County of Kern: protecting data with Purview before Copilot

Microsoft describes the county as running like about 40 separate small businesses, with IT spread across departments and data that had never been classified. The county has to meet HIPAA, CJIS and more than 20 other regulations.

Before giving staff Microsoft 365 Copilot, county leaders wanted to stop oversharing and data loss, because an assistant that can search across files will surface whatever users are already able to reach.¹²

Using its Microsoft 365 Government G5 licensing, the county rolled out Microsoft Purview Information Protection with automatically applied sensitivity labels, Purview Data Loss Prevention policies and Purview eDiscovery. A four-person security team led by the deputy CISO oversaw the work, alongside IT teams that stay inside each department, and the project was completed in six months. Six weeks of targeted training material went to users.

Microsoft Security Copilot is used to speed up alert triage and to give automated insights inside Purview. The next step is a controlled rollout of about 400 Microsoft 365 Copilot licenses with access reviews and mandatory training.¹

In our view, the useful lesson here is the order of work: Kern classified and protected its data before switching on Copilot, which addresses the oversharing risk that worries most public bodies. The approach suits councils and counties with department-level IT, because labels and DLP policies can be applied centrally while departments keep their own teams. Both sources are Microsoft pages, and the $1 million figure is a risk estimate rather than a saving, so other public bodies should not budget against it. A smaller organization with tidy permissions may get most of the benefit from an access review and SharePoint permission clean-up before buying extra licensing.