout risks that end pilots. Role delegation without Global Admin.
Reference sections included
Nine modules · findings quick-reference · CCPP certification exam · every claim citing its Microsoft Learn source. No subscription. No renewals. Free updates as Microsoft ships new Purview features.