Microsoft Purview Data Governance Retirement: The CDO Re-Evidencing Plan · Enterprise Agentic AI Insights

Microsoft Purview Data Governance was retired on November 12, 2026 with end of support on November 12, 2027. What it does to your AI evidence base, and how to size the re-evidencing work from your own counts.

Your data catalog expires next November and the docs don't say so

Format: report · Pillar: Diagnose · Edition: Saturday, November 14, 2026 · Week covered: November 8 to 14, 2026

Every sentence a Chief Data Officer has written this year about knowing where their data lives points at a product. For a large share of Microsoft estates, that product is Microsoft Purview Data Governance. On November 12, 2026, Microsoft set a one-year clock on it, and it told the partner channel rather than the product documentation.

---

1. What the CDO is staring at

The announcement is four sentences long and it is not ambiguous.

> "As of November 12, 2026, Microsoft Purview Data Governance is being retired, with an end of support by November 12, 2027. This includes the Unified Catalog, Data Map, Workflows, and Microsoft Azure Purview solutions."

That is from "Update on the Microsoft Data Governance strategy," published November 12, 2026 on the Microsoft Partner Center announcements page. VERIFIED C01

The same announcement tells partners what to do about it, in the imperative: "Center new data governance conversations on Microsoft Fabric and the OneLake catalog." "Start transition planning with your existing Purview Data Governance customers now." "Scope the transition services that move their governance to the OneLake catalog before end of support." VERIFIED C02

One thing is explicitly carved out: "Purview Data Security and Compliance offerings are unchanged." VERIFIED C03 So this is not Purview going away. It is the governance half going away and the security half staying, which is the detail most likely to be lost in a hallway summary.

Now the part that decides whether this is news or a nasty surprise. On November 14, 2026, the Microsoft Purview what's-new page carries no November 2026 section at all. Its newest heading is October 2026. The words retirement and end of support do not appear on it. Its footer reads last updated 2026-10-16. VERIFIED C04 The Purview data governance overview page was read at primary on November 13 and carried no notice either, last updated 2025-02-20; it returned a site error on re-read today, so treat the second page as a one-day-old read rather than a same-day one. CITED C05

Two days after a one-year clock started on a product, the documentation a data governance lead or an auditor would open to check does not mention it.

2. The mechanic that is failing

The Unified Catalog and the Data Map are not reporting tools. They are the answer to four questions a CDO gets asked and has to answer with a screen, not a slide:

That answer now has 363 days. And the replacement is not a setting. Microsoft Fabric and the OneLake catalog is a different product with a different licensing model and a different permission model, which makes this three events at once inside a single 2027 budget cycle: a procurement event, a re-platforming, and a re-evidencing. The third one is the one nobody schedules. Every lineage screenshot, every data-boundary attestation, and every classification claim that currently resolves to a Purview object has to resolve to a OneLake object instead, and the mapping is not one to one.

The timing is the trap. A 2027 plan is being signed in November and December 2026. If the catalog transition is not a line in it now, it becomes an unfunded emergency somewhere around September 2027, which is also when the people who would do the work are closing a year.

This is not one vendor having one bad week. The same mechanic ran three times in three days, each time at a different vendor surface, each time verified at that vendor's own primary.

On November 6, Microsoft Entra announced agent identity lifecycle management in public preview, including "a default inactivity policy (available to all tenants, no license required)" that "notifies owners after 60 days of inactivity" and "disables the identity if no new activity occurs." VERIFIED C06 Read that against a real fleet: the agents whose idleness is correct by design are quarter-close, open enrollment, year-end tax, audit support and disaster recovery. A 60-day clock reaches all of them. Neither Entra Agent ID documentation page describes the behavior, so the runbook cannot be written from the docs. CITED C07

On November 12, Gemini Enterprise shipped skill version history: "Skill owners can view the version history of a skill, inspect the instructions and files of earlier versions" in read-only mode, and restore an earlier version as the latest. Only skill owners are named. The release entry describes no admin view, no auditor view, no export and no approval gate. VERIFIED C08 A change log held solely by the person making the change is a change log. It is not change control, and no attestation framework treats the two as the same thing.

