If you've been following Microsoft's data governance strategy over the past several years, you've probably noticed that the landscape has become increasingly crowded. Between Microsoft Purview, Microsoft Fabric, and the introduction of OneLake Catalog, understanding which tools do what (and where they overlap) hasn't always been straightforward.

Now, Microsoft’s about to shake things up again. Microsoft recently announced plans to retire its Purview data governance solutions with support ending on November 12, 2027. For those of you scoring at home, the affected portfolio includes the following capabilities:

• Data Map: The underlying metadata management platform responsible for scanning, cataloging, and tracking data assets across your enterprise data landscape.
• Unified Catalog: The business-facing governance experience that builds on Data Map to help users discover, understand, organize, and manage data through capabilities like business glossaries, data products, and governance domains.

Going forward, Microsoft Fabric and OneLake Catalog will play a much larger role in its data governance strategy, while Purview will continue focusing on data security, information protection, and compliance.

For customers who've invested in Purview, the announcement raises some important questions. What happens to our existing governance capabilities? Can OneLake Catalog provide everything we need? Where do third-party platforms like Atlan fit into the picture? And perhaps most importantly, how do we maintain consistent governance and security across an enterprise data landscape that extends well beyond Microsoft?

There's also a broader consideration. As AI agents and intelligent applications become more deeply integrated into business operations, the need to understand, protect, and trust enterprise data is only growing.

In this article, we'll explore what's changing in Microsoft's data governance strategy, what OneLake Catalog brings to the table, and how Purview's security and compliance capabilities fit into the picture. We'll also look at the growing role of third-party governance platforms and some practical considerations for navigating the transition.

The End of Purview Data Governance (As We Know It)

If you've invested in Microsoft Purview Data Governance, this announcement marks a significant change in direction. Microsoft spent years positioning Purview as a centralized platform for discovering, cataloging, and governing data across an increasingly diverse enterprise landscape. Now, you've got roughly a year to figure out what comes next.

According to Microsoft's announcement, the existing Purview Data Governance solutions are entering maintenance mode, with support scheduled to end on November 12, 2027. You can continue using your existing deployment during this period, but Microsoft is shifting its development investments toward governance capabilities within Microsoft Fabric and the OneLake Catalog.

The implications extend beyond simply replacing one catalog with another. If you've been using Purview to scan data sources, maintain a business glossary, track lineage, or organize data ownership and stewardship, you'll need to evaluate how those capabilities will be supported going forward. And because Purview was designed to work across Microsoft and non-Microsoft data sources, the transition may be particularly significant if you're managing a mix of SAP, Databricks, Azure, and other enterprise platforms.

There's also an important distinction worth making: Microsoft Purview isn't going away. Its data security, information protection, and compliance capabilities remain part of Microsoft's broader strategy. What's changing is where Microsoft intends to deliver its data governance functionality and how those capabilities will integrate with the rest of its data platform.

A Few Things Worth Checking Now

If you're currently using Purview Data Governance, here are a few things we recommend getting a handle on sooner rather than later:

• Governance Asset Inventory: Identify the data sources, scans, classifications, lineage relationships, business glossary terms, and data products you're managing today.
• Governance Process Documentation: Understand how your teams use Purview for data discovery, ownership, stewardship, access requests, and data quality management.
• Identify Dependencies: Look for applications, integrations, APIs, and reporting processes that rely on Purview's governance metadata or services.
• Evaluating Replacement Capabilities: Determine which requirements can be addressed by OneLake Catalog and where you may need additional tools or integrations.
• Metadata Preservation Plan: Identify what needs to be exported, migrated, or recreated, and validate available migration paths before making changes to your existing environment.
• Establishing a Transition Timeline: Give yourself enough runway to evaluate alternatives, test integrations, and validate governance processes before November 12, 2027.

This leaves you with both a deadline and an opportunity. There's time to assess your existing investments and explore alternatives, but it's worth starting that evaluation now rather than waiting until the support window closes.

The Future of Data Governance Runs Through OneLake

With Purview Data Governance on its way out, Microsoft is putting its weight behind Microsoft Fabric and the OneLake Catalog as the foundation of its future data governance strategy.

