Wave 11 · Cloud Identity & Device Control Azure / Microsoft 365 / Purview proof Synthetic retention + eDiscovery exports

Purview retention, label disposition, and case posture that stay operator-readable.

This control plane turns raw Microsoft Graph Purview exports into a buyer-readable compliance and legal-ops surface: workload coverage, label-quality drift, stale cases, failed holds, and the remediation packet needed before audits, investigations, or disposition reviews break.

Overview Retention Lane Case Risks Disposition Posture Verification Docs

Commercial Front Door

Enterprise Purview retention and eDiscovery operations for Microsoft 365, legal, and compliance teams.
Audit-safe visibility into retention coverage, label disposition, and matter health without tenant-secret exposure.

Proof Layer

Offline analyzer + CLI + dashboard surface.
This repo includes a reusable analyzer that reads Microsoft Graph retention and eDiscovery exports and turns them into workload, case, and disposition packets.

Why it matters

Recruiters looking for Azure / Microsoft 365 / Purview should see real retention and legal-ops work: workload coverage, custodian holds, label behavior, and matter-readiness controls.

Case Risks

severity · owner · subject

Risk	Owner	Subject	Custodian	Message
high no-retention-coverage-for-workload	Purview Operations	Teams	—	No enabled retention policy covers Teams.
high case-without-custodians	eDiscovery Operations	Vendor dispute hold	—	Active case "Vendor dispute hold" has no custodians attached.
high case-closed-with-error	eDiscovery Operations	M&A diligence	—	Case "M&A diligence" closed with error — review before purge.
high custodian-hold-error	eDiscovery Operations	M&A diligence	carol@example.com	Hold failed for custodian carol@example.com on case "M&A diligence".
medium policy-disabled	Purview Operations	Teams chat retention	—	Retention policy is disabled — its workloads are uncovered.
medium label-without-disposition	Content Compliance	Marketing Drafts	—	Label "Marketing Drafts" has no retention duration or behavior.
medium stale-case	eDiscovery Operations	Q4 audit collection	—	Case "Q4 audit collection" has been active with no activity since 2025-12-01.
medium custodian-hold-pending	eDiscovery Operations	Q4 audit collection	bob@example.com	Hold still pending for custodian bob@example.com on case "Q4 audit collection".
low label-orphaned	Content Compliance	Marketing Drafts	—	Label "Marketing Drafts" exists but is not applied to any policy or location.
low external-id-missing	eDiscovery Operations	Vendor dispute hold	—	Case "Vendor dispute hold" has no externalId — matter reconciliation will be manual.