Learn about data governance in the Microsoft Purview portal

The modern governance experience is available in the Microsoft Purview portal for anyone who didn't create a Microsoft Purview account in the Azure portal before, and for existing customers. This article explains how to use this new experience.

The new governance experience

The Microsoft Purview portal, https://purview.microsoft.com, is a single, organization-wide instance of Microsoft Purview that's the next step towards unifying your organization's governance, policy, compliance, risk, and security. It's a prerequisite to a single platform used to manage and govern any data, both structured and unstructured, across your data estate. Including Azure, Microsoft 365, Azure, on-premises, or multicloud and SaaS applications in future.

• If you're a new Microsoft Purview customer, read about the new governance experience for new customers.
• If you're an existing Microsoft Purview customer, read about the new governance experience for existing customers.

Learn more about all the governance, data security, and risk and compliance features available in the Microsoft Purview portal.

How to use the new experience

If you're a new Microsoft Purview governance customer (if your organization doesn't have any Microsoft Purview accounts in any Azure subscriptions under your Microsoft Entra tenant), you can start using the Microsoft Purview portal right now for your governance journey.

If your organization already has Microsoft Purview accounts in Azure, after your organization is enabled, getting started with the new experience depends on your organization's current structure:

• You only have one Microsoft Purview account:
  • Your account region matches your tenant region
  • Your account region doesn't match your tenant region
  • Your account has disabled all public access
• You have multiple Microsoft Purview accounts

For more information, visit the new experience FAQ.

One Microsoft Purview account

Your account has disabled all public network access

If your Microsoft Purview account had disabled all public network access and is using private endpoints, you need to make some changes before you upgrade it. You can continue to use ingestion private endpoints, but not account or portal private endpoints. The new experience uses a new private endpoint called a platform private endpoint.

To check your current public network settings:

1. Go to the Azure portal.
2. Search for your Microsoft Purview account.
3. Select Networking under the Settings menu.
4. If your firewall is set to Disabled from all networks, you need to follow the next steps to upgrade. If your firewall is set to Enabled from all networks or Disabled for ingestion only, you should be able to upgrade without these steps.

To upgrade an account using private endpoints, you need to:

1. Confirm that your firewall allows these global and tenant-specific endpoints (replacing the accountname and tenantid with your values):
   1. api.purview-service.microsoft.com
   2. accountname.purview.azure.com
   3. tenantid-api.purview-service.microsoft.com
2. After upgrading to the new experience, you can follow this guide to set up private endpoints for governance solutions in the Microsoft Purview portal.

Your region matches your tenant region

If your Microsoft Purview account's region matches your Microsoft Entra tenant region, and you set your networking settings to either enabled from all networks or disabled for ingestion only, you can use the new experience; no upgrade is required.

Your region doesn't map to your tenant region

1. A Microsoft Purview Admin selects the Upgrade button in the Azure portal, Microsoft Purview portal, or upgrade email.

   Note

   If you don't have access to the Microsoft 365 role groups to assign users to the Microsoft Purview Admin role, contact support.

2. If your account is in a different region than your tenant, an admin confirms setup, as seen in this image:

   

3. After confirmation, the new portal launches.

Multiple Microsoft Purview accounts

The new experience requires a single, tenant-level or organization-wide account as the primary account for your organization. If you have multiple Purview accounts in your tenant, you can upgrade one account to the new experience and merge up to four other accounts into your primary account as domains.

1. If your Microsoft Purview account disables public network access and uses account or portal private endpoints, follow the steps at Disabled all public network access to upgrade.

2. A Microsoft Purview Admin selects the Upgrade button in the Azure portal, Microsoft Purview portal, or upgrade email.

3. Select an existing account to upgrade it as your organization-wide account. See How to choosing a primary account.

   

   Note

   Upgrading one account doesn't affect your other Microsoft Purview accounts or their data. After upgrading, you can merge your secondary accounts into your primary account as domains.

   If you don't have access to the Microsoft 365 role groups to assign users to the Microsoft Purview Admin role, contact support.

