Microsoft Purview suits organisations whose data and people live mostly inside Microsoft 365, who hold the licence tier Microsoft ties the features to, and who want labels, DLP and Copilot governance from one Microsoft console. Tracemark suits organisations that need a server they host themselves, that have Linux endpoints, file shares, other clouds and databases to cover, and that want AI prompt control and insider-risk scoring from the same agent. Many estates run both, with Tracemark reading and writing Purview labels so the two agree on what is confidential.
What does each product cover?
Microsoft's documentation describes Purview Information Protection as sensitivity labels applied in Word, Excel, PowerPoint and Outlook, with optional encryption and visible markings, plus automatic labelling in Office and across SharePoint, OneDrive and Exchange Online. Purview DLP applies policies to Exchange Online, SharePoint, OneDrive, Teams, onboarded Windows and macOS devices, on-premises file shares through the information protection scanner, and third-party cloud apps through Defender for Cloud Apps. Insider Risk Management and DSPM for AI sit in the same portal.
Tracemark is one agent and one self-hosted console. Its DLP checks the clipboard, file copies to USB, shares and cloud-sync folders, print jobs, email in Outlook, Outlook on the web and at an SMTP gateway, browser uploads, AI prompts and screenshots, with an ICAP sensor for proxy traffic. Its posture side scans endpoints, file shares, SharePoint and OneDrive, S3, Azure Blob and Google Cloud Storage, Box, Dropbox and Google Drive, and PostgreSQL, MySQL and SQL Server, then gives every document one of four levels and ranks risk by who can open it.
Where is Purview the better choice?
If your data lives in Microsoft 365, Purview is the natural starting point. Its policies run inside the service, so Exchange Online, SharePoint, OneDrive and Teams are covered with nothing to install on the device. Labels follow the document through Office on Windows, Mac, web and mobile, and the encryption is tied to Microsoft Entra identities, which Tracemark does not replicate. Cloud-scale auto-labelling over a large SharePoint estate is something a cloud service does well. Microsoft 365 Copilot governance is only available from Microsoft, and Purview shares a portal and an audit log with the rest of Microsoft security.
Where does Tracemark go further?
Tracemark runs its server in your own infrastructure and does its detection on the device. Only the decision and the evidence you choose to keep reach your server. The agent runs on Windows, macOS and Linux, with clipboard protection on all three. Print blocking reads the spooled text and cancels only sensitive jobs. Screenshots can be blocked while a labelled document is in front.
AI prompts are checked inside the browser page before they leave, with block, mask, warn or monitor responses, a shadow-AI inventory, and a policy for coding agents that controls MCP servers, denied commands and protected files. Discovery reaches non-Microsoft storage and databases without an agent. Data owners review who can open their files, and every fix waits for security approval. Insider risk scores each endpoint and person against peer baselines, tightens DLP at medium and high risk, and adds up drip violations. Policies enforce offline.
Some capabilities exist on both sides and should not decide the choice: exact data match, document fingerprinting, trainable classifiers, custom patterns, a justification override, and simulation. Discovery, labels and the four levels are described on the Data Security Posture page, and prompt control on the AI Security page.
Can they run together?
Yes. Tracemark reads Purview sensitivity labels through Microsoft Graph, imports them, and maps each Tracemark label to the Purview label it writes. Discovery reads existing Purview labels on files during a scan. The Office add-in for Word, Excel, PowerPoint, Visio and Project can write a Purview label alongside its own header, footer and watermark. In Outlook, classify-on-send can write the mapped Purview label as the msip_labels header, so Exchange and Purview DLP treat the mail as labelled.
Policy uses the labels in both directions. Email DLP rules take the sensitivity label as a condition. Label-based enforcement sets block, warn, monitor or allow per level on the clipboard, file, browser and mail guards. Automatic remediation can apply a MIP label to a file found at rest. The coding-agent policy can stop Claude Code or Cursor reading a document that carries a Microsoft sensitivity label at or above a chosen tier. An encryption mark header, with a generated Exchange transport rule, lets Purview or AD RMS encrypt mail Tracemark detected.
One rule keeps the two honest: a document's level in Tracemark is the strictest of its signals. A Purview label can raise a level but never lower it below what the content shows, and a label below the content is flagged as a conflict.
Which fits an on-premises or hybrid estate?
Purview is a cloud service. Microsoft's documentation describes the information protection scanner for on-premises file shares and SharePoint Server, but policy, findings and the console stay in Microsoft's cloud. Linux is not in the documented Endpoint DLP device list as far as we know; check Microsoft's current documentation.
Tracemark's server, database and detection engines run where you put them. The Windows agent ships as an MSI for GPO, SCCM or Intune, with Linux and macOS packages beside it. The SMTP gateway checks mail at the server, which suits on-premises Exchange, and events go to your SIEM over syslog or webhook. For an estate split between Microsoft 365 and everything else, Tracemark covers the second half and feeds the first half's labels into the same policy.
How do they compare side by side?
| Capability area | Tracemark | Microsoft Purview |
|---|---|---|
| Hosting | Server in your own infrastructure | Microsoft cloud service |
| Endpoint platforms | Windows, macOS, Linux agent | Windows and macOS per Microsoft's documentation |
| Microsoft 365 services | SharePoint and OneDrive discovery via Graph; Outlook and OWA | Native: Exchange Online, SharePoint, OneDrive, Teams |
| Outlook add-in, webmail extension, SMTP gateway | Exchange Online policies | |
| Clipboard, USB, print, screen | Clipboard on three platforms, USB and print on Windows, screenshot blocking | Clipboard, removable media and print in Endpoint DLP |
| Browser uploads and AI prompts | In-page inspection on Chrome, Edge, Firefox, with masking | Edge and a Purview extension; Copilot governance |
| Non-Microsoft storage | S3, Azure Blob, GCS, Box, Dropbox, Google Drive, file shares | Defender for Cloud Apps; on-prem shares via scanner |
| Databases | PostgreSQL, MySQL, SQL Server discovery | Not part of Purview DLP |
| Labels | Four levels plus own labels; reads and writes Purview labels | Sensitivity labels with encryption and markings |
| Insider risk | 0 to 100 score, peer anomalies, risk-adaptive DLP, drip detection | Insider Risk Management on Microsoft 365 signals |
| Licensing | Licensed separately from Microsoft 365 | Tied to tiers; check the current licensing guide |
Frequently asked questions
Do I need a separate DLP if I have Microsoft 365 E5?
Microsoft's documentation ties Purview DLP and Endpoint DLP to its higher tiers; check the current licensing guide for what your tier includes. Whether you need more depends on where your data goes. If it leaves through Linux machines, file servers, other clouds, databases, printers, screenshots or AI tools outside Copilot, Purview alone does not see those paths.
Does Tracemark replace Purview labels?
No. Tracemark reads Purview labels from Graph and from files, maps its own labels to them, and can write the mapped Purview label from Office and Outlook. Purview can stay the label authority while Tracemark enforces on the device.
Can Tracemark run with no Microsoft 365 tenant at all?
Yes. The server, agent, SMTP gateway and connectors do not depend on Microsoft 365. The Purview sync, SharePoint and OneDrive connectors and Outlook add-in are optional.
Which one should an organisation choose first?
Start from where the data is. Mostly in Microsoft 365 with onboarded Windows and Mac devices: Purview first, then Tracemark for the gaps. On-premises systems, Linux, several clouds or evidence that must stay on your own servers: Tracemark first, with Purview labels imported if you use them.