On November 12, the data catalog got its retirement date, in the partner channel.

Three surfaces, three days, one mechanic: the governance plane is changing through channels the customer does not read. The release note, the partner bulletin and the preview blog post are all public. None of them is where a governance program looks, and none of them triggers a change ticket.

The reason that lands harder than it should is that most organizations have nothing to check it against. In G2's own survey of 1,019 B2B decision-makers, fielded July 2026, 38 percent of organizations with agents in production run more than 100 of them, while just 27 percent maintain a central AI agent registry and 14 percent have real-time observability into unusual behavior, costs or risks. The same survey puts 31 percent of buyers reporting employees spending six or more hours a week overseeing agents, and 45 percent saying oversight and correcting agent mistakes consumes more than a quarter of the productivity gain. CITED C09 G2 sells services to vendors it covers and the report promotes G2's own evaluation product, and G2 discloses that generative AI models helped design the survey and analyze the results. It is a buyer-sentiment reading, not independent research, and it should be quoted that way every time.

Put the two together. The vendor changes the governance plane in a channel you do not read, and you have no registry that would show you what the change touched.

3. The governance turn

This is the point where the problem stops being an operations ticket.

Ariana AEGIS Model (Agentic Enterprise Governance and Intelligence Standard), Pillar 2, AI System Inventory. The inventory is the list an examiner can walk: every agent, model, tool and third-party flow, with an owner, a risk tier, a data boundary and a cost baseline. A Purview-backed inventory is not wrong today. It is dated. And a dated inventory is the single failure an examiner finds without being pointed at it, because the first thing they do is pick a row and ask you to prove it still resolves.

Pillar 7, Regulatory Intelligence and Program Evolution. This is the harder one, and it is the actual lesson of the week. Most AI governance calendars are built from regulators. A calendar built only from regulators misses every item above, because the dated thing is a vendor notice. Compare what is on the clock right now:

| Date | Days out | What it is | Where it was published | |---|---|---|---| | November 16, 2026 | 2 | Gemini Notebook lm hostname removed; allowlist entire domains | Vendor release note VERIFIED C10 | | November 16, 2026 | 2 | Interagency third-party risk management comments close, 11:59 PM, docket NCUA-2026-1684-0001, four agencies, no extension | Regulator primary VERIFIED C11 | | December 2, 2026 | 18 | EU AI Act Article 50(2) marking obligation applies | Regulator primary VERIFIED C12 | | January 1, 2027 | 48 | Microsoft commercial cloud currency adjustment: INR +15.7 percent cloud, up to +20 percent on-prem; NZD +10 percent; AUD -4 percent | Partner bulletin VERIFIED C13 | | February 1, 2027 | 79 | Microsoft-provided SMS and voice MFA delivery retires; configure Soprano, Telesign or Infobip | Preview blog post VERIFIED C14 | | November 12, 2027 | 363 | Purview Data Governance end of support | Partner bulletin VERIFIED C01 |

Four of those six were published in a channel that is not the product documentation and is not a regulator. Two of them move real money with no renewal event: the India currency adjustment lands on every India capability centre on January 1 with nothing to sign, and the MFA retirement is a procurement task sitting directly on the authentication path across two holiday months.

A regulator will not tell you your catalog expired. Your integrator was told. You were not, unless you read partner bulletins.

4. The move

Six things, in order, none of which needs a budget approval to start.

