Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Security imperative: Get ready for AI
Job to be done: Protect sensitive data
A proactive data protection strategy creates the trusted data foundation organizations need to adopt and scale AI with confidence. By unifying data security and compliance, organizations can understand sensitive data and exposure, apply consistent protections across human and AI interactions, investigate risk, and demonstrate that controls are working.
Context and problem
AI expands how organizations discover, access, summarize, and act on their data—creating opportunities to improve productivity, decision-making, and innovation. A strong data security foundation helps organizations realize these benefits with confidence by helping provide continuous visibility into sensitive data, access, usage, and protection. It also helps address existing challenges such as oversharing, excessive permissions, inconsistent classification, and protection gaps before they limit AI adoption.
Organizations can accelerate AI adoption by treating data readiness as a continuous operating model rather than a one-time deployment checkpoint. This approach helps ensure that the right people, apps, and agents can access the right data with the right permissions and protections as data, access, and AI usage evolve. Extending the same trusted foundation across supported human activity, AI apps, agents, and models enables organizations to:
Understanding where your sensitive data lives.
Gaining visibility into what data AI can access across apps, browsers, on-premises, file shares and other endpoints.
Scaling classification, policy creation, investigations, and compliance reporting to AI usage.
Ensuring the right permissions and controls are in place to help prevent oversharing.
Maintaining consistent protections as data grows and spreads across systems.
Proactively identifying and remediating issues before they become data security and/or compliance incidents.
Providing measurable proof of data protection to regulators, auditors, executives, and/or customers.
Solution
An effective data protection strategy gives organizations a connected, proactive operating model for scaling AI with confidence. It starts with discovering and accurately classifying sensitive data, then connects data, permissions, activity, and protection signals to prioritize the actions that matter most. Organizations can apply controls across supported human and AI interactions, investigate incidents with shared context, govern AI activity according to business and regulatory requirements, and measure improvements in their posture. This continuous loop strengthens readiness as AI adoption expands.
Guidance
Microsoft Purview is a unified data security and compliance solution that helps organizations discover, protect, and govern data across people, applications, and AI. Purview brings together data context, integrated protection, investigation, and compliance capabilities so organizations can understand where sensitive data and exposure exist, prioritize and take action, govern AI interactions, and continuously strengthen their data security and compliance posture. The guidance below organizes these capabilities into three connected stages for building a trusted data foundation and scaling AI with confidence.
Phase 1: Understand data readiness and reduce exposure through discovery, classification, and protection
Start by building a clear, shared view of sensitive data, permissions, protection coverage, and AI activity. Accurate classification helps organizations understand sensitive and overshared content, see who or what can access it, and prioritize the actions that will have the greatest impact on secure AI adoption. This foundation helps enable consistent labeling and protection while helping teams with the context they need to make more informed remediation decisions.
Step |
Recommended action |
Resource |
|---|---|---|
Understand your data risks |
Microsoft Purview Data Security Posture Management (DSPM) helps identify where sensitive data resides, who can access it, and where exposure exists by prioritizing data that is overshared, broadly accessible, or available to AI applications and agents. DSPM can help assess sensitive data exposure, identify overshared or high-risk content, and understand relationships between sensitive data, users, AI applications, agents, and Copilots. |
Learn about Microsoft Purview Data Security Posture Management (DSPM) | Microsoft Learn Use Microsoft Purview to manage data security & compliance for Microsoft Agent 365 | Microsoft Learn |
Discover ,classify and label critical information |
Microsoft Purview Information Protection (MIP) provides classification and labeling capabilities for confidential, regulated, and proprietary information. Using sensitive information types, trainable classifiers, and auto-labeling, coverage doesn't depend on individual user judgment. MIP provides the foundation to help ensure data security controls can readily be extended to AI usage. |
|
Prevent unauthorized sharing of sensitive data |
Microsoft Purview Data Loss Prevention (DLP) extends sensitive data protections across Microsoft 365, endpoint devices, browsers, networks, Fabric, and Microsoft 365 Copilot. DLP also helps prevent sharing sensitive information with unmanaged AI apps through networks, Microsoft Edge, and cloud apps in Edge for Business. |
Microsoft Purview DLP for Microsoft 365 Copilot and Copilot Chat | Microsoft Learn |
Phase 2: Protect sensitive data and investigate risk across human and AI interactions
With a trusted data foundation in place, organizations can apply controls that support appropriate use and sharing across supported human and AI interactions. When risk is detected, connected sensitivity, identity, activity, and policy context helps security and compliance teams quickly understand what happened, determine which data is affected, prioritize by business impact, and coordinate the right response across workloads.
