A finance analyst creates an Excel file containing next year’s renewal pricing for every account and stores it in OneDrive. The tenant applies the default General label.
The analyst shares it with a sales manager. The manager downloads it to a laptop, saves a copy under a different name, uploads that copy to a SharePoint project site, and shares the SharePoint file with a partner working on one of those accounts.
Nothing unusual happened. Every action is consistent with normal collaboration. But a partner working on a single deal can now see pricing for every customer.
The organization now has to answer a different question:
Where is the pricing data?
There is an answer for where the files are. One copy is in OneDrive, another is on a laptop, another is in SharePoint. There are also records of who accessed them, who shared them, and what policies apply.
The security question goes deeper. Are these three files the same underlying content, and how did that content move from one location to another? Once the exposure is understood, can security take a precise action on the specific file that is exposed?
Microsoft 365 and Purview provide a substantial set of controls for answering parts of these questions. The architectural question is whether those controls, together with the rest of the security stack, give you enough understanding of the data behind the file.
The problem is bigger than the file
A file is an object.
It has an owner, a location, permissions, a label, and a history of activity around it. Microsoft 365 records much of what happened in the example above. The audit trail captures activity around the files, and Purview can evaluate their content and user activity through its classification, DLP and risk controls.
But the data inside the file can have a much longer life than the file itself.
The same pricing information can be downloaded, renamed, copied, moved to another location, and shared again. The filename can change. The permissions can change. The location can change. Even the classification state can change.
The harder question is whether the security architecture can establish that the content in those different files is actually the same content.
That is the distinction between understanding a file and understanding the data behind the file.
It becomes important when security teams move from asking:
“What is happening to this file?”
to:
“What is happening to this data?”
1. Classification: Understanding what the data represents
Classification is where this starts.
Microsoft Purview identifies sensitive information through mechanisms including sensitive information types, Exact Data Match, trainable classifiers, and document fingerprinting, and uses sensitivity labels to drive policy. Those controls are valuable, particularly when the organization has already invested in a well-designed Microsoft information protection taxonomy.
The challenge is that sensitive information does not always announce itself through a predictable pattern.
Consider a document containing a mixture of customer names, contract terms, renewal dates, pricing, discounts, and account information. The sensitivity of the document comes from the combination and meaning of those fields, not necessarily from one isolated string.
Matters.AI approaches classification by using AI to understand the context and meaning of the content itself.
The objective is not to keep adding narrower classifiers for every possible variation of sensitive information. It is to understand what the data represents well enough that classification can become an input to the controls already operating in the environment.
That distinction becomes more important as the volume and variety of data grow. The more kinds of sensitive content an organization holds, the harder it becomes to describe each one in advance.
2. Content identity: Recognizing the same data in different files
Classification tells you what something contains.
The next question is whether you can recognize that content when it appears somewhere else.
In the example above, the original file exists in OneDrive. A copy is downloaded to a laptop. Another copy is uploaded to SharePoint under a different filename.
From a file-management perspective, these are separate objects.
From a data security perspective, they may represent the same content.
Matters fingerprints file content so duplicate copies can be recognized across Microsoft 365 and connected endpoints. Fingerprinting runs across discovered files, not just those already identified as sensitive. The lineage experience surfaces that relationship for sensitive content.
This distinction is important.
A file that is not sensitive today can become sensitive tomorrow. If content identity only begins to exist after a file has already been classified as sensitive, the system has less context about where that content came from and where its copies may exist.
Matters establishes content identity across the files it discovers without requiring an administrator to first define which documents should be fingerprinted.
That allows the original OneDrive file, the laptop copy and the SharePoint copy in our example to be understood as instances of the same underlying content.
3. Lineage: Reconstructing what happened to the content
Fingerprinting tells you that the OneDrive file, the laptop copy and the SharePoint copy contain the same content. Lineage tells you how that content moved from one to the next.
An audit trail can tell you that a user downloaded a file, uploaded another file, or shared a document externally. Those events are valuable, but they are generally recorded as activity around individual files and users.
Content lineage connects those copies.
In the pricing example, the security team can see that the content originated in OneDrive, appeared on an endpoint, and was subsequently uploaded to SharePoint. The security question is no longer just whether someone shared a file. It is whether sensitive content moved through a sequence of locations and eventually reached an external party.
This creates a different way of investigating exposure.
A user-centric investigation asks:“What did this person do?”
A file-centric investigation asks:“What happened to this file?”
A content-centric investigation asks:“Where did this data go?”
These questions overlap, but they are not interchangeable.
For data security teams, the third question can be particularly important because the same data may exist across multiple files, users and locations.
4. Policy: Applying the MIP labels Purview enforces
Understanding the data is only useful if it can influence the controls already deployed.
This is where Matters works with Microsoft Information Protection rather than attempting to introduce a parallel labeling system.
Matters syncs the customer’s existing MIP label taxonomy. The customer chooses which labels Matters is allowed to apply and can map those labels to specific data elements and conditional or tag-based rules.
For files that already carry MIP labels, the customer can configure whether Matters should respect the existing label or override it when its classification and configured rules indicate a different result.
