Microsoft Purview Data Map
The Data Map is the foundational layer of Microsoft Purview data governance: it discovers, scans,
and maps metadata and classifications from data sources across Azure, multicloud, SaaS, and
on-premises - powering the Unified Catalog, lineage, and downstream protection decisions.
When to use
Building an enterprise-wide inventory of data assets and their classifications as the basis for
governance, security, and data product publishing.
Do not use this skill for in-tenant Microsoft 365 classification (use purview-data-classification)
or for AI prompt visibility (use purview-dspm-ai).
Pick the right integration runtime
| Source location |
Use this runtime |
| Azure (Storage, SQL, Synapse, Fabric, Cosmos) |
Managed (Azure-hosted) runtime |
| AWS S3 / RDS, GCP BigQuery, public SaaS |
Managed runtime, with credentials in Key Vault |
| On-premises SQL, Oracle, file shares |
Self-hosted integration runtime (SHIR) on a domain-joined Windows host |
| Private-endpoint-only Azure sources |
SHIR or VNet-integrated managed runtime |
| Power BI tenant |
Native connector, no runtime config |
Rule of thumb: managed runtime first; deploy SHIR only when network or private-endpoint reach
requires it - and treat the SHIR host as Tier-0 infrastructure.
Approach
- Plan collections - Design the collection hierarchy (by business domain or geography)
before registering sources; collections drive RBAC and asset organisation.
Verify: a draft collection tree exists and maps to data-owner accountability.
- Register sources - Connect data sources (Azure Storage, SQL, Synapse, Fabric, AWS S3,
databases, Power BI, etc.) into the right collection with appropriate credentials.
Verify: each registered source shows correct subscription/account and target collection.
- Choose an integration runtime - Use the managed runtime for cloud sources; deploy a
self-hosted integration runtime to reach on-premises or private-network sources securely.
Verify: SHIR status is Running and self-update is enabled.
- Configure scans and rule sets - Schedule scans with scan rule sets; apply
classifications (built-in SITs and custom) and lineage extraction where supported. Start
incremental, not full.
Verify: scan history shows successful runs with classified assets counted.
- Curate - Review discovered assets, apply glossary terms, and assign data owners/stewards;
tune custom classifications based on real matches.
Verify: top assets have owners and at least one glossary term.
- Govern access - Use collections to organise assets and scope permissions by domain;
prefer collection-level role assignment over root.
Verify: collection-admin roles assigned to domain owners, not platform team only.
- Operate - Monitor scan failures, classification drift, and cost; right-size scan frequency
per source criticality.
Verify: a weekly scan-health report exists.
Guardrails
- Scope and schedule scans to manage cost and source load; avoid scanning everything at full
depth on day one - sampling first, full second.
- Secure the self-hosted integration runtime host as sensitive infrastructure - it holds
credentials and reaches into production data sources; patch, restrict logon, monitor.
- Validate classification accuracy before relying on it for downstream protection - sample matches
per SIT and tune confidence levels.
- Use Key Vault for credentials; never embed secrets in scan configuration.
- Plan capacity - Data Map is metered by capacity units; oversized scans inflate cost without
governance value.
Common anti-patterns
- Registering every source into the root collection and assigning everyone Data Reader.
- Scheduling weekly full scans on petabyte data lakes - blows out capacity and budget.
- Running SHIR on a workstation or shared jump host.
- Skipping the glossary and ownership step - assets get classified but nobody acts on them.
- Treating Data Map as a one-off load instead of a continuously curated catalogue.
Example prompts
Register and scan data sources in the Purview Data Map.Configure an integration runtime for multicloud data scanning.How do I map enterprise data and run classification scans?Plan data discovery across cloud and on-prem sources.Design a Purview collection hierarchy aligned to business domains.