  1. Establish whether you are exposed, this week. Enumerate Purview accounts and Data Map sources in every subscription. If the count is zero, you are done and this costs you twenty minutes. If it is not zero, it is a 2027 plan line.
  2. Build the catalog dependency register before the migration plan. One row per artifact that currently resolves to a Purview object: lineage screenshots in control evidence, data-boundary attestations, classification claims, retention justifications, DPIA and model-card references. The register is the thing that tells you whether this is a 40-day job or a 400-day job. The migration plan written without it will be wrong.
  3. Date every row. Each evidence artifact gets the date its underlying system is supported until. This is the one change that makes the Pillar 2 inventory survive a vendor retirement, because the row fails on your calendar rather than in an examiner's hands.
  4. Add the vendor channels to the regulatory calendar. Partner Center announcements, the vendor release notes for each platform in scope, and the preview blogs for identity. One page each, read weekly. This week, that one habit was worth a catalog retirement, a currency change and an MFA retirement.
  5. Set the agent inactivity clock against your own calendar. List every agent identity whose correct behavior is to sit idle for more than 60 days, and name a living owner for each. Do this before the Entra default reaches a quarter-close agent.
  6. Separate change log from change control. Anywhere a platform gives version history to the person making the change and nothing to an auditor, that gap is yours to close with an export or an approval gate outside the platform. Gemini Enterprise skills is the current example. It will not be the last.

The honest caveat on all of it: nothing above proves your estate is compliant with anything. It proves your inventory is current and your evidence is dated. That is a smaller claim than most governance programs make, and it is the one an examiner can actually check.

5. The week across the stack

Sections 1 to 4 covered the three stories that share a mechanic. This section is the rest of the week's research, sorted by the layer of the stack it touches, with one action per layer that can be assigned on Monday. Owners are suggested roles, not facts about your organization. Timings are suggestions.

| Layer | What changed this week | Do this | Suggested owner | Suggested timing | |---|---|---|---|---| | Identity and access | Entra disables idle agent identities after 60 days by default, in all tenants (Nov 6) VERIFIED C06. Microsoft-provided SMS and voice MFA retires February 1, 2027 VERIFIED C14. Gemini Enterprise skill version history is visible to skill owners only (Nov 12) VERIFIED C08 | List every agent whose correct behavior is to sit idle past 60 days and name an owner for each. Choose the replacement MFA delivery provider and schedule the change outside the holiday freeze. Keep skill change records in an export or approval step you control | CISO | Idle-agent list this week; MFA provider before mid-December | | Data and catalog | Purview Data Governance retired, end of support November 12, 2027 VERIFIED C01. For Anthropic covered models, prompts and outputs are retained 30 days, and zero data retention is a notified exception VERIFIED C18. Adobe's CX Enterprise Coworker now runs inside six platforms, and the release is silent on permissions, audit and data residency VERIFIED C21 | Count Purview accounts and start the dependency register. List every workload that calls a covered model and check it against your zero-retention commitments before taking the price cut. Ask Adobe in writing what leaves its boundary | CDO | Count this week; retention check before the next model change | | Models and inference | Gemini 4 Carbon (Nov 10) and Hydrogen (Nov 12) are GA, off by default in the web and mobile apps and on by default for licensed AI developer tools users on the default model selection VERIFIED C19 C08. AWS AgentCore harnesses on managed defaults take the vendor's current recommended model, and the release notes say defaults can change; V2 is now in five more Regions including Frankfurt and Stockholm VERIFIED C20 | Replace the default Gemini model selection with an explicit allowlist. Pin the model, system prompt, truncation and allowed tools on every AgentCore harness. Record the decision on the web and mobile default | CIO | This week | | Agent platforms | ServiceNow's AI Passport, shadow AI detection and AI cost management are "expected to be available in Q4 2026," and the release gives no status for Control Tower, policy enforcement or the kill switch VERIFIED C25 | Treat these as roadmap, not as controls in a 2027 design. Ask for a dated commitment before relying on any of them | CIO | Before the 2027 plan is signed | | Cost and commercial | Copilot Chat fair use limits for unlicensed users in tenants above 2,000 seats went active November 9, with no numeric cap published VERIFIED C17. Anthropic cut Fable and Mythos 5.2 prices 20 percent VERIFIED C18. Microsoft currency adjustments take effect January 1, 2027 VERIFIED C13. In G2's own survey, preference for pay-as-you-go rose from 38 to 57 percent CITED C09 | Open a ticket category for unlicensed-user slowdowns so the first complaints are counted. Reprice model spend only after the retention check above. Re-baseline India, New Zealand and Australia budgets | CFO with CIO | Currency before mid-December | | Regulatory and third party | Interagency third-party risk comments are due November 16, no extension found, and NCUA is the fourth agency VERIFIED C11. Article 50(2) applies December 2 VERIFIED C12. Colorado SB 26-189 replaced the 2024 act and removed deployer impact assessments VERIFIED on obligations, CITED C22 on dates. The FTC's accuracy statement is still proposed and names the Colorado act VERIFIED C23. The EU Digital Omnibus moved Annex III high-risk obligations to December 2, 2027 CITED C24 | File a comment or record the decision not to. Confirm marking readiness for December 2. Remove impact assessments from any policy, template or vendor deliverable that still lists them as a Colorado requirement. Move the high-risk date in your planning calendar | CRO with legal | November 16; December 2 |