Consider the SharePoint copy of the pricing file. It carries the General label. With override configured, if Matters classifies its content as sensitive pricing information and a configured rule maps that data to Confidential, the copy’s MIP label can become Confidential.
Purview can then use that sensitivity label within the policies and controls already configured in the Microsoft environment.
The important architectural point is that the interoperability mechanism is the MIP sensitivity label.
Matters understands the content. MIP expresses that understanding through the organization’s existing sensitivity taxonomy. Microsoft controls can then enforce policies against that classification.
Matters also writes its own metadata tags, which extend beyond Office files and can carry classification to other systems that read file metadata. For Purview, MIP labels are the integration path.
This means the organization does not need to abandon its existing Microsoft information protection model to introduce deeper content understanding.
5. Acting on the specific exposure
Detection and classification eventually have to lead to action.
Suppose the SharePoint copy of the pricing file has been shared with an external partner. Once the organization understands what the file contains and who currently has access to it, the next question is what should happen to that specific file.
Matters can directly remediate Microsoft 365 files in both OneDrive and SharePoint. The actions available depend on the file’s source and current state: making the file private, removing external access, revoking access for a specific recipient, narrowing the link scope, scheduling external access to end at a specified time, setting a link expiry, or deleting the file.
That matters because remediation does not always mean deleting the file or removing every person’s access.
In the pricing example, the partner needs pricing for one account, not a file containing every account. Revoking that specific recipient is a much more precise response than broadly restricting the document. Where a partner genuinely needs a file for a limited period, setting an expiry may be the better answer.
This is complementary to Microsoft’s enforcement capabilities, not a replacement for them.
The difference is that classification and content history can provide additional context for deciding which file requires action and why.
6. The same principle applies to structured data
The problem does not stop with files.
Databases create a different version of the same challenge. Consider an application database. A customer’s name and email sit in a customers table. Their account sits in an accounts table, linked by a customer ID. Their invoices link to the account rather than directly to the customer. Their support tickets reference the customer ID and may contain personal details in free-text notes.
A subject rights request is therefore not simply:
Which table contains this person’s name?
The useful question is:
Which connected records constitute that person’s data?
Matters Data Flow maps those relationships at the schema and table level. It can understand how tables connect, which tables contain sensitive data, and how records can be stitched together across those relationships.
That makes it possible to trace a person’s records across connected schemas and tables for Data Subject Requests, including records that do not mention the person by name.
The mechanism is separate from Microsoft 365 content lineage, but the underlying principle is the same: security needs to understand relationships between pieces of data, not only the individual objects in which those pieces happen to reside.
So what does this mean if you already have Microsoft 365 E3 or E5?
If you already have Microsoft 365 and Purview, the starting point should not be:
“What does Purview lack?”
Purview is where your labels, policies and enforcement live. The real question is how accurately those controls understand the data they are acting on.
With E3, the foundation is sensitivity labels and DLP across Exchange, SharePoint and OneDrive. Applying labels in E3 is largely manual, with automatic labeling licensed at higher tiers, so a label is more likely to reflect a user’s choice or a default than the content itself. The pricing file in our example is exactly that case. Matters can add contextual classification, content identity across copies, lineage across Microsoft 365 and connected endpoints, and direct remediation of exposed OneDrive and SharePoint files. Where your Microsoft licensing supports it, Matters can also apply labels from your existing taxonomy for your Purview policies to act on.
With E5, you have a broad control environment: DLP across Microsoft 365, endpoint DLP, Insider Risk Management, Copilot controls and more. Many of those controls act on sensitivity labels, so they are only as accurate as the labels they are given. That is where Matters fits in an E5 estate. Matters works out what the data is from its content, recognizes duplicate copies across Microsoft 365 and connected endpoints, and records how that content moved. It applies the right MIP label from your taxonomy, under your rules, and Purview enforces on those labels through the policies you have already built. You keep your E5 investment, and your enforcement gets a more accurate picture of the data it protects.
Six questions to ask about your Microsoft 365 data
When evaluating whether your current architecture gives you sufficient visibility and control, ask:
- Classification: Can the system understand what the data represents from the content itself?
- Content identity: Can it recognize the same content when it is copied, renamed or moved?
- History: Can you reconstruct where that content has been and how it reached its current location?
- Policy: Can deeper data understanding be expressed through the sensitivity labels and policies you already use?
- Response: Once an exposure is identified, can you take a precise action on the specific Microsoft 365 file?
- Relationships: For structured data, can you understand how records relate across schemas and tables rather than treating every table as an isolated source?
If your current stack answers all six clearly, you are in a strong position. If it doesn’t, those gaps are where Matters fits.
These questions change the evaluation from “What controls do we have?” to “What does our security architecture actually understand?”
Understanding the data behind the file
Microsoft 365 gives organizations a powerful set of controls around files, identities, activity and policy.
But files are containers.
The data inside them can be copied, renamed, moved, shared and connected to other data. Its security context can therefore persist even when the original file no longer does.
That is why a mature data security architecture has to look beyond the individual file.
For organizations already invested in Microsoft 365 and Purview, this does not have to mean replacing what is already there. It means asking:
Can we understand the data behind the file well enough for our existing controls to protect it?
That is the problem Matters is designed to address.