Step |
Recommended action |
Resource |
|---|---|---|
Detect, investigate, and mitigate internal risks |
Microsoft Purview Insider Risk Management (IRM) helps identify and mitigate potential risks across user and agent activities. It can surface scenarios such as prompt injection attacks, access to protected materials, intellectual property theft, data leakage, and security policy violations—whether the activity is inadvertent or intentional—so teams can investigate and respond before risks become security incidents. |
Monitoring agents with Insider Risk Management | Microsoft Learn |
Investigate data risks within security incidents |
Microsoft Purview integrates with Microsoft Defender XDR to bring data context into security operations. Insider Risk Management and Data Loss Prevention alerts can be correlated with alerts from other Microsoft security solutions such as Microsoft Entra ID, into a single incident. This helps security teams understand what sensitive data is at risk and prioritize incidents by business impact. |
Investigate insider risk threats in the Microsoft Defender portal Investigate data loss prevention alerts with Microsoft Defender XDR |
Ensure gen AI interactions meet regulatory compliance and business conduct guidelines |
Microsoft Purview Communication Compliance provides tools to help you detect and manage regulatory compliance and business conduct violations across various communication channels, which include user prompts and responses for AI apps. Communication Compliance can analyze AI prompts and responses to detect inappropriate interactions, sharing confidential information, harassing or threatening language, or adult content entered into generative AI applications. |
Configure a Communication Compliance policy to detect generative AI interactions | Microsoft Learn Detect channel signals with Communication Compliance | Microsoft Learn |
Search and manage AI activities to support audits and investigations |
Microsoft Purview Audit provides robust tools for searching and managing audit records for various AI activities performed across various Microsoft services by users and admins. Using Audit logs and reports, organizations can understand which user interacted with AI, when the AI interactions took place and where it occurred. |
Auditing and AI interactions | Microsoft Learn Audit logs for Copilot and AI applications | Microsoft Learn |
Phase 3: Govern AI interactions and demonstrate compliance effectiveness
As AI use expands, organizations can strengthen confidence by combining preventive controls with a defensible record of AI activity and a repeatable governance model. This includes assessing applicable requirements, observing supported user, administrator, Copilot, and agent activity, detecting policy violations, retaining or deleting AI interaction data according to policy, and preserving relevant evidence for investigations. Together, these capabilities help organizations translate regulatory and business requirements into operational controls, demonstrate that those controls are working, and scale AI with greater consistency and accountability.
Step |
Recommended action |
Resource |
|---|---|---|
Manage retention and records requirements |
Microsoft Purview Data Lifecycle Management provides tools and capabilities to automatically manage lifecycle of AI apps, user prompts, and responses. By simply applying a single policy to multiple locations, specific locations or specific users, organizations can help ensure appropriate retention policies are applied as per industry standard. |
Data Lifecycle Management and AI interactions Learn about retention for Copilot and AI apps | Microsoft Learn Learn about retention policies & labels to retain or delete | Microsoft Learn |
Effectively respond to security events, investigations and compliance obligations |
Microsoft Purview eDiscovery provides tools and capability to respond to security, regulatory, and legal inquiries and investigations. Using Microsoft Graph Explorer, eDiscovery can help find and remove sensitive information or inappropriate content included in Copilot and other AI application activities. |
eDiscovery and AI interactions | Microsoft Learn Search for and delete AI application data in eDiscovery | Microsoft Learn |
Ensure business and regulatory requirements are being met |
To help you keep compliant with AI regulations, Microsoft Purview Compliance Manager provides regulatory templates to help you assess, implement, and strengthen your compliance requirements for all generative AI apps. For example, monitoring AI interactions and helping prevent data loss in AI applications. |
Microsoft Purview Compliance Manager assessments for AI regulations | Microsoft Learn |
Outcomes
Accelerate AI adoption with a clearer understanding of sensitive and overshared content, permissions, access, and the risks most likely to affect secure expansion.
Enable appropriate use and sharing by applying classification, labels, and data loss prevention controls across supported collaboration tools, applications, endpoints, Copilot experiences, and AI interactions.
Continuously strengthen data security posture by connecting sensitivity, permissions, activity, and policy signals; understanding why exposure exists; prioritizing remediation actions; and measuring improvements in protection coverage and risk indicators over time.
- Demonstrate compliance with defensible evidence by preserving AI activity, policy, retention, investigation, and control-effectiveness records that support audits, regulatory inquiries, legal matters, and executive oversight.
Key success factors
Help increase security ROI by using classification and labeling to scale consistent protection, help reduce manual effort, and help prevent sensitive data from being leaked or overshared.
Scale AI adoption with confidence by establishing protection for sensitive information as a foundation and continuously addressing data exposure as usage expands.
Maintain consistent protection at scale so teams can collaborate, adopt AI, an expand data use while policies continue to follow sensitive information across supported systems.
Increase executive confidence with demonstratable policy effectiveness and audit readiness across your organization.