Someone in your org typed “summarize the compensation review for the leadership team” into Copilot last Tuesday. Copilot didn’t hesitate. It found the spreadsheet — the one sitting in a SharePoint site that HR shared with “Everyone except external users” back in 2021 because that was faster than picking the right group — and it produced a tidy paragraph with names and numbers. No permission was violated. No alert fired. The file was technically accessible to that user the entire time. Copilot just made it findable in a way that manually browsing SharePoint never did.
That gap — between “technically permissioned” and “practically buried” — is the entire security model half of Microsoft 365 quietly ran on for a decade. Copilot deleted it. And Purview DSPM for AI is Microsoft’s admission that this is now your problem to see and fix, whether you asked for the visibility or not.
What actually turned on
Data Security Posture Management for AI lives in the Purview portal at purview.microsoft.com under its own DSPM for AI node. The freshest change is that the discovery and analytics layer now activates by default in tenants with the right licensing — you no longer have to opt into collecting AI interaction signals. Open the blade and you’ll likely find it already counting Copilot prompts, flagging which of them touched sensitive data, and ranking the sites feeding those responses.
Be precise about what “on by default” means, because Microsoft’s marketing blurs it. Three things happen automatically: interaction analytics start accumulating, the recommendations engine lights up with a to-do list, and the data risk assessment schedules a weekly scan. What does not happen automatically is any enforcement. No content gets restricted. No prompt gets blocked. The dashboard turns on; the seatbelts are still in the glovebox. That distinction is the whole post, so hold onto it.
The oversharing report is the part that ruins your afternoon
The centerpiece is the data risk assessment (it grew out of what used to be the standalone oversharing assessment). DSPM for AI runs one automatically against a sample of your most active sites and hands you a report that answers the question every CISO has been afraid to ask out loud: if every user pointed Copilot at everything they’re allowed to see, what leaks?
The default assessment covers a limited scope — typically the top sites by activity, not your entire tenant — which is worth knowing before you present the numbers as gospel. To get real coverage you create a custom assessment and scope it to the sites you actually care about. The report breaks down, per site:
- How many items are accessible to “Everyone except external users” (EEEU) or company-wide links — the two flavors of accidental broad access that Copilot loves
- How many of those items carry a sensitivity label versus how many are naked and unclassified
- How many contain sensitive information types (SITs) — credit cards, national IDs, that HR spreadsheet — regardless of label
- Which sites are the highest-risk contributors to potential Copilot oversharing
The unclassified number is the one that stings. Sensitivity labels are how downstream enforcement decides what to protect, and most tenants have labeled maybe a fraction of their content. Everything else is invisible to your policies and fully visible to Copilot. The assessment makes that ratio impossible to ignore, which is genuinely useful and genuinely uncomfortable.
The one-click policies, and what they really do
From the recommendations, DSPM for AI offers a few enforcement moves. They’re worth understanding individually because they behave very differently.
Restricted Content Discovery (RCD)
This is the surgical one. RCD tells Copilot and org-wide search to stop surfacing a site’s content without touching a single permission. Users who navigate directly to the site still get in; Copilot and search just pretend it isn’t there. It’s the pressure-release valve for a site you know is oversharing but can’t re-permission this quarter. You can flip it per site in the SharePoint admin center under SharePoint Advanced Management, or with PowerShell:
Set-SPOSite -Identity "https://contoso.sharepoint.com/sites/HR-Comp" -RestrictContentOrgWideSearch $trueThe honest caveat: RCD is a curtain, not a lock. The permissions are still wrong. Anyone who knows the URL still walks in. Treat it as containment while you fix the actual access model, not as the fix.
Restricted Access Control (RAC)
The heavier hammer. RAC limits a site’s access to a defined security group and blocks everyone else outright — permissions and all. This is for the sites that should never have been broad in the first place.
Set-SPOSite -Identity "https://contoso.sharepoint.com/sites/MnA-Deals" -RestrictedAccessControl $trueDLP for Microsoft 365 Copilot
You can now target Microsoft 365 Copilot as a DLP location. Create a policy that, when content carries a given sensitivity label, prevents Copilot from using it in summaries and responses. Pair it with sensitivity labels that apply encryption, and content labeled Highly Confidential stops feeding the model even if a user technically has read access. This is the closest thing to actual data-aware enforcement, and it’s why the “unclassified content” number in your assessment matters so much — no label, no DLP hook.
