I keep seeing the same sequence. Copilot rolls out, third-party AI tools turn up all over the place, and soon IT and compliance teams want to know how they can actually see and govern those AI interactions. In almost every tenant I work in, data exposure, oversharing and sensitive information in AI prompts become a concern right away. Microsoft's new DSPM for AI solution in the Purview portal is the first consolidated answer we've had. It brings reports, risk assessments and one-click policies that put both Copilot and third-party AI usage under real oversight.

DSPM for AI needs licences and audit logging before it shows anything

You'll find DSPM for AI in the Microsoft Purview portal under Solutions, but as usual the actual work starts with the prerequisites. You need Microsoft 365 E5 Compliance licences or equivalent add-ons (Information Protection or Insider Risk Management, for example). To monitor third-party AI, devices have to be onboarded with Microsoft Purview Endpoint DLP. Audit logging must be switched on, because without it you get no insight into Copilot or AI usage at all. I always check the audit settings in Microsoft Purview → Monitoring → Audit before doing anything else. The browser extension (currently Edge and Chrome) is rolled out through an Endpoint DLP policy, and that step often causes trouble in hybrid and BYOD environments.

One-click policies cover sensitive data and communication in AI

The one-click policies in the portal are the part I find most useful. With a few clicks you can set up detection of sensitive information in AI prompts and answers, based on the Purview sensitivity labels and info types you already have. If you want more, you can enable Insider Risk Management or communication compliance for AI. Communication compliance now also reviews prompt and response content for compliance violations, inappropriate language or insider risk signals. You can tailor these policies quite a bit and limit them to specific sources, user groups or AI providers. In practice a staged rollout works best for me: begin with reporting, then turn on policies selectively for the riskiest users or sites. All of it happens in the GUI. No PowerShell, no JSON, only the portal.

The reports show Copilot and third-party AI activity side by side

The reporting is where DSPM for AI is strongest. You can see Copilot usage broken down by interactions, data sources and risk factors. On top of that, you can see which third-party AI tools (ChatGPT, Perplexity and others) are being opened from company devices or browsers. This only works for devices onboarded with Endpoint DLP or the browser extension. Still, for many organizations it's the first time they can trace sensitive SharePoint data being pasted into a third-party AI chat, or even get a basic picture of where and how AI shows up in daily work.

The SharePoint data risk assessment is one report I'd look at early. Purview evaluates which SharePoint sites carry the highest risk of oversharing to AI. It combines sensitivity label analytics with access signals, which is exactly what I've wanted for a long time (see /blog/copilot-oversharing-deployment-blueprint).

flowchart TD
    User["User"] --> Copilot["Microsoft 365 Copilot"]
    User --> ThirdAI["Third-Party AI (e.g., ChatGPT)"]
    Copilot --> Audit["Audit Log"]
    ThirdAI --> EndpointDLP["Endpoint DLP / Browser ext."]
    Audit --> PurviewDSPM["Purview DSPM for AI"]
    EndpointDLP --> PurviewDSPM
    PurviewDSPM --> Admin["Admin Reports & Policies"]

Figure: How data flows into DSPM for AI. Copilot and third-party AI usage end up in one place for admins.

Audit logging and device onboarding should come first

When I pilot DSPM for AI, I start with a small group. Give them E5 Compliance licences and make sure their devices have Endpoint DLP and the browser extension deployed. Confirm that audit logging is running before you even open the reports, otherwise you have nothing to go on.

Device onboarding is usually the slowest part, especially when Endpoint DLP isn't widely deployed yet. Compliance, IT and the pilot users need to coordinate early, or this step drags on.

DSPM for AI still has limits you should know about

DSPM for AI doesn't solve everything. I still see gaps with unmanaged BYOD devices, with apps outside browser and Endpoint DLP coverage, and with the underlying governance questions, oversharing through open SharePoint permissions in particular (see also /blog/copilot-interactions-audit-retention-purview and Purview: AI and data classification).

Microsoft documents many of the technical requirements and caveats in DSPM for AI: Considerations and DSPM for AI: Third-party AI considerations. If you're about to implement it, read those pages first.

DSPM for AI is worth it if you do the groundwork first

DSPM for AI closes a lot of the visibility and control gaps in Microsoft 365 AI. Consolidated reporting, one-click protection and monitoring of third-party AI add a great deal of value, but only on solid foundations. Without audit logs, Endpoint DLP and clear governance, it stays a partial solution. Once those basics are in place, you're in a good position to handle productive AI adoption.