Purview DSPM for AI: Copilot Governance Checklist

Purview DSPM for AI is one of the most useful starting points for Microsoft 365 Copilot governance. Copilot makes work faster, but it also makes existing data problems easier to find. Overshared SharePoint sites, weak labeling and no audit routine all surface quickly once AI is in use.

Microsoft’s Purview documentation says organizations can use Data Security Posture Management (DSPM) and DSPM for AI to discover, secure and apply compliance controls to AI usage. It also documents DLP controls for Microsoft 365 Copilot and Copilot Chat. These can restrict sensitive prompts, block external web search when prompts contain sensitive information, and stop labeled files or emails from being processed in responses. This checklist turns that guidance into a rollout plan for IT, security and Microsoft 365 owners.

Why Purview DSPM for AI belongs in your Copilot plan

Microsoft 365 Copilot works inside the Microsoft 365 service boundary, uses Microsoft Graph, and accesses data based on the signed-in user’s permissions. That is the right model. However, it means Copilot readiness is inseparable from data readiness: if a user can see content today, Copilot can help them reason over it tomorrow.

Microsoft also states that prompts, responses and data accessed through Microsoft Graph aren’t used to train the foundation models behind Microsoft 365 Copilot. That privacy commitment matters, but it doesn’t fix stale permissions, unlabeled sensitive files or risky prompts. Microsoft Purview’s AI security and compliance guidance covers the capabilities that do: information protection, DLP, audit, insider risk management, communication compliance, eDiscovery and retention.

If you’re still tightening SharePoint permissions, pair this with our guide to SharePoint oversharing before a Copilot rollout. Copilot governance starts with permissions work.

Start with the prerequisites

Microsoft’s deployment considerations for DSPM for AI list prerequisites for monitoring Copilot and agent interactions: the right permissions, Microsoft Purview auditing, and Microsoft 365 Copilot licenses for users. Monitoring other AI apps in Edge also requires an Edge configuration policy that activates the Purview integration.

For third-party generative AI sites, devices must be onboarded to Microsoft Purview. That lets you see sensitive information shared with those sites and apply Endpoint DLP. Some browser and policy scenarios also need a browser extension. So if you want visibility beyond Microsoft 365 Copilot, your endpoint and browser setup matters.

Decide now who owns Copilot governance. IT may manage licenses and configuration, while security owns DLP and audit. Compliance may own eDiscovery and retention, and SharePoint admins may own oversharing cleanup. Name an owner for each.

See the risk before you block anything

Microsoft describes DSPM and DSPM for AI as the front door for AI governance. The first job isn’t to block everything; it’s to understand where risk already exists. Use Purview reports and activity views to answer:

• Which users and groups use Copilot and other supported AI apps?
• Do prompts or responses include sensitive information types?
• Are labeled files being referenced in AI interactions?
• Are third-party AI sites part of users’ workflow?
• Which departments need training before tighter controls go live?

Sensitive information types and trainable classifiers can find sensitive data in prompts and responses for supported AI apps. Results appear in reports and activity explorer. As a result, a vague sense that “AI feels risky” turns into specific policy gaps.

Protect Copilot prompts with DLP

Purview DLP has specific controls for Microsoft 365 Copilot and Copilot Chat:

One configuration detail saves troubleshooting time. You can’t use “content contains sensitive info types” and “content contains sensitivity labels” in the same rule. Instead, create one rule for each condition in the same policy.

Don’t skip labels, audit and retention

Microsoft recommends enabling sensitivity labels for SharePoint and OneDrive if you haven’t already. For encrypted labeled content, users need the right usage rights, including EXTRACT and VIEW, for AI apps to return the data.

Prompts and responses for supported AI apps are captured in the unified audit log. The log records when users interacted and which Microsoft 365 files were referenced, along with any sensitivity labels on those files. Copilot interactions are stored as Copilot activity history, and Purview Content search and retention policies can be applied to that data.

If you’re also letting departments build agents, connect this work to our Copilot Agent Builder governance guide; the data governance foundations are the same.

A 30-day Purview DSPM for AI rollout plan

• Week 1: Validate prerequisites and scope the pilot: roles, audit, licensing, pilot users, device and browser requirements. Confirm who can view AI activity, create policies and approve changes.
• Week 2: Use reports and activity explorer to find sensitive prompt patterns, risky AI app use and content hot spots.
• Week 3: Start with audit-only or narrowly scoped DLP policies for web search, prompts and labels. Test user messaging and business impact before broad enforcement.
• Week 4: Move from pilot to routine: document policy owners, the exception process, review cadence and user guidance.

Bottom line

Purview DSPM for AI brings AI usage, sensitive data, DLP, audit and compliance into one operating model. It doesn’t replace SharePoint cleanup, labeling, endpoint readiness or user training. It does make them easier to target and to prove. The best Copilot rollout is one where users get value, admins can see what’s happening, and sensitive data has guardrails.

Last reviewed: October 2026

Sources

• Microsoft Purview data security and compliance for AI (Microsoft Learn)
• Considerations for deploying DSPM for AI (Microsoft Learn)
• DLP for Microsoft 365 Copilot (Microsoft Learn)
• Microsoft 365 Copilot architecture (Microsoft Learn)
• Data, privacy and security for Microsoft 365 Copilot (Microsoft Learn)