How I Run a Microsoft 365 Copilot Data Security Assessment with Microsoft Purview
The assessment sequence I use to evaluate permissions, classification, DLP, AI-specific controls, and investigation readiness before and after Microsoft 365 Copilot deployment — using Microsoft Purview as the primary assessment and enforcement platform.
Introduction
I start a Microsoft 365 Copilot data security assessment with permissions and oversharing, not with DLP. If access is already too broad, Copilot simply makes that exposure easier to discover. A configured DLP policy does not fix a tenant where hundreds of SharePoint sites are accessible to Everyone except external users (EEEU), sensitivity labels exist but are not consistently applied, and audit retention has never been validated.
One common mistake is assuming that enabling Purview automatically makes the tenant Copilot-ready. Classification, labels, permissions, DLP, auditing, and governance all need to work together — and the sequence matters. My assessment sequence: permissions → sensitive-data discovery → classification and labels → DLP → AI-specific controls → audit and retention → validation and remediation.
Why a Microsoft 365 Copilot Data Security Assessment Matters
Microsoft 365 Copilot queries Microsoft Graph using the authenticated user’s permissions and returns content from SharePoint, OneDrive, Teams, Exchange, and other Microsoft 365 services. It respects sensitivity labels and encryption where supported — Copilot only returns encrypted content if the user holds VIEW and EXTRACT usage rights.
But “respects permissions” means Copilot inherits every permission problem the tenant already has. Broad sharing links, stale group memberships, EEEU access, and unclassified sensitive content all become discoverable through natural-language prompts. The assessment is not about Copilot itself — it is about whether the data environment is governed well enough for AI-scale discovery.
How Microsoft Purview Protects Copilot Data
Microsoft Purview Data Loss Prevention (DLP) provides the classification, labeling, DLP, audit, and compliance layer for Microsoft 365 Copilot interactions. Each control addresses a different part of the data flow:
Sensitivity labels and encryption. Labels applied to files, emails, Teams, Microsoft 365 Groups, and SharePoint sites govern how Copilot can process the content. Encrypted content requires the user to hold VIEW and EXTRACT rights. Unlabeled content does not receive label-specific protection, but other Purview controls — including SIT-based DLP, retention, and auditing — can still evaluate and protect it.
Data Loss Prevention. The Microsoft 365 Copilot and Copilot Chat DLP location can block labeled files and emails from Copilot processing (E5/Purview Suite), restrict sensitive information types (SITs) in prompts (available to Microsoft Copilot and Copilot Chat users), and block external web search on sensitive prompts. DLP does not inspect files uploaded directly into a prompt, and calendar invitations are unsupported. External-email grounding restriction is currently in Preview.
Data Security Posture Management (DSPM). DSPM discovers sensitive data being used by AI, runs Copilot data risk assessments, surfaces oversharing, and provides one-click policy recommendations. It is the assessment starting point — not a control you configure after DLP.
Endpoint DLP. Microsoft Purview Endpoint DLP can block users from pasting or uploading sensitive content to third-party AI services. This extends the data-protection boundary beyond Microsoft 365 Copilot to browser-based AI tools.
Audit, retention, and eDiscovery. Copilot prompts and responses are logged in the unified audit log. Copilot interaction compliance copies are stored in hidden Exchange mailbox locations and governed through Purview retention policies — a separate retention mechanism from Audit (Standard) records. Premium eDiscovery supports searching Copilot activity for compliance and investigation.
Microsoft 365 Copilot Data Security Assessment Framework
I use DSPM early in the assessment to understand where sensitive data, oversharing, and risky AI interactions actually exist.
The assessment sequence from permissions through validation. Each step maps to a primary tool and licensing tier — permissions remediation comes before any Purview control.
