DLP on the endpoint: what Purview and Netskope charge for a thousand users

The licence you already own is the first quote to beat

A thousand-user estate that already runs Microsoft 365 does not buy Purview DLP as a separate endpoint product. Microsoft's own pricing page routes buyers to three options: Microsoft 365 E5, the Purview Suite, and pay-as-you-go, and the same page splits them by workload rather than by feature. User-based protections start with the Purview Suite; coverage across data estates, analytics and AI apps starts with pay-as-you-go.

That split is the decision. If the DLP programme is about people sharing sensitive files from laptops and mail, the Suite is the bundle Microsoft points at. If it is about classifying and governing data sitting in stores and pipelines, the meter runs instead. The endpoint controls described in the DLP documentation, including policy tips, blocking with override and justification, quarantine of data at rest and Teams chat redaction, are the same controls in either case.

What the page does not give is a number. Microsoft lists no per-user price for the Purview Suite or for E5 on the material here, so the cost of 1,000 users is quote-only until a reseller or an existing agreement supplies it. The question to put in writing is which bundle the endpoint DLP workload is licensed under, and whether the estate's current Microsoft 365 tier already includes it.

Where Purview DLP actually enforces

The endpoint story is narrower than the marketing suggests, and the documentation is specific about it. Purview DLP policies target Microsoft 365 services including Exchange, SharePoint, OneDrive and Teams chat and channel messages, and they extend to devices running Windows 10, Windows 11 and the three most recent versions of macOS. On-premises file shares and on-premises SharePoint are covered too, but the file repositories need the Microsoft Purview Information Protection scanner deployed first.

Non-Microsoft connected apps are listed as in preview, naming Box, Dropbox, Google Workspace and Salesforce. That matters for a buyer pricing 1,000 seats: the third-party SaaS coverage that often justifies a standalone DLP purchase is not yet generally available in Purview, so a shortlist that leans on it is comparing a shipping product with a preview.

The network layer is the other half. Purview inspects and blocks sensitive data in AI prompts at the network layer and applies protections to unmanaged and untrusted cloud app traffic, using collection policies and Microsoft Edge for Business. The cloud app catalog behind the network option is Microsoft Defender for Cloud Apps, which the documentation puts at over 35,000 apps. Edge for Business on Windows devices that have not been onboarded into Purview is named as a separate enforcement path.

The classification engine is what you are paying for

Purview's DLP runs deep content analysis rather than a text scan, according to the documentation. It matches primary data such as a card number and then looks for secondary data in proximity, and it applies machine learning to detect content that matches a policy. That proximity logic is the difference between a policy that fires on a real record and one that fires on a test file in a shared drive.

The operational consequence is tuning load. Microsoft tells administrators to deploy policies in simulation mode and evaluate impact before moving to more restrictive modes, and it says a successful implementation depends as much on training users as on the policies. Policy tips are the mechanism it recommends for raising awareness before enforcement tightens. Every monitored activity is written to the Microsoft 365 Audit log by default and routed to Activity explorer, which is where the review evidence comes from.

For a 1,000-user estate the practical question is not whether the engine classifies, but how many policies a small team can tune. Simulation mode, policy tips and Activity explorer are all included in the licence; the analyst time to run them is not, and it is the line that decides whether the programme lands before the audit.

What the endpoint platform already includes

The reason this decision is live for a Microsoft estate is that the endpoint DLP controls arrive with a bundle the organisation may already hold. Blocking a share, warning the user, capturing an override justification, quarantining data at rest and hiding sensitive content in Teams chat are documented behaviours of Purview DLP, not add-ons priced separately on the page. If the estate runs E5, the marginal cost of turning endpoint DLP on is configuration and analyst time.

The gap is coverage outside the Microsoft estate. Devices are Windows 10, Windows 11 and the three latest macOS releases, so Linux endpoints and older macOS builds fall outside the documented scope. On-premises repositories need the scanner deployed before a policy reaches them. Third-party cloud apps are in preview. A buyer with a mixed fleet should price the uncovered devices separately rather than assume the bundle closes them.

That is the honest comparison against a standalone endpoint DLP platform: Purview wins on marginal cost where the bundle is already paid for, and loses on breadth where the fleet is not Microsoft-shaped. The number to ask for is the per-user uplift from the current Microsoft 365 tier to the tier that carries the Suite, not a standalone DLP price.

The question to put to each vendor

Neither vendor publishes a per-user DLP price on the pages available here. Microsoft names the bundles and the pay-as-you-go route without a rate; Netskope is quote-only on this material. A 1,000-user comparison therefore cannot be settled from list prices, and any figure presented as one should be treated as an estimate until it appears on a quote with a term and a bundle named.

Ask Microsoft for the per-user uplift to the tier that includes the Purview Suite, the term, and whether the endpoint DLP workload is metered separately under pay-as-you-go for devices outside the Microsoft 365 estate. Ask for the treatment of the non-Microsoft connected apps once they leave preview, because a price agreed on preview coverage may not hold at general availability.

Ask Netskope for the same three things in the same units: per-user cost at 1,000 seats, the term, and which endpoint and cloud app coverage is included at that price. Without matched units the two quotes cannot be compared, and the cheaper headline number usually belongs to the narrower scope.

The decision rule for a 1,000-user estate

Choose the Purview Suite route if the estate already runs Microsoft 365 at a tier close to E5, the endpoints are Windows and current macOS, and the DLP requirement is about people sharing sensitive files from devices and mail. In that case the controls are already licensed, the work is simulation, tuning and training, and the cost to defend is the uplift rather than a new contract.

Choose pay-as-you-go if the requirement is classification and governance across data estates, analytics and AI apps rather than endpoint enforcement, because that is the route Microsoft points estate-wide coverage at and it meters with the data rather than the headcount. Price it against the volume of data scanned, not against 1,000 users.

Wait on the third-party app coverage if Box, Dropbox, Google Workspace or Salesforce enforcement is what the purchase is for, since those connectors are documented as in preview and a programme built on them carries a date risk. And if the fleet is Linux-heavy or the requirement is a standalone endpoint DLP platform with published per-seat pricing, neither option here gives a number to compare, so the shortlist needs a vendor that publishes one.