Your biggest data protection problem might already be sitting in SharePoint
When organisations talk about information protection, the conversation often focuses on what happens from now on.
New documents get created.
New files are uploaded.
Users apply sensitivity labels.
Policies are configured.
DLP is enabled.
Everything looks nicely governed.
But there is a problem.
❓ What about the millions of files that were created before all of those controls existed?
That’s where Microsoft Purview Roadmap ID 499076 gets interesting.
Microsoft is introducing a capability that will allow administrators to scan existing files at rest in SharePoint and OneDrive for Business for sensitive information. The roadmap currently lists the feature as In development, with General Availability targeted for December 2026.
And this could be a very useful addition to the Purview toolkit.
💾 The forgotten data problem
Think about a typical Microsoft 365 environment.
An organisation may have been using SharePoint and OneDrive for years.
During that time, users have created:
- Contracts
- HR documents
- Financial spreadsheets
- Customer information
- Employee records
- Project documentation
- Commercial plans
- Legal documents
- Reports
- Presentations
- Old archives
Some of these files may be labelled.
Some may be protected by DLP.
Some may have been automatically classified.
And some may have never been evaluated for sensitive information at all.
This creates what I would call the “legacy data problem.”
Your organisation may have excellent information protection controls today…
…but that doesn’t necessarily mean your historical data has been through those controls.
❕ Why “at rest” is important
The wording in Microsoft’s roadmap is particularly interesting:
“existing files at rest”
This is important because Microsoft already has mechanisms that evaluate content when it is created, edited or otherwise processed.
Microsoft’s current guidance explains that files in SharePoint and OneDrive can remain unclassified if they haven’t been edited or touched, and that on-demand scanning can be used to evaluate historical content.
That’s a huge distinction.
Imagine a document created in 2019.
It hasn’t been opened since.
Nobody has edited it.
It contains sensitive information.
Your organisation introduced a much better Purview classification strategy in 2025.
Does that automatically mean the 2019 document has been evaluated against your new classification approach?
Not necessarily.
That’s the gap this type of capability is designed to address.
📈 This could change how organisations approach data discovery
One of the biggest challenges with information governance is knowing what you actually have.
Organisations often have policies saying:
“Sensitive information must be protected.”
But the more difficult question is:
“Where is the sensitive information?”
And that’s much harder to answer when you’re dealing with millions of files.
This new capability moves the conversation from:
“We have policies.” to: “We’ve actually evaluated our existing data.”
That’s a significant difference.
👨🔬 Imagine what you could discover
An organisation could potentially uncover things like:
📁 Old HR information
A spreadsheet containing employee information from several years ago.
💰 Financial information
Historical financial reports containing sensitive commercial data.
👥 Customer information
Legacy customer datasets sitting in an old SharePoint site.
📄 Contracts
Commercial agreements containing confidential terms.
🔐 Credentials and secrets
Sensitive authentication-related information accidentally stored in documents.
The important point isn’t simply finding the files, it’s understanding where your protection gaps actually exist.
👁️ This isn’t just a scanning exercise
I’d argue that organisations shouldn’t approach this feature as:
“Let’s scan everything and see what happens.”
That’s potentially a recipe for an enormous amount of data.
Instead, this should become part of a structured information governance exercise.
Think about the process as:
Discover → Classify → Assess → Protect → Remediate → Monitor
Discover
Find sensitive information that already exists.
Classify
Understand what type of sensitive information you’ve found.
Assess
Determine whether the information is appropriately protected.
Protect
Apply appropriate sensitivity labels, DLP controls or other safeguards.
Remediate
Move, restrict, delete or otherwise address information that shouldn’t exist where it currently does.
Monitor
Continue looking for new gaps.
That’s a much more mature approach than simply running a scan.
🗂️ The relationship with sensitivity labels
This is where things become particularly interesting for Purview administrators.
Finding sensitive information doesn’t automatically mean that the file has an appropriate sensitivity label.
Microsoft’s current Purview guidance highlights the importance of automatically applying sensitivity labels to existing SharePoint and OneDrive content and notes that service-side auto-labelling can apply to existing files.
So imagine discovering:
10,000 files containing sensitive information
The next question becomes:
How many of those files are actually protected?
And then:
How many should be labelled?
And:
Are the labels appropriate?
This is where scanning becomes the beginning of the governance process rather than the end.
🔓 Don’t confuse discovery with protection
This is an important point.
Finding sensitive information isn’t the same as protecting it.
You could scan your entire SharePoint estate and discover thousands of sensitive documents.
But if you don’t have an appropriate response strategy, you’ve simply created a very large report.
The real value comes from connecting discovery to action.
For example:
Sensitive information detected
↓
No sensitivity label
↓
Assess business context
↓
Apply appropriate label
↓
Apply DLP controls
↓
Monitor
That’s where Purview becomes much more powerful.
🤖 There’s also an AI governance angle
And this is perhaps where I think this update becomes particularly relevant.
We’re entering an era where AI tools such as Microsoft 365 Copilot and agents can make it easier to discover and work with organisational information.
That makes the quality of your underlying data governance increasingly important.
If your SharePoint environment contains years of poorly classified, overshared or sensitive content, simply deploying Copilot doesn’t make that problem disappear.
In fact, AI can make existing governance weaknesses more important.
The better question isn’t:
“Have we deployed Copilot?” It’s “Is the data that Copilot can potentially work with appropriately governed?”
That’s why data discovery and information protection are becoming fundamental parts of AI governance.
🧠 What should organisations start thinking about?
Although Microsoft currently lists this as In development, with GA targeted for December 2026, I’d start thinking about the implications now.
Ask yourself:
1. How much historical data do we have?
Do you know how many files exist across SharePoint and OneDrive?
2. How much of that data has actually been classified?
Not how much could be classified.
How much has actually been evaluated?
3. Where are your high-risk locations?
Which SharePoint sites contain the most sensitive information?
4. What happens when sensitive information is discovered?
Do you have a defined remediation process?
5. Are your labels appropriate?
Finding a sensitive document is only useful if you can determine what protection it actually requires.
6. Are you ready for AI?
If Copilot and agents are increasingly working with organisational information, your information protection strategy becomes even more important.
💡 The Jim Talks takeaway
For me, the most interesting thing about Roadmap 499076 isn’t the scanning capability itself.
It’s the principle behind it.
You can’t govern data you haven’t discovered.
And organisations have accumulated an enormous amount of data over the years.
Some of it is valuable.
Some of it is obsolete.
Some of it is sensitive.
Some of it is duplicated.
And some of it probably shouldn’t be there anymore.
The next phase of Microsoft Purview isn’t just about protecting new data.
It’s about finally shining a light on the data that’s been sitting quietly in the background for years.
And perhaps the most uncomfortable question of all is:
“What would we discover if we scanned everything we’ve been ignoring?”
That could be where the really interesting findings begin.
🗺️ Microsoft Purview Roadmap ID: 499076
🏗️ Status: In development
📅 Target GA: December 2026
Leave a Reply