Collection Policies Planner
Plan which events get ingested into Purview from devices, Copilot, Enterprise AI, and unmanaged cloud apps. Includes an IRM overlap check, PAYG consumption estimator, and branded deployment plan.
Start here
Collection policies decide which events Purview ingests from your environment. They feed Activity Explorer, Insider Risk, DSPM for AI, and eDiscovery. Pick the data sources you want to collect from, then move through the tabs left to right: Prerequisites, Policies, IRM Overlap (to check your IRM indicators have signal), Cost, and What If for testing.
Most organisations tick Devices (included in E5) for baseline endpoint activity, then layer on AI and cloud sources as they go. The Inline Web DLP Planner is the sibling tool if you need to block, not just collect.
Pick which data sources to ingest events from. Activities and planes are filtered per source when you build policies.