Platform / XQ + Microsoft Purview
XQ + Microsoft Purview
Purview governs the environment. XQ protects the data.
Microsoft Purview classifies and governs data inside your Microsoft 365 tenant. XQ extends it everywhere else: it discovers and classifies sensitive data in Snowflake, AWS S3, Azure, databases, APIs and edge systems, applies native Purview (MIP) sensitivity labels automatically, and turns each label into object-level encryption and access policy enforced wherever the data goes.
Built for CISOs and compliance leads running Microsoft Purview · Enterprises with sensitive data in Snowflake, AWS and Azure · Public-sector agencies sharing data with contractors and partners
At a glance
PurviewClassification and compliance policy inside Microsoft 365
XQ addsDiscovery, labeling and encryption beyond the tenant
LabelsNative Purview (MIP) labels, applied automatically
SharingExternal recipients need no guest Entra accounts
Works with Microsoft Purview · Microsoft 365 · Microsoft Entra ID · Copilot · Snowflake · AWS S3 · Azure · Databases · APIs
Zero blind spots
XQ scans multi-cloud stores, warehouses, databases and APIs, expanding classification coverage across 100% of corporate data assets.
Automated Purview labeling
Native MIP labels are applied in the background — no user prompts — raising Purview’s effective label coverage.
Key sovereignty everywhere
Labels become object-level encryption with customer-controlled, geofenced, post-quantum-ready keys.
Where Purview’s boundary ends
Purview is where organizations manage sensitivity labels and Microsoft security controls — and it governs Microsoft 365 documents and SharePoint sites well. But much of an organization’s sensitive data lives outside, or travels beyond, that estate: data lakes, warehouses, databases, APIs and partner environments that tenant classification cannot see.
- Discovery blind spot: external lakes, APIs and non-Microsoft pipelines go unclassified.
- Access blind spot: knowing a sensitive file exists isn’t knowing who can reach it through nested permissions.
- Sharing overhead: external collaborators typically need guest identities and cross-tenant configuration.
A common request from Purview customers: keep Purview as the place to manage labels, but find a better way to discover, classify and protect the sensitive data outside the core Microsoft estate.
How XQ and Purview work together
| Stage | Who | What happens |
|---|---|---|
| 1. Discover | Purview + XQ | Purview monitors Microsoft 365; XQ scans Snowflake, AWS, Azure, databases, APIs and edge servers. |
| 2. Label | XQ | Applies native Purview (MIP) sensitivity labels silently, across every file and record. |
| 3. Govern | Purview | Sets the classification standard and compliance rules. |
| 4. Policy | XQ | AI generates ABAC and geofence rules from the labels. |
| 5. Protect | XQ | Binds an individual key and access controls to each object — labels become cryptographic boundaries. |
| 6. Enforce | XQ | Verifies identity, location and conditions every time the data is opened, anywhere. |
The question changes from “Does the destination support Microsoft rights management?” to “Is this recipient authorized to unlock this XQ-protected object?”
Want to see where Purview coverage ends in your environment?
What XQ adds to Purview
| Requirement | Microsoft Purview | With XQ |
|---|---|---|
| Microsoft 365 content collaboration | Industry standard | Supported alongside Purview |
| Database record-level protection and sharing | Limited scenarios | Core focus — every record gets its own key |
| API and data-pipeline payloads | Requires third-party bridging | Native protocol support |
| Protection across clouds and tenants | Tenant-centric model | Independent of the destination |
| External recipient onboarding | Entra ID guest accounts | No federation or guest accounts required |
| Attribute-based access control | Microsoft only | Data-type agnostic |
| Admin / data decoupling | Not available | Removes infrastructure administrators from data access |
| Post-quantum cryptographic readiness | None | Dilithium (NIST PQC) |
| Automated key lifecycle | — | Automated key rotation and expiry |
| AI pipeline protection | AI tools get complete access to what users can reach | Shields labeled data from Copilot and AI pipelines |
Blast radius and least privilege
Purview identifies sensitive content types. XQ maps the exact effective access behind nested groups, ACLs and sharing links — the blast radius of each sensitive object — and automatically revokes excessive rights without disrupting business workflows.
Share without guest accounts
- Possession isn’t access: a partner can host or receive data without the ability to decrypt it; key management stays sovereign.
- No guest Entra accounts: recipients are authenticated independently of their identity domain or federation status.
- Instant cutoff: when a contract ends, revoking authorization renders the data unusable — no file retrieval required.
- Record-level segmentation: individual files and database records get dedicated keys from their labels, isolating CUI, ITAR and PII instead of exposing whole folders.
Value for regulated and public-sector teams
- Supports NIST SP 800-171 / CUI, HIPAA, GDPR, CJIS and ITAR data-protection requirements.
- Cryptographic provenance and a complete audit trail across multi-cloud pipelines.
- Zero guest fees — cuts guest identity and licensing overhead — and 80% less administration by eliminating manual cross-tenant enclave configuration.
- Onboards contractors in minutes, with deterministic revocation at contract end.
- Payloads stay encrypted even in a compromised cloud; sensitive-data borders are enforced continuously.
- Native protection for applications, databases, telemetry and APIs — no custom code.
Related resources and articles
FAQ
XQ + Microsoft Purview, answered directly.
Does XQ replace Microsoft Purview?
No. Purview remains where you manage labels and compliance rules. XQ extends discovery, labeling and enforcement beyond the Microsoft 365 tenant and turns labels into encryption that travels with the data.
Does XQ use our existing Purview labels?
Yes. XQ applies native Purview (MIP) sensitivity labels automatically and syncs with them bi-directionally, so the same labels drive protection inside and outside Microsoft.
Where does XQ find data Purview can’t see?
In multi-cloud stores and warehouses such as Snowflake and AWS S3, in Azure, databases, APIs, edge servers and AI pipelines.
Do external recipients need guest accounts?
No. XQ authenticates recipients independently of their identity domain, so sharing needs no guest Entra accounts or federation.
Can XQ keep sensitive data away from Copilot and other AI tools?
Yes. Data is encrypted and governed by its label, so AI assistants and agents can only reach what policy allows.
Can XQ reduce overexposed data that Purview has labeled?
Yes. XQ maps the effective access behind nested groups, ACLs and sharing links — the blast radius of each sensitive object — and automatically revokes excessive rights without disrupting business workflows.
Extend Purview everywhere your data goes.
Book a strategy session to map where Purview coverage ends and how XQ closes the gap.