Logically, this approach makes a lot of sense. Rather than managing governance through a separate platform that has to continually synchronize metadata, policies, and lineage with your data systems, Microsoft wants to bring those capabilities closer to where data is actually stored, processed, and consumed. This becomes especially relevant as more companies look to make enterprise data available to AI-powered applications and agents.

If you're already using Fabric, you've probably bumped into the OneLake Catalog a time or two even if you weren’t really looking for it. It's the centralized experience for discovering, understanding, governing, and securing data across your Fabric environment.

Figure 1: Working with the OneLake Catalog in Fabric

As you can see in Figure 1, Microsoft organizes the capabilities of the OneLake Catalog into three primary areas:

• Explore: Discover data assets, browse metadata, examine lineage, and identify trusted datasets through endorsements and other contextual information.
• Govern: Organize data into business domains, manage governance-related settings, monitor governance health, and identify recommended actions to improve how your data is managed.
• Secure: Understand and manage access to supported Fabric and OneLake resources, bringing security administration closer to the data itself.

Beyond these core experiences, OneLake Catalog brings together capabilities such as metadata scanning, organizational tagging, sensitivity label visibility, and governance insights. Many of these capabilities are included with your existing Fabric capacity, potentially simplifying the licensing and operational overhead associated with maintaining a separate governance platform.

Figure 2: Side-by-Side Comparison Between the Purview Unified Catalog and the OneLake Catalog

What About Data Outside of Fabric?

This is where things get particularly interesting, especially if your data landscape extends beyond Microsoft's ecosystem.

Microsoft is positioning OneLake as a foundation for governing data across a broader enterprise landscape through capabilities like OneLake shortcuts and mirroring. These technologies allow Fabric to work with data from supported external systems, sometimes without physically copying it into OneLake.

For example, you might use shortcuts to expose data stored in Azure Data Lake Storage or Amazon S3, or mirroring to make operational data available for analytics within Fabric. Once these assets are available through supported Fabric experiences, they can participate in the platform's discovery, governance, and security capabilities.

Figure 3: Unifying Data Sources with Shortcuts in OneLake

There's an important distinction, however. Making external data accessible through OneLake doesn't automatically mean you're governing the entire source system. The metadata available, lineage captured, and policies enforced depend on the integration method and the underlying platform.

If you're running SAP, Databricks, Salesforce, or other enterprise systems alongside Fabric, it’s important to understand exactly how much visibility and control OneLake Catalog provides across those environments.

That brings us to an important consideration: while OneLake Catalog represents a significant investment in native governance capabilities, it isn't necessarily a one-for-one replacement for everything previously available through Purview Data Governance.

For customers whose data strategies are already centered on Fabric, this direction could simplify governance considerably. If you're managing a more diverse technology landscape, you'll need to look more carefully at where Fabric's capabilities end and where additional governance tools or processes may still be necessary.

Where Does Purview Fit Now?

With Microsoft shifting its data governance investments toward Fabric, you might be wondering whether Purview still has a place in your data architecture. The short answer is absolutely, but its role is becoming more clearly defined.

Microsoft is drawing a distinction between governing data and protecting it. While Fabric and OneLake Catalog are taking on greater responsibility for data discovery, lineage, and governance, Microsoft Purview will continue focusing on information protection, data security, risk management, and regulatory compliance.

What's particularly interesting is that Purview's security capabilities aren't limited to applications like Power BI, Excel, or Microsoft 365. Microsoft has been extending its information protection capabilities directly into Fabric, including support for lakehouses, warehouses, and other supported data assets. That said, the level of protection varies depending on the workload, how data is accessed, and where it's ultimately consumed.

Understanding the Division of Responsibilities

Fabric provides its own security foundation through Microsoft Entra ID, workspace and item permissions, and OneLake Security. These capabilities control who can access your data and what they're allowed to do with it. Depending on the workload, you can enforce permissions at the table, row, or column level, giving you fairly granular control over sensitive information.

Purview complements these controls through a broader set of information protection and compliance capabilities, including:

• Sensitivity Labels: Classify Fabric items according to their sensitivity, with support for label inheritance and propagation across supported workloads.
• Data Loss Prevention (DLP): Detect sensitive information in supported Fabric assets, generate alerts, and apply access restrictions where supported.
• Protection Policies: Restrict access to supported Fabric items based on their sensitivity labels, providing an additional layer of control beyond native permissions.
• Audit & Monitoring: Track supported user activities and security-related events to help investigate incidents and meet compliance requirements.
• Broader Compliance Capabilities: Support information protection, insider risk management, retention, and eDiscovery across supported Microsoft services, although these capabilities don't apply uniformly to every Fabric workload.