Prompt-level auditing: the receipts
Every Copilot interaction that touches sensitive data now lands in the audit log and surfaces in Activity Explorer inside DSPM for AI. You see the prompt, the response, the sensitive info types involved, and the user. That feeds three things worth wiring up:
- eDiscovery — Copilot prompts and responses are discoverable content now, stored in the user’s mailbox. Your legal team will eventually ask about this; better to know before they do.
- Communication Compliance — flag risky or inappropriate prompts to the model, the same way you monitor Teams messages.
- Insider Risk Management — correlate risky AI usage with a user’s broader risk signals, so the person exfiltrating data and the person interrogating Copilot about layoffs light up together.
One prerequisite people trip on: auditing has to be enabled and your audit retention has to actually cover the window you care about. Standard retention is short. If you want to investigate a prompt from four months ago, confirm your retention policy before you need it, not during the incident.
Why this beats the way you were doing it
Before this, “auditing Copilot exposure” meant exporting SharePoint permissions, wrestling Data Access Governance reports in the SharePoint admin center by hand, cross-referencing sensitivity labels in a separate Purview blade, and building your own mental model of what Copilot could reach. Three consoles, zero correlation, and no view of what users were actually asking. You were auditing capability in the dark and hoping.
DSPM for AI collapses that into one surface that ties potential exposure (the risk assessment) to actual behavior (the prompt audit) to remediation (the policies) in one place. That’s a real improvement, not a repackaging. The permission-report grind still exists underneath — DSPM for AI is a lens on top of SharePoint Advanced Management and Purview, not a replacement — but the correlation work that used to eat a week of an engineer’s time is now a dashboard.
What’s genuinely better commercially: Microsoft bundled SharePoint Advanced Management — which powers the data access governance reports, RCD, and RAC — into Microsoft 365 Copilot licensing at no extra cost. If you’re paying for Copilot, you already own the tooling to clean up after it. A lot of admins don’t realize they have it.
Where people get burned
A few things the getting-started wizard won’t warn you about:
- The default assessment is a sample, not the truth. Presenting the built-in weekly scan as full-tenant coverage will get you in trouble the day someone finds an overshared site it never scanned. Build custom assessments scoped to your real crown jewels.
- RCD hides, it doesn’t secure. If your remediation plan stops at Restricted Content Discovery, you’ve fixed the symptom Copilot exposed and left the disease. The site is still misconfigured.
- Unlabeled content is a blind spot for enforcement. DLP for Copilot keys off labels and SITs. If your labeling coverage is thin, your enforcement is thin, no matter how good the dashboard looks. Auto-labeling is the unglamorous prerequisite nobody budgets time for.
- Licensing is layered. The core DSPM for AI analytics have a free tier, but data risk assessments, DLP for Copilot, and the full audit integrations lean on Microsoft 365 E5 / E5 Compliance and SharePoint Advanced Management. Confirm what your enforcement moves actually require before you promise a remediation timeline.
- EEEU is the villain in almost every report. If you fix one thing, it’s the reflexive “Everyone except external users” sharing pattern. It’s the single biggest contributor to Copilot reach in most tenants.
Where this is heading
The direction is clear and you should plan for it: DSPM for AI is expanding past first-party Copilot. Coverage for third-party generative apps — ChatGPT, Gemini, and others — flows through the Purview browser extension and Edge integration, so the same prompt-and-sensitive-data telemetry applies to the AI tools your users adopted without asking you. The bigger frontier is agents: Copilot Studio agents and autonomous agents each carry their own identity and their own data reach, and governing what an agent can retrieve is the next version of this exact oversharing problem, one level of abstraction up. If you’re building agents on top of your SharePoint estate, the assessment you run today is the floor, not the ceiling.
Do this before your next Copilot expansion
Open DSPM for AI, read the default data risk assessment, then immediately build a custom one scoped to HR, Finance, Legal, and any M&A or