Data Governance: Purview, Sensitivity Labels & Policies

Enterprise data governance with Purview sensitivity labels, access policies, and compliance management

Data Governance Framework

Architecture Diagram

┌─────────────────────────────────────────────────────────────────────┐
│                    DATA GOVERNANCE FRAMEWORK                         │
├─────────────────────────────────────────────────────────────────────┤
│                                                                     │
│  GOVERNANCE PILLARS                                                 │
│  ┌─────────────────────────────────────────────────────────────┐   │
│  │                                                               │   │
│  │  1. DATA STEWARDSHIP        2. DATA QUALITY                  │   │
│  │  ┌─────────────────────┐   ┌─────────────────────┐         │   │
│  │  │ Ownership per domain│   │ Validation rules     │         │   │
│  │  │ Accountability      │   │ Quality metrics      │         │   │
│  │  │ Decision rights     │   │ Remediation process  │         │   │
│  │  └─────────────────────┘   └─────────────────────┘         │   │
│  │                                                               │   │
│  │  3. DATA SECURITY         4. DATA COMPLIANCE                 │   │
│  │  ┌─────────────────────┐   ┌─────────────────────┐         │   │
│  │  │ Sensitivity labels  │   │ GDPR, HIPAA, SOC2   │         │   │
│  │  │ Access policies     │   │ Retention policies  │         │   │
│  │  │ Encryption          │   │ Audit trails        │         │   │
│  │  └─────────────────────┘   └─────────────────────┘         │   │
│  │                                                               │   │
│  │  5. DATA LIFECYCLE       6. DATA CATALOG                      │   │
│  │  ┌─────────────────────┐   ┌─────────────────────┐         │   │
│  │  │ Creation → Archive  │   │ Discovery           │         │   │
│  │  │ Retention → Delete  │   │ Metadata            │         │   │
│  │  │ Tiering policies    │   │ Lineage             │         │   │
│  │  └─────────────────────┘   └─────────────────────┘         │   │
│  └─────────────────────────────────────────────────────────────┘   │
│                                                                     │
│  PURVIEW GOVERNANCE CAPABILITIES:                                   │
│  ┌─────────────────────────────────────────────────────────────┐   │
│  │ • Automated data discovery and classification               │   │
│  │ • Sensitivity labeling (auto + manual)                      │   │
│  │ • Access policies (RBAC + ACLs)                             │   │
│  │ • Data lineage tracking                                     │   │
│  │ • Business glossary                                         │   │
│  │ • Compliance reporting                                       │   │
│  └─────────────────────────────────────────────────────────────┘   │
└─────────────────────────────────────────────────────────────────────┘

Sensitivity Labels Configuration

from azure.purview.datamap import PurviewDataMapClient
from azure.identity import DefaultAzureCredential

credential = DefaultAzureCredential()
client = PurviewDataMapClient(credential=credential, account_name="purview-prod")

# Apply sensitivity label to asset
client.classification.add_classification(
    entity_type="azure_datalake_gen2_path",
    entity_guid="asset-guid",
    classifications=[
        {"typeName": "Microsoft.SensitivityLabel.Confidential"},
        {"typeName": "PII.Email"},
        {"typeName": "PII.PhoneNumber"}
    ]
)

# Get classification details
classifications = client.classification.get_classification(
    entity_type="azure_datalake_gen2_path",
    entity_guid="asset-guid"
)

Access Policy Implementation

{
  "policies": [
    {
      "name": "DataAnalyst-ReadOnly",
      "description": "Read-only access for data analysts",
      "principal": "data-analysts@company.com",
      "scope": "/subscriptions/xxx/resourceGroups/rg/providers/Microsoft.Storage/storageAccounts/stdatalake001",
      "role": "Storage Blob Data Reader",
      "conditions": {
        "sensitivityLabels": ["Public", "Internal"],
        "timeRestriction": "BusinessHours"
      }
    },
    {
      "name": "DataEngineer-FullAccess",
      "description": "Full access for data engineers",
      "principal": "data-engineers@company.com",
      "scope": "/subscriptions/xxx/resourceGroups/rg/providers/Microsoft.Storage/storageAccounts/stdatalake001",
      "role": "Storage Blob Data Contributor",
      "conditions": {
        "sensitivityLabels": ["Public", "Internal", "Confidential"],
        "requireMFA": true
      }
    }
  ]
}

ℹ️

Pro Tip: Implement sensitivity labels at the column level for granular protection. Use auto-labeling rules in Purview to automatically classify PII and financial data.

Interview Questions

Q1: How do you implement data governance in a data lake? A: 1) Define data ownership per domain, 2) Implement Purview scanning and classification, 3) Apply sensitivity labels, 4) Set up RBAC and ACLs, 5) Create business glossary, 6) Monitor compliance with audit logs.

Q2: What is the difference between RBAC and ACLs in Azure data governance? A: RBAC provides role-based access at resource level (Storage Account, Container). ACLs provide POSIX-compliant permissions at file/directory level. Use RBAC for administrative access; ACLs for data lake workloads.

Q3: How do you handle data retention policies in Azure? A: Use lifecycle management policies in ADLS Gen2 to automatically tier data (Hot → Cool → Cold → Archive) and delete expired data. Configure retention periods based on compliance requirements (7 years for financial data).