4. If the account you select is in a different region than your tenant, an admin needs to confirm setup.

   

5. After confirmation, the new portal launches.

6. You can take the tour and begin exploring the new Purview experience.

7. Merge your secondary accounts into your primary account as domains.

Disabled all public network access

If your Microsoft Purview account had disabled all public network access and is using private endpoints, you need to make some changes before you upgrade it. You can continue to use ingestion private endpoints, but not account or portal private endpoints. The new experience uses a new private endpoint called a platform private endpoint.

To check your current public network settings:

1. Go to the Azure portal.
2. Search for your Microsoft Purview account.
3. Select Networking under the Settings menu.
4. If your firewall is set to Disabled from all networks, you need to follow the next steps to upgrade. If your firewall is set to Enabled from all networks or Disabled for ingestion only, you should be able to upgrade without these steps.

To upgrade an account using private endpoints, you need to:

1. Confirm that your firewall allows these global and tenant-specific endpoints (replacing the accountname and tenantid with your values):
   1. api.purview-service.microsoft.com
   2. accountname.purview.azure.com
   3. tenantid-api.purview-service.microsoft.com
2. After upgrading to the new experience, you can follow this guide to set up private endpoints for governance solutions in the Microsoft Purview portal.

Why upgrade to the new experience

If you're already using the classic Microsoft Purview governance portal, upgrading your Microsoft Purview account to the new experience offers several benefits, including:

• Prerequisites for unified experience: The upgrade is a prerequisite and one step to bring your environment closer to use data governance, security, risk, and compliance capabilities under the same platform.

• Improved user experience: The new experience provides a more streamlined and intuitive user interface, making it easier for users to access and manage their data assets in the new Microsoft Purview portal.

• Enhanced features: Upgrading unlocks new features and capabilities, such as live view, preset scans, and more.

• Consolidated management: The enhanced experience offers a centralized management interface for all your Microsoft Purview resources, simplifying administration tasks.

• Access to new capabilities: All new Microsoft Purview features are only available in the upgraded tenant level account.

After upgrading an existing account to the new experience, here's what to expect:

• Account consolidation: You access all other Microsoft Purview accounts in your tenant through the classic portal. Be prepared to merge those accounts with the primary account when the feature becomes available. Microsoft notifies customers who need to perform other steps to merge these accounts.

• Roles and permissions: Fine grained access control via roles and permissions at collection scopes continues to function as-is after your accounts are upgraded. In addition, there are new tenant-level roles that you can manage in the new portal. For more information, see our tenant-level permissions documentation.

• Adapting to new features: Educate users within your organization on the new features and capabilities introduced in the upgraded account, enabling them to maximize the benefits of these enhancements. This education includes understanding and using the following features:

  • Live view
  • Tenant-level permissions

Accessing support

With the free version of Microsoft Purview governance solutions, you can't open support tickets for Microsoft Purview. You need to upgrade to enterprise access for support.

How to choose a primary account

If you have a single Microsoft Purview account, your account is likely automatically upgraded. When you have multiple Microsoft Purview accounts under the same Microsoft Entra tenant, consider the following factors while selecting an account for the upgrade. Select an account as primary tenant-level account by following guidelines below:

• Data assets: Choose the account with the most valuable or frequently used data assets, as this account becomes the primary data map after the upgrade.

• Account usage: Evaluate how each account is currently used and its role within your organization. Select accounts that are considered production for this purpose.

• Permissions and access controls: Consider the existing permissions and access controls for each account, as they're carried over to the upgraded environment (as an isolated domain).

• System Assigned Managed Identity (SAMI) and User Assigned Managed Identity (UAMI): The existing system and user assigned managed identities for the primary upgraded account can be used across all domains in the Microsoft Purview instance.

Other considerations

• You can access the upgraded account through current endpoints and new endpoints, so there's no immediate effect if you use Microsoft Purview APIs. Any updates you perform in the upgraded account also reflect in the classic portal for the same Microsoft Purview account.

• New Microsoft Purview features are only available for the upgraded account.

• For other accounts in your tenant, you can continue to access through the classic governance portal.

Regions

This table lists the regions that you can use to access Microsoft Purview in the new portal:

For information about all available Microsoft Purview regions, see Azure products by regions.

Resources

• New Microsoft Purview portal experience for data governance frequently asked questions
• Share and receive data
• Data lineage in classic Data Catalog
• Data owner policies
• Classification in Data Map