Figure 4: Understanding How Purview Security & Compliance Policies Map to Fabric

An important distinction is that classifying data doesn't automatically mean it's protected against every form of access or extraction. For example, applying a sensitivity label to a lakehouse doesn't encrypt its underlying tables based on that label, and not every data export preserves the same protections.

Fabric itself provides encryption at rest and in transit, while Purview adds classification and policy-based protections in supported scenarios. Understanding where those controls are enforced is essential when designing your security architecture.

What Does This Look Like in Practice?

Imagine you've built a Fabric lakehouse containing customer information sourced from SAP and several other enterprise systems. Your finance team needs access to detailed transaction records, while your sales team should only see information relevant to its customers.

Within Fabric, you can use workspace permissions and supported data-level security controls to restrict access to the appropriate records. OneLake Catalog helps users discover the data, understand its lineage, and identify trusted datasets.

Now suppose those records contain personally identifiable information (PII). You can apply Purview sensitivity labels to the lakehouse and establish DLP policies that detect sensitive information. Depending on your configuration and the capabilities supported by the workload, you may also be able to restrict access through label-based protection policies.

Things get more interesting when that data is consumed through Power BI. Sensitivity labels can propagate to supported downstream assets, and certain export formats, including Excel, PDF, and PowerPoint, can retain labels and associated protection settings.

However, if someone extracts the same information directly from a lakehouse using a notebook or another supported data access method, those protections don't necessarily follow the exported data. The extraction remains subject to the applicable Fabric access controls, but you can't assume Purview will automatically encrypt or protect the resulting file.

This is why it's important to evaluate security across the entire data lifecycle, from ingestion and storage through analytics, sharing, and downstream consumption.

And Then There’s AI

As AI agents become more deeply integrated into enterprise workflows, the relationship between governance and security becomes even more important.

Imagine an AI agent that can discover a trusted dataset through OneLake Catalog, understand its business context, and use that information to answer questions or execute business processes. That sounds promising, but it also introduces some important security considerations.

Which identity is the agent using to access the data? Does it inherit the permissions of the person making the request, or does it operate under a separate service identity? Can it retrieve sensitive information that the requesting user wouldn't ordinarily be allowed to see? And what happens when that information is included in a generated response or passed to another system?

These questions need to be addressed through the security controls enforced by the underlying data platforms and the applications accessing them.

Microsoft is also extending Purview's information protection, auditing, and risk management capabilities into supported AI experiences, including Microsoft 365 Copilot and other integrated services. However, those protections don't automatically extend to every custom agent or AI application you might build.

As you introduce more intelligent applications into your environment, understanding who or what can access your data, and where those permissions are enforced, becomes just as important as knowing where the data resides.

Fabric and Purview provide complementary capabilities to help address these challenges, but making them work together requires a clear understanding of your architecture, your data flows, and the security boundaries between systems.

Looking Beyond Microsoft

While Microsoft is positioning OneLake Catalog as the foundation of its future data governance strategy, there's an important question worth considering: What happens when your data landscape extends well beyond Fabric?

If you're running SAP, Databricks, Snowflake, Salesforce, or a combination of other enterprise platforms, chances are your data governance requirements don't begin and end with Microsoft. You still need a consistent way to discover data, understand its lineage, manage business definitions, and establish accountability across systems that may have very different approaches to governance.

To Microsoft's credit, OneLake isn't limited to data physically stored in Fabric. Shortcuts, mirroring, and supported connectors make it possible to work with data from external systems, sometimes without moving it into OneLake. But making external data accessible through Fabric doesn't necessarily give you complete governance visibility into the systems where that data originates.

Microsoft understands this and has explicitly acknowledged that some governance requirements extend beyond Fabric's current capabilities, pointing to third-party platforms like Atlan, Alation, Collibra, and Informatica as potential complements to its ecosystem.