If you only do three things this week: decide on the November 16 comment, pin or allowlist the models your agents run on, and build the idle-agent list and the Purview count. Each one converts something the vendor decided into something you decided.

Read with care. Several results for this week's topics are older than they look or unsupported. The ServiceNow AI Passport release is dated October 15, 2026, not November. California SB-11, whose text opens with a December 1, 2026 consumer warning requirement, was vetoed, per the Assembly committee's own summary. CITED C26 Four widely repeated headlines, including a claimed FTC investigation of OpenAI and Anthropic and a claimed EU "first enforcement actions" over agent incidents, trace to aggregator sites with no primary source, and are left out here.

What the week adds up to. Most of this week's changes were made by the vendor, to a default, a model, a limit or a date, and arrived by release note, bulletin or press release. Most of the actions above do the same thing in reverse: an allowlist, a pin, a register, a dated row. The Purview retirement is the largest item because it has a hard date and a year of consequences. It is not unusual in how it arrived.

Next week. Microsoft Ignite runs November 17 to 20. Sessions LTG1165, on usage-based billing, and BRK263, on AI budget governance, are the best available signal on whether Microsoft agent metering is about to change. No figures have been published, and none should be assumed.

---

What this does not establish

Size the re-evidencing

The catalog expiry clock is interactive. Enter your own source, catalog, workflow and AI-system counts. Nothing is sent anywhere.

<div data-ariana-embed="purview-catalog-expiry"> <p><a href="/assets/tools/purview-catalog-expiry.html" target="_blank" rel="noopener">Open the catalog expiry clock →</a></p> </div>

