Policy-based review, with HR and DPO overlay
Communication Compliance
Last reviewed
Ghani Governance configures Microsoft Purview Communication Compliance so it has a written purpose, a named reviewer, and a fairness path. It can detect communications that may breach a written policy, such as harassment, threats, or sharing of regulated information. It is not a licence to watch everyone.
Communication Compliance: purpose, reviewer, and limit
Microsoft Purview Communication Compliance can detect messages that may breach a written policy — for example harassment, threats, or sharing of regulated information. It is not staff surveillance. Enabling every template for the whole tenant is how these programmes lose trust and become hard to defend in a UK organisation.
Ghani Governance configures the product and the overlay around it: which scenarios justify a policy, who may see a match, how HR is involved, and how the data protection officer (DPO) can explain the purpose. Product references: Microsoft’s Communication Compliance documentation and the Communication Compliance get-started guide.
Communication Compliance configuration we deliver
Scope cards below are first-party delivery detail: scenarios, policy settings, named reviewers, HR/DPO overlay, and tuning before population grows. Product behaviour remains as documented in Microsoft’s Communication Compliance get-started guide.
Written scenarios
Each policy has a purpose a non-specialist can repeat. No “monitor everything in case”.
Policy configuration
Scope, conditions and reviewers aimed at usable cases, not volume.
Reviewer access
A small named set. Matches are not a spectator sport for IT.
HR and DPO overlay
Fairness, retention of investigative material, and a path that can be explained if challenged. The DPO is in the design, not a slide at the end.
Testing and tuning
False positives reviewed before the population grows.
Insider Risk Management · DLP implementation · Policy to Purview design · eDiscovery · DSPM for AI · All Purview services
How we implement Communication Compliance
Implementation follows a short sequence: agree scenarios with HR and the DPO, confirm prerequisites, pilot one scenario or a limited population, review match quality, then govern access and change. Steps below are our method; Microsoft’s configure guidance is the product baseline.
Define scenarios
Behaviours that justify a policy, agreed with HR and the DPO.
Prerequisites
Licensing, permissions, related DLP or Insider Risk controls.
Pilot
One scenario or a limited population first.
Review quality
Matches, false positives, and whether reviewers can actually act.
Govern
Ownership, access reviews, change control.
Communication Compliance questions
Is this staff surveillance?
It must not be. Communication Compliance is for defined policy scenarios — for example harassment, threat, or unauthorised sharing of sensitive information — with named reviewers, a purpose, and HR/DPO overlay. Broad “read everyone’s mail” configurations are how these programmes lose legitimacy.
How is this different from DLP or Insider Risk?
DLP looks at sensitive content leaving a channel. Insider Risk looks at patterns of user activity. Communication Compliance reviews the content of communications against policy. They can share signals; they are not substitutes, and they should not all be pointed at the same population without a reason.
Who should be allowed to review matches?
A small, named set — typically a combination of HR, employee relations, legal or compliance, not the whole security team. We design that access with the DPO in the conversation.
Related Purview services
Other Ghani Governance Microsoft Purview services on this hub that often sit alongside Communication Compliance:
- Insider Risk Management — activity patterns and investigation paths that can share signals with communications review
- Microsoft Purview DLP implementation — outbound sensitive-content controls that Communication Compliance does not replace
- Policy to Purview design — mapping written policies before review scenarios are switched on
- Microsoft Purview eDiscovery — holds and collections when a matter needs a formal case path
- DSPM for AI — AI interaction risk where Copilot or agents are in scope
- All Microsoft Purview services — full hub list
Book a discovery workshop
A scoping conversation about what you need to protect, what is already configured, and what must not break.