Microsoft Learn
1---2name: purview-data-map3description: Guidance for the Microsoft Purview Data Map - the foundation that scans and maps data sources across multicloud and on-premises estates to power cataloging and governance. Covers source registration, integration runtimes (managed vs self-hosted), scan rule sets, classifications, collections, and cost control. WHEN: Purview Data Map, scan data sources, register data source, data discovery, integration runtime, map enterprise data, multicloud data scanning, classification scan, collections, glossary.4license: MIT5---67# Microsoft Purview Data Map89The Data Map is the foundational layer of Microsoft Purview data governance: it discovers, scans,10and maps metadata and classifications from data sources across Azure, multicloud, SaaS, and11on-premises - powering the Unified Catalog, lineage, and downstream protection decisions.1213## When to use14Building an enterprise-wide inventory of data assets and their classifications as the basis for15governance, security, and data product publishing.1617Do not use this skill for in-tenant Microsoft 365 classification (use `purview-data-classification`)18or for AI prompt visibility (use `purview-dspm-ai`).1920## Pick the right integration runtime21| Source location | Use this runtime |22|---|---|23| Azure (Storage, SQL, Synapse, Fabric, Cosmos) | **Managed** (Azure-hosted) runtime |24| AWS S3 / RDS, GCP BigQuery, public SaaS | Managed runtime, with credentials in Key Vault |25| On-premises SQL, Oracle, file shares | **Self-hosted integration runtime (SHIR)** on a domain-joined Windows host |26| Private-endpoint-only Azure sources | SHIR or VNet-integrated managed runtime |27| Power BI tenant | Native connector, no runtime config |2829Rule of thumb: managed runtime first; deploy SHIR only when network or private-endpoint reach30requires it - and treat the SHIR host as Tier-0 infrastructure.3132## Approach331. **Plan collections** - Design the collection hierarchy (by business domain or geography)34 before registering sources; collections drive RBAC and asset organisation.35 *Verify: a draft collection tree exists and maps to data-owner accountability.*362. **Register sources** - Connect data sources (Azure Storage, SQL, Synapse, Fabric, AWS S3,37 databases, Power BI, etc.) into the right collection with appropriate credentials.38 *Verify: each registered source shows correct subscription/account and target collection.*393. **Choose an integration runtime** - Use the **managed** runtime for cloud sources; deploy a40 **self-hosted integration runtime** to reach on-premises or private-network sources securely.41 *Verify: SHIR status is Running and self-update is enabled.*424. **Configure scans and rule sets** - Schedule scans with scan rule sets; apply43 **classifications** (built-in SITs and custom) and lineage extraction where supported. Start44 incremental, not full.45 *Verify: scan history shows successful runs with classified assets counted.*465. **Curate** - Review discovered assets, apply glossary terms, and assign data owners/stewards;47 tune custom classifications based on real matches.48 *Verify: top assets have owners and at least one glossary term.*496. **Govern access** - Use collections to organise assets and scope permissions by domain;50 prefer collection-level role assignment over root.51 *Verify: collection-admin roles assigned to domain owners, not platform team only.*527. **Operate** - Monitor scan failures, classification drift, and cost; right-size scan frequency53 per source criticality.54 *Verify: a weekly scan-health report exists.*5556## Guardrails57- Scope and schedule scans to manage cost and source load; avoid scanning everything at full58 depth on day one - sampling first, full second.59- Secure the self-hosted integration runtime host as sensitive infrastructure - it holds60 credentials and reaches into production data sources; patch, restrict logon, monitor.61- Validate classification accuracy before relying on it for downstream protection - sample matches62 per SIT and tune confidence levels.63- Use Key Vault for credentials; never embed secrets in scan configuration.64- Plan capacity - Data Map is metered by capacity units; oversized scans inflate cost without65 governance value.6667## Common anti-patterns68- Registering every source into the root collection and assigning everyone Data Reader.69- Scheduling weekly full scans on petabyte data lakes - blows out capacity and budget.70- Running SHIR on a workstation or shared jump host.71- Skipping the glossary and ownership step - assets get classified but nobody acts on them.72- Treating Data Map as a one-off load instead of a continuously curated catalogue.7374## Example prompts75- `Register and scan data sources in the Purview Data Map.`76- `Configure an integration runtime for multicloud data scanning.`77- `How do I map enterprise data and run classification scans?`78- `Plan data discovery across cloud and on-prem sources.`79- `Design a Purview collection hierarchy aligned to business domains.`8081## Microsoft Learn82- Data Map overview: https://learn.microsoft.com/purview/concept-elastic-data-map83- Register & scan sources: https://learn.microsoft.com/purview/scan-data-sources84- Manage integration runtimes: https://learn.microsoft.com/purview/manage-integration-runtimes85- Classifications: https://learn.microsoft.com/purview/concept-classification86- Collections & access control: https://learn.microsoft.com/purview/how-to-create-and-manage-collections87- Pricing & capacity: https://learn.microsoft.com/purview/concept-elastic-data-map
vinayaklatthe