Assessment sequence
Step What I assess Primary assessment tool 1. Permissions and oversharing SharePoint and OneDrive — broad sharing, EEEU, stale groups, ownerless sites SAM Data Access Governance (DAG) reports, DSPM oversharing assessment 2. Sensitive-data discovery Where sensitive data exists, who can access it, and whether AI interactions reference it DSPM data-risk assessment, Content Explorer (where licensed) 3. Classification and labels Whether a usable sensitivity-label taxonomy exists, is published, and is applied Sensitivity labels, auto-labeling policies, label activity 4. DLP for Copilot Whether Copilot-specific DLP policies are configured, scoped, and effective Purview DLP — Microsoft 365 Copilot and Copilot Chat location 5. Endpoint DLP Whether third-party AI services are covered Endpoint DLP policies, browser controls and extensions 6. Audit and retention Whether Copilot interactions are logged, retained, and investigable Purview Audit, retention policies, eDiscovery 7. Validation Whether configured controls actually work when tested against real Copilot behavior Activity Explorer, policy events, manual Copilot testing
Licensing determines assessment scope
Capability E3 + Copilot E5 + Copilot E7 Manual sensitivity labels ✓ ✓ ✓ Automatic sensitivity labeling — ✓ (E5/Purview Suite) ✓ Container sensitivity labels Verify prerequisites ✓ ✓ DSPM — activity and auditing ✓ ✓ ✓ DSPM — prompt/response visibility — ✓ ✓ DLP: restrict SITs in Copilot prompts ✓ ✓ ✓ DLP: block labeled files/emails from Copilot — ✓ (E5/Purview Suite) ✓ Endpoint DLP — ✓ (E5 or Purview Suite/IP&G) ✓ Insider Risk Management AI templates — ✓ ✓ Communication Compliance for Copilot — ✓ ✓ Audit (Standard) — 180-day record retention ✓ ✓ ✓ Audit (Premium) — extended retention — ✓ ✓ eDiscovery content search, hold, export ✓ ✓ ✓ eDiscovery Premium workflows — ✓ ✓
E3 + Copilot supports eDiscovery content search, legal hold, and export for Copilot interactions. Premium eDiscovery capabilities require E5 or qualifying add-ons.
How I Run the Assessment
Step 1: Assess permissions and oversharing. Before evaluating any Purview control, review the access environment Copilot operates within. Use SharePoint Advanced Management (SAM) DAG reports to identify sites with EEEU access, anonymous sharing links, ownerless sites, and inactive sites with broad permissions. Run the DSPM oversharing assessment. Review Teams and Exchange permissions using their appropriate workload and identity controls separately — DAG reports primarily assess SharePoint and OneDrive permission exposure.
Step 2: Discover sensitive data exposure. Run a DSPM data-risk assessment to identify what sensitive data exists, where it sits, who can access it, and whether Copilot interactions have already referenced it. Review Content Explorer where licensed for SIT matches and classification coverage. This step determines where labels and DLP are most urgently needed.
Step 3: Evaluate classification and labeling. Sensitivity labels are only useful when the taxonomy is practical and consistently applied. I prefer a small, enforceable label model over a large catalog users do not understand. Assess whether labels are published to the right users, whether auto-labeling policies cover high-risk content (E5), and whether container labels are applied to Teams, Groups, and SharePoint sites. Check whether encrypted content has appropriate usage rights — Copilot requires VIEW and EXTRACT. Verify sensitivity-label inheritance for Copilot-generated content in supported scenarios, including whether the highest-priority source label and associated protection are applied as expected.
Step 4: Evaluate Copilot-specific DLP. I review Copilot DLP separately from traditional Microsoft 365 DLP because AI prompts, grounding, and generated responses introduce different data-flow risks. Check whether dedicated policies exist for the Microsoft 365 Copilot and Copilot Chat location. Verify which rules use label-based blocking (E5) versus prompt-level SIT protection.