Sources

  1. Microsoft Partner Center, "Update on the Microsoft Data Governance strategy," November 2026 announcements, published 2026-11-12. Re-read at primary 2026-11-14. https://learn.microsoft.com/en-us/partner-center/announcements/2026-november C01 C02 C03
  2. Microsoft Partner Center, "Annual currency adjustments to Microsoft Commercial Cloud pricing," published 2026-11-11. Re-read at primary 2026-11-14. Same URL. C13
  3. Microsoft Learn, "What's new in Microsoft Purview," read at primary 2026-11-14; newest heading October 2026, footer last updated 2026-10-16. https://learn.microsoft.com/en-us/purview/whats-new C04
  4. Microsoft Learn, Purview data governance overview, read at primary 2026-11-13, last updated 2025-02-20; returned a site error on re-read 2026-11-14. C05
  5. Microsoft Entra blog, "What's new in Microsoft Entra, November 2026," published 2026-11-06. Re-read at primary 2026-11-14. https://techcommunity.microsoft.com/blog/microsoft-entra-blog/what%e2%80%99s-new-in-microsoft-entra-november-2026/4556457 C06 C14
  6. Microsoft Learn, Entra Agent ID documentation pages manage-agent-identities-admin and agent-id-governance-overview, read at primary 2026-11-11; neither describes the inactivity policy. C07
  7. Google Cloud, Gemini Enterprise release notes, entries dated 2026-11-12 and 2026-11-06. Re-read at primary 2026-11-14. https://docs.cloud.google.com/gemini/enterprise/docs/release-notes C08 C10
  8. NCUA, comments on proposed interagency third-party risk management guidance due November 16, 2026, docket NCUA-2026-1684-0001, OCC, Federal Reserve, FDIC and NCUA. Verified at primary 2026-11-11. https://ncua.gov/news/events/2026/comments-proposed-third-party-risk-management-guidance-due-november-16 C11
  9. European Commission, AI Act Article 50(2) transparency marking obligation applying 2 December 2026, verified at the Commission AI Act FAQ 2026-11-08 and corroborated through Regulation (EU) 2026/1744, OJ 2026-07-24. C12
  10. G2, "2026 AI Agents Insight Report," G2's own survey of 1,019 B2B decision-makers, fielded July 2026, page last updated 2026-10-14. Commercially interested; generative AI used in survey design and analysis. Read at primary 2026-11-14. https://sell.g2.com/g2-2026-ai-agents-insight-report C09
  11. Microsoft Partner Center, November 2026 announcements, Microsoft 365 Copilot Chat fair use limits, notice dated 2026-11-04, effective 2026-11-09. Same URL as source 1. C17
  12. Anthropic, "Claude Fable 5.2 and Mythos 5.2," 2026-11-09, https://www.anthropic.com/claude-fable-and-mythos-5-2; and Anthropic privacy center article 15425996 on covered-model retention, policy effective 2026-06-09. That article names Fable 5, 5.1 and Mythos 5, 5.1 and does not mention 5.2. C18
  13. Google Cloud, Gemini Enterprise release notes, entry dated 2026-11-10 (Gemini 4 Carbon). Same URL as source 7. C19
  14. AWS, Amazon Bedrock AgentCore release notes, November 2026 section, month-only date. https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/release-notes.html C20
  15. Adobe, "Adobe integrates agentic CX Enterprise Coworker into AI platforms," 2026-11-04. https://news.adobe.com/news/2026/11/adobe-integrates-agentic-cx-enterprise-coworker-into-ai-platforms C21
  16. Colorado General Assembly, summary of IT and AI legislation, r26-580. https://content.leg.colorado.gov/sites/default/files/r26-580-summary-of-it-and-ai-legislation-accessible.pdf. The bill page shows only the May 1 introduction action; signing and effective dates are from law firm commentary. C22
  17. US FTC, proposed policy statement concerning the suppression of accuracy in AI systems, 91 FR Doc 2026-13628, docket FTC-2026-0859, document dated 2026-07-01. https://www.ftc.gov/system/files/ftcgov/pdf/ai-policy-statement0.pdf C23
  18. Regulation (EU) 2026/1744, OJ 2026-07-24, https://eur-lex.europa.eu/eli/reg/2026/1744/oj; dates per Future of Privacy Forum, https://fpf.org/blog/the-ai-act-implementation-timeline-what-changes-under-the-ai-omnibus/ C24
  19. ServiceNow, AI Passport and expanded governance capabilities, 2026-10-15. https://newsroom.servicenow.com/press-releases/details/2026/ServiceNow-advances-its-operational-harness-for-enterprise-AI-with-AI-Passport-and-expanded-governance-capabilities/default.aspx C25
  20. California Assembly Privacy and Consumer Protection Committee, 2025 legislative bill summary, SB-11 status vetoed. https://apcp.assembly.ca.gov/system/files/2025-12/2025-legislative-bill-summary.pdf C26

Governance framework: Ariana AEGIS Model, https://ariana.digital/ai-governance.html

© Ariana Digital LLC. All rights reserved.

Open the formatted article on Ariana.Digital →