Microsoft Purview DSPM for AI (Classic)
Discovering, auditing and governing Microsoft 365 Copilot and generative AI activity, with auto-provisioned Data Loss Prevention and Insider Risk Management policies.
Difficulty
Advanced
Environment
Microsoft 365 / Purview
Deployment
Production
Est. Implementation
45–60 minutes
Executive Summary
This project documents an end-to-end configuration of Microsoft Purview Data Security Posture Management (DSPM) for AI (Classic) — the control plane Microsoft 365 tenants use to discover, audit and govern how users and agents interact with Microsoft 365 Copilot and other generative AI applications.
The lab completes the mandatory onboarding checklist, validates live AI interaction and sensitive-information-type telemetry in Activity Explorer, reviews risk-focused Reports, and confirms the Data Loss Prevention and Insider Risk Management policies that extending AI data discovery insights auto-provisions, closing with a governance maturity scorecard from Purview’s Recommendations engine.
Business Problem
The organization had no way to see what sensitive data — PII, financial data, national identifiers — was being shared with Microsoft 365 Copilot, Copilot agents, or external generative AI applications accessed through the browser.
Microsoft 365 Copilot and browser-based AI tools sit directly on top of the same SharePoint, Exchange and Teams content stores that traditional DLP programs were built to protect, and prompts submitted to those tools cannot be retrieved once sent — a governance blind spot that grows with every stage of Copilot adoption.
Business Risks
- Sensitive identifiers (Aadhaar numbers, Japanese My Number data and other regulated PII) shared with Copilot without any monitoring
- No structured signal for unauthorized or unethical AI interactions
- Governance and audit gaps as Copilot usage scales across the tenant
Compliance Concerns
- SC-400 / SC-300 aligned data security and insider risk scenarios
- Zero Trust audit-first governance posture
Solution Overview
DSPM for AI (Classic) was activated from the Purview Solutions catalog and the four-step onboarding checklist was completed in sequence — activating Microsoft Purview Audit, installing the Purview browser extension, onboarding devices, and extending insights for data discovery.
Extending insights auto-provisioned three governance policies across Data Loss Prevention and Insider Risk Management in a single action, while Activity Explorer and the Reports dashboard gave a unified view of Copilot interactions, sensitive information type matches and a dedicated "unethical AI interaction" risk signal.
Architecture
Architecture diagram placeholder
Technology Stack
Microsoft Purview DSPM for AI (Classic)
Discovery, telemetry and governance control plane for AI activity
Microsoft Purview Audit
Foundational telemetry layer feeding Copilot interaction data
Purview browser extension & device onboarding
Extends visibility to AI sites reached through Edge, Chrome and Firefox
Activity Explorer
Event-level detail on AI interactions and sensitive info type matches
Data Loss Prevention / Insider Risk Management
Auto-provisioned enforcement policies triggered by extending AI insights
Lab Environment
- Portal
- Microsoft Purview compliance portal (purview.microsoft.com)
- Tenant admin account
- admin365lab
- Test user
- testuser1@securem365lsb...
- AI app in scope
- Microsoft 365 Copilot (Copilot Chat, WebChat surface)
- Lab date range observed
- 30 June 2026 – 7 July 2026
Implementation
A phased, expandable walkthrough. Screenshots and evidence can be attached to each phase.
Locate DSPM for AI (Classic) in the Purview Solutions catalog and review the four-step "Get started" onboarding checklist.
- Select DSPM for AI (classic) from the Purview Solutions catalog
- Review the Overview dashboard and the four required onboarding steps
- Confirm Purview Audit, the browser extension and device onboarding show completed
Screenshots for this phase can be added here.
PowerShell
Illustrative example snippets — copy or download each script. Production values are placeholders.
Confirm Microsoft Purview Audit status
# Illustrative scaffold — DSPM for AI has a hard dependency on Purview Audit being active.
Connect-IPPSSession -UserPrincipalName admin@yourtenant.onmicrosoft.com
# Confirm unified audit logging is enabled tenant-wide
Get-AdminAuditLogConfig | Select-Object UnifiedAuditLogIngestionEnabledConfiguration Screenshots
Click any tile to open the lightbox. Real screenshots will replace these placeholders.
Validation
Onboarding checklist completed
Purview Audit, browser extension and device onboarding confirmed complete before extending insights — Pass
Telemetry validated
Activity Explorer returned 9 events across AI Interaction and Sensitive info types activity types — Pass
Policies auto-provisioned
Extend Insights panel confirmed policies created; independently verified Status: On for all three in the Policies list — Pass
Sensitive interactions confirmed
Reports Data section showed 12 sensitive interactions and 1 unethical interaction against Microsoft 365 Copilot — Pass
Challenges
Sequenced onboarding dependency
DSPM for AI cannot surface any Copilot interaction telemetry until Purview Audit is active first — the onboarding checklist must be completed in order, not in parallel.
One action, multiple solution areas
"Extend insights for data discovery" provisions policies across Data Loss Prevention and Insider Risk Management simultaneously, so a single DSPM for AI action has a footprint that other solution owners need to review.
Lessons Learned
- Visibility precedes governance — meaningful AI activity data only became visible after the first three onboarding steps were completed.
- A single "Extend insights for data discovery" action provisioned policies across three different Purview solution areas at once, which matters for change management.
- The Recommendations completion count is a leading indicator of governance maturity, not a lagging measure of actual protection already in place.
- DSPM for AI (Classic) is scheduled for retirement on 30 September 2026, with all classic data carrying forward into the new DSPM experience — a migration every Microsoft 365 security team using it will need to plan for.
Business Impact
12
Sensitive Interactions Detected
3
Policies Auto-Provisioned
9 Activity Events
Telemetry Validated
1 of 14 Recommendations
Governance Maturity
Skills Demonstrated
Related Certifications
Certifications this project maps to are highlighted.
Related Blog Articles
Placeholder cards — future TechCertGuide integration.
GitHub Repository
Microsoft-Purview-DSPM-for-AI
PublicEnterprise configuration and validation of Microsoft Purview DSPM for AI (Classic) for Microsoft 365 Copilot governance.
Download Center
Project Case Study
PDF · Available soon
Architecture Diagram
PDF · Available soon
PowerShell Scripts
ZIP · Available soon
Technical Documentation
PDF · Available soon