Implement Data Governance features using Microsoft Purview.

[marcusgraca]

To ensure compliance with data regulations and the proper handling of sensitive information, we need to implement governance, classification, and data protection tools and practices.

As the primary candidate, we will adopt Microsoft Purview, given its seamless integration with the Azure environment.

[LarsKemmann]

The three classification types that we will need to consider are Confidential, PII, and PHI. Confidential information relates to who our customers are, how much they are paying, who their team members are, their policies, and so on, and needs to be kept private. In the set of all information, i.e. general/unclassified, PII is the set of information that is personally identifiable, meaning it can be traced back to a particular person, potentially with some outside knowledge or googling of somebody's address. PHI is a subset of PII that includes health information.

[LarsKemmann]

Privileged identity management in Azure allows for just-in-time escalation of permissions with an approval from other team members, so that we can do things like only giving our team members access to certain customer PII or PHI and only for a time-limited duration. Privileged identity management is orthogonal to all of the security rules. We define the security rules first, and then PIM allows us to say when those enhanced security grants should apply to somebody.