Data Governance: Purview, Sensitivity Labels & Policies
Enterprise data governance with Purview sensitivity labels, access policies, and compliance management
Data Governance Framework
Sensitivity Labels Configuration
from azure.purview.datamap import PurviewDataMapClient
from azure.identity import DefaultAzureCredential
credential = DefaultAzureCredential()
client = PurviewDataMapClient(credential=credential, account_name="purview-prod")
# Apply sensitivity label to asset
client.classification.add_classification(
entity_type="azure_datalake_gen2_path",
entity_guid="asset-guid",
classifications=[
{"typeName": "Microsoft.SensitivityLabel.Confidential"},
{"typeName": "PII.Email"},
{"typeName": "PII.PhoneNumber"}
]
)
# Get classification details
classifications = client.classification.get_classification(
entity_type="azure_datalake_gen2_path",
entity_guid="asset-guid"
)
Access Policy Implementation
{
"policies": [
{
"name": "DataAnalyst-ReadOnly",
"description": "Read-only access for data analysts",
"principal": "data-analysts@company.com",
"scope": "/subscriptions/xxx/resourceGroups/rg/providers/Microsoft.Storage/storageAccounts/stdatalake001",
"role": "Storage Blob Data Reader",
"conditions": {
"sensitivityLabels": ["Public", "Internal"],
"timeRestriction": "BusinessHours"
}
},
{
"name": "DataEngineer-FullAccess",
"description": "Full access for data engineers",
"principal": "data-engineers@company.com",
"scope": "/subscriptions/xxx/resourceGroups/rg/providers/Microsoft.Storage/storageAccounts/stdatalake001",
"role": "Storage Blob Data Contributor",
"conditions": {
"sensitivityLabels": ["Public", "Internal", "Confidential"],
"requireMFA": true
}
}
]
}
âšī¸
Pro Tip: Implement sensitivity labels at the column level for granular protection. Use auto-labeling rules in Purview to automatically classify PII and financial data.
Interview Questions
Q1: How do you implement data governance in a data lake? A: 1) Define data ownership per domain, 2) Implement Purview scanning and classification, 3) Apply sensitivity labels, 4) Set up RBAC and ACLs, 5) Create business glossary, 6) Monitor compliance with audit logs.
Q2: What is the difference between RBAC and ACLs in Azure data governance? A: RBAC provides role-based access at resource level (Storage Account, Container). ACLs provide POSIX-compliant permissions at file/directory level. Use RBAC for administrative access; ACLs for data lake workloads.
Q3: How do you handle data retention policies in Azure? A: Use lifecycle management policies in ADLS Gen2 to automatically tier data (Hot â Cool â Cold â Archive) and delete expired data. Configure retention periods based on compliance requirements (7 years for financial data).