Microsoft Purview DSPM for AI: Discovering and Reducing Data Risk in AI Use

Begin With the Data Relationship Behind the AI Interaction

When an employee asks an AI application to summarize a document, the visible prompt is only one part of the security story. The application may retrieve organizational content, combine it with the user’s instructions, call tools, generate a response, and preserve some or all of that interaction. Risk depends on which identity initiated the action, what that identity could access, which data entered the interaction, where the response went, and which application or agent performed the work.

Microsoft Purview Data Security Posture Management, or DSPM, is intended to make those relationships visible enough to govern. The current Microsoft Purview DSPM documentation describes a broader experience for sensitive-data risk across traditional applications, AI apps, agents, Microsoft 365, Azure, Fabric, and integrated third-party software. Microsoft still exposes DSPM for AI (classic), but documents the current DSPM experience as the place where most new capabilities will appear.

That distinction prevents a common misunderstanding. DSPM is not an isolated AI firewall. It brings together evidence and controls from Purview capabilities such as auditing, information protection, Data Loss Prevention, insider risk, communication compliance, lifecycle management, and eDiscovery. Its value lies in helping you see where those controls should be applied and whether important data paths remain exposed.

Understand Why Existing Access Can Still Produce AI Risk

Supported Microsoft 365 Copilot experiences respect the permissions a user already has. That is necessary, but it does not mean the information returned is appropriate. A user may have accumulated access to old SharePoint sites, broad Teams memberships, abandoned project spaces, or documents shared more widely than their owners realized. Generative AI can surface that accessible content quickly and in a newly useful form.

This is the oversharing problem. The AI system has not necessarily bypassed authorization; it has made the consequence of weak authorization easier to experience. The security response should therefore include permission hygiene, ownership, site governance, and classification rather than focusing only on prompt inspection.

Well-designed sensitivity labels give Purview and supported AI experiences a durable signal about how information should be handled. Labels do not repair an inappropriate permission by themselves, and an unlabeled item is not automatically harmless. They become most useful when the taxonomy, access model, DLP behavior, lifecycle rules, and investigation process agree about the meaning of the data.

Separate AI Discovery From Interaction Collection

AI visibility can come from several evidence paths. Audit records can identify supported Copilot and agent activity. Endpoint and network controls can provide insight into visits or transfers to third-party generative AI services. Connected enterprise AI applications can make prompts and responses available for compliance workflows when the required integration and policy are in place.

These paths do not prove the same thing. A network event might show that a user visited an AI service or transferred content without revealing the application’s full reasoning. A captured prompt can show what the user submitted but not every source the model retrieved. An audit event might identify an interaction while omitting the response content. Record the vantage point before drawing a conclusion.

Microsoft’s DSPM setup tasks include activating audit, extending discovery of sensitive data in AI interactions, onboarding devices, connecting partner solutions, and creating collection policies for supported enterprise AI apps. Each task expands a particular observation path. None turns absence of an event into proof that no AI use occurred.

Use Security Objectives to Organize Work, Not to Replace Judgment

The newer DSPM experience uses security objectives and guided workflows to organize data-security work. An objective can gather related insights, setup tasks, recommendations, policies, and investigations around a risk such as sensitive data exposed to AI or risky external sharing.

This is useful because posture problems rarely belong to one console switch. Consider an AI interaction that contains confidential customer data. Reducing that risk could involve discovering the data, correcting access, applying a label, warning or blocking transfer with Data Loss Prevention, capturing selected interactions for retention, and giving investigators enough audit context to understand what happened.

Treat the objective as an evidence-backed work area. Ask which population it covers, how freshness is measured, what licensing or onboarding it assumes, and which recommendation changes risk rather than merely changes configuration. A completed setup task is a fact about configuration. Improved security posture is an assessment that also needs outcome evidence.

Read One-Click Policies Before You Accept Their Consequences

Microsoft offers one-click policies to accelerate common configurations, including discovering sensitive information sent to generative AI sites, applying endpoint DLP actions, and capturing interactions from supported enterprise AI applications or Copilot experiences. The convenience is real. So is the need to understand what will be created.

Before activation, identify the policy type, included users and devices, covered applications, sensitive information definitions, action, enforcement mode, storage behavior, prerequisites, licensing, and expected user experience. Determine who will review matches and how exceptions will be governed. A policy that collects prompts and responses creates a sensitive evidence set that needs access control, retention, legal purpose, and monitoring.

Use a simulation-first approach wherever the underlying control supports it. Start with a representative population, examine true and false matches, confirm that alerts contain enough context, and observe operational volume before moving to restrictive actions. One-click should describe deployment effort, not the amount of thinking required.

Treat AI Interaction Evidence as Sensitive Data

Prompts and responses can contain personal information, source code, legal advice, credentials, medical details, customer records, security investigations, or an employee’s unpolished reasoning. Collecting them for security or compliance creates a second data-handling problem if too many people can search them or if they remain available longer than the purpose requires.

Define the purpose before collection. Decide which AI applications and populations are in scope, which fields are necessary, who may investigate, how reviewers are separated from policy administrators, and when evidence should be retained or deleted. Confirm applicable employment, privacy, works-council, and regional requirements with the people accountable for those decisions.

Avoid assuming that more content always means better detection. Metadata and classification might answer some posture questions without storing full conversational content. Where content is required, use least privilege, audit reviewer actions, and make uncertainty explicit. A prompt can show what was submitted; it cannot automatically prove intent or establish that the generated response was used.

Measure Whether the Risk Path Became Safer

A useful DSPM program can explain what changed after a recommendation was adopted. Configuration counts alone are weak evidence. Measure coverage of the intended user and application population, freshness of audit and endpoint evidence, classification quality, recurring sensitive-data paths, policy overrides, unresolved high-impact findings, investigation time, and changes in inappropriate access or transfer.

Keep denominators visible. Ten risky interactions among twenty observed interactions means something different from ten among two million. A decline can mean improved behavior, reduced collection, a changed policy, or missing telemetry. Pair posture trends with health checks and change records.

The mature outcome is not a permanently green dashboard. It is a repeatable ability to discover where AI changes the reach or speed of sensitive data, select a proportionate control, observe its effect, and revise the assessment when applications, permissions, models, agents, or business purposes change.