This PowerShell checks whether Copilot DLP policies exist and their current enforcement state:
Connect-IPPSSessionGet-DlpCompliancePolicy |
Where-Object { $_.Workload -match "M365Copilot" -or $_.Workload -match "CopilotChat" } |
Select-Object Name, Mode, Enabled,
@{N='Workload';E={$_.Workload -join ', '}} |
Format-Table -AutoSizeIf this returns no results, no Copilot-specific DLP policies exist. If policies appear with Mode: Audit or Enable: False, they are not enforcing. Also check the default Copilot DLP policy — it starts in simulation mode and requires deliberate configuration to enforce.
Document the known coverage gaps: uploaded-file contents are not inspected, calendar invitations are unsupported, external-email grounding restriction is in Preview.
Step 5: Evaluate Endpoint DLP. The risk is not limited to Microsoft 365 Copilot — users can paste corporate data into third-party AI services through browsers. Assess whether Endpoint DLP is configured, whether devices are onboarded, and whether sensitive service domain groups and browser restrictions cover the AI services in scope. Microsoft Edge supports Endpoint DLP natively on Windows; Chrome and Firefox require the Microsoft Purview extension for applicable scenarios.
Step 6: Evaluate audit, retention, and investigation readiness. I treat audit, retention, eDiscovery, and investigation capability as security controls, not just compliance features. Verify that Purview Audit is active for Copilot interactions — Audit (Standard) records are retained for 180 days. Separately, define retention policies for Copilot interaction content stored in hidden Exchange mailbox locations according to investigation and compliance requirements. Confirm that eDiscovery roles and investigation procedures are established.
Step 7: Validate everything. I always validate what Purview can and cannot enforce. A configured policy is not enough. Test actual Copilot behavior: attempt to retrieve labeled content, trigger a DLP rule, generate a prompt containing a configured SIT, and verify the expected blocking, logging, and alerting. Review Activity Explorer for policy matches. If the expected behavior does not occur, the control is not working.
Common Microsoft 365 Copilot Data Security Mistakes
Starting with DLP instead of permissions. DLP cannot fix access. If 500 users can access a sensitive SharePoint site, Copilot DLP can restrict processing of labeled content but cannot undo the underlying access grant.
Assuming Purview enablement means Copilot readiness. Each Purview capability — labels, DLP, DSPM, Endpoint DLP, audit, retention — requires deliberate configuration, scoping, and testing.
Get Hasib Munib’s stories in your inbox
Join Medium for free to get updates from this writer.
Labels without a practical taxonomy. A large, confusing label catalog that users cannot consistently apply is not data classification.
Ignoring Endpoint DLP scope. The data-security boundary extends beyond Microsoft 365 Copilot. Browser-based third-party AI services are a separate exposure path.
Misconfiguring retention. Audit (Standard) records and Copilot interaction compliance copies are governed by different retention mechanisms. Define requirements for both.
Licensing assumptions. Label-based Copilot DLP blocking requires E5 or the Purview Suite. Endpoint DLP requires E5 or qualifying Purview entitlement. Do not design controls that exceed the tenant’s entitlement.
Skipping validation. A policy that appears configured in the Purview portal but does not produce the expected behavior during actual Copilot use is not a working control.
What Microsoft Purview Does Not Replace in Copilot Security
Permissions. Purview classifies, labels, and restricts processing. Permission remediation in SharePoint, OneDrive, and Teams is a workload responsibility.
Files uploaded directly into prompts. DLP does not inspect file contents uploaded into a Copilot prompt — only the typed prompt text is evaluated.
Prompt injection detection. Purview does not automatically detect prompt-injection attacks in retrieved content. That requires separate controls such as Defender runtime protection.
Generated-content governance. Verify that Copilot-generated content inherits the expected sensitivity label in supported scenarios. Do not assume inheritance works universally without validation.
Universal coverage. The Copilot DLP location covers human-Copilot interactions in supported channels. It does not universally cover every tool call, agent action, or data path.
What I Recommend in Production
Fix oversharing first. No Purview control substitutes for correct permissions.
Run DSPM before writing policies. Use data-risk assessments and one-click recommendations.
Deploy a small, enforceable label taxonomy. Auto-label high-risk content where E5 supports it.
Configure Copilot DLP deliberately. Label-based blocking (E5). Prompt-level SIT protection. Separate rules.
Extend to Endpoint DLP. Cover third-party AI services with appropriate browser controls.
Establish investigation readiness. Audit active. Retention defined for both audit records and Copilot interaction content. eDiscovery roles assigned.
Validate every control. Test actual Copilot behavior before considering the assessment complete.
Microsoft 365 Copilot Data Security Assessment Checklist
→ SharePoint and OneDrive permissions assessed using SAM DAG reports; oversharing, EEEU, anonymous links, and ownerless sites remediated. → Teams and Exchange permissions reviewed using appropriate workload controls. → DSPM activated; data-risk assessment and oversharing assessment completed. → Sensitivity-label taxonomy defined, published, and applied; auto-labeling configured for high-risk content (E5); container labels applied. → Copilot-generated-content label inheritance verified in supported scenarios. → Copilot DLP policies configured: label-based blocking (E5) and prompt SIT protection with separate rules. → Endpoint DLP configured for third-party AI services; devices onboarded; required browser controls and extensions deployed. → Purview Audit verified for Copilot interactions (180-day Audit Standard retention). → Retention policies defined for Copilot interaction compliance copies. → eDiscovery roles assigned; investigation procedures established and tested. → Licensing verified against the Microsoft Purview service description. → All configured controls validated through actual Copilot testing — policy events, Activity Explorer, and expected behavior confirmed.
Microsoft References
→ Use Microsoft Purview to manage data security for Microsoft 365 Copilot — Layered control model: labels, DLP, DSPM, audit, retention, and compliance.
→ Microsoft Purview DLP for Microsoft 365 Copilot and Copilot Chat — Conditions, actions, coverage gaps, and file-upload limitation.
→ Prevent oversharing with Data Security Posture Management — DSPM data-risk assessments, oversharing discovery, and one-click recommendations.
→ Considerations for deploying DSPM — Prerequisites, Audit activation, and administrative-unit limitations.
→ Learn about sensitivity labels — Label taxonomy, encryption, usage rights, and auto-labeling.
→ Microsoft Copilot data protection architecture — How Copilot respects permissions, labels, and encryption.
→ Configure a secure and governed foundation for Microsoft Copilot — Oversharing remediation, SAM, and phased governance.
→ Prepare for Microsoft Copilot by comparing E3, E5, and E7 — Purview, DSPM, DLP, audit, and compliance capabilities by tier.
→ Microsoft Purview service description — Authoritative licensing matrix for Purview controls by tier.
→ Learn about retention for Copilot and AI apps — Hidden mailbox compliance copies and retention-policy behavior.
→ Audit logs for Copilot and AI applications — Copilot audit schema, interaction metadata, and 180-day Audit Standard retention.
→ Microsoft Copilot release notes — Generated-file sensitivity-label inheritance and recent feature changes.
→ Get ready for Copilot with SharePoint Advanced Management — DAG reports and SAM Copilot capabilities.
→ Purview Endpoint DLP — Device onboarding and browser-based AI service restrictions.
→ Endpoint DLP browser and domain restrictions — Edge native support, Chrome/Firefox extension requirements, and sensitive service domains.
→ Microsoft Purview Audit overview — Audit (Standard) and Audit (Premium) retention.
→ Insider Risk Management — AI-specific risk templates.
→ Communication Compliance — Detecting sensitive content in Copilot communications.
The Microsoft Learn references above reflect documentation current as of September 2026. Microsoft Purview capabilities, licensing, and Copilot integration features change — verify against the latest documentation and your tenant’s actual entitlement before deploying.