Case Study: Working with Atlan

One platform worth watching is Atlan, which has been expanding its integration with Microsoft Fabric. Atlan takes a broader approach to enterprise data governance, connecting to data platforms across your environment to bring technical metadata, business definitions, ownership, and lineage into a common catalog. Rather than requiring all your data to reside in one platform, it helps you govern assets across the systems where they already live.

Notably, its Microsoft Fabric connector can discover and catalog supported Fabric assets, including lakehouses, warehouses, semantic models, reports, and data pipelines. It also supports lineage across several Fabric workloads, with deeper capabilities depending on the APIs and integration methods available.

Interestingly, the integration can work in the other direction as well. Atlan has introduced capabilities for making its governance metadata available through OneLake, allowing Fabric workloads to access business context managed outside Microsoft's native catalog.

That creates an interesting architectural possibility: Fabric can remain your primary analytics platform, while Atlan provides a broader governance layer spanning Microsoft and non-Microsoft systems.

Imagine you're bringing SAP financial data into Fabric, combining it with Salesforce customer information, and publishing the results through Power BI. OneLake Catalog can help govern the Fabric assets involved, while a platform like Atlan may provide additional visibility into the upstream systems, shared business definitions, and lineage relationships that extend beyond Fabric.

Figure 5: Working with the Atlan Business Glossary

Of course, there's a tradeoff. Introducing another governance platform means additional licensing, integration work, and potentially overlapping capabilities. You'll also need to understand where metadata is synchronized, which platform owns your business definitions, and how governance responsibilities are divided between the two.

And while Atlan is an interesting example, it's hardly the only option. As noted earlier, Collibra, Alation, and Informatica bring their own approaches to enterprise cataloging, metadata management, and governance workflows.

The question isn't necessarily which catalog is better. It's how much of your governance program can reasonably live within Fabric and whether you need a broader platform to connect the rest of your enterprise data landscape.

Planning Your Next Move

With so many moving pieces, it's tempting to approach this transition as a product selection exercise. But before deciding whether OneLake Catalog, Atlan, or another platform is the right fit, I'd encourage you to think about what you're actually trying to accomplish with data governance.

For example, are you primarily trying to help people discover and understand trusted data? Do you need to establish consistent business definitions across departments? Are you struggling to trace data lineage across systems? Or are you trying to establish clearer ownership and accountability for the data your business relies on?

Your answers should drive the architecture, rather than the other way around.

Another consideration is where you want governance responsibilities to live. If you adopt multiple governance tools, you'll need to establish which platform serves as the authoritative source for business definitions, ownership, and other shared metadata. Otherwise, you risk creating competing catalogs with inconsistent information, which is precisely the kind of problem data governance is supposed to solve.

I'd also encourage you to think beyond your immediate migration requirements. As AI agents and intelligent applications become more capable of discovering and acting on enterprise data, the quality and accessibility of your governance metadata will become increasingly important. Business definitions, ownership, lineage, and security context may eventually be just as valuable to automated systems as they are to the people managing your data today.

At Bowdark, we help customers work through these decisions by looking at their existing data architecture, governance requirements, and longer-term technology plans. Our experience across Microsoft Fabric, Azure, ERP, and enterprise integration gives us a practical perspective on how these pieces fit together, particularly when your data landscape extends beyond a single platform.

Microsoft's announcement creates a reason to revisit your governance strategy. How you respond should depend on where you want to take your data architecture, not simply where Microsoft is taking its products.

Closing Thoughts

Microsoft's decision to retire Purview Data Governance marks an interesting turning point in its broader data strategy. Bringing governance closer to Fabric and OneLake makes sense, particularly as analytics and AI become more tightly integrated. But it also raises some legitimate questions about how well this approach will serve customers whose data environments extend well beyond Microsoft's ecosystem.

I suspect we'll see Microsoft's native governance capabilities continue to mature, alongside deeper integrations with third-party platforms. Whether that ultimately delivers a simpler, more cohesive governance experience remains to be seen.

In the meantime, there's an opportunity to rethink how you're managing one of your most important business assets. With AI increasingly capable of interpreting and acting on enterprise data, having a clear understanding of what that data means, where it came from, who owns it, and how it can be used is becoming more important than ever.

The technology will continue to evolve. The challenge is making sure your governance strategy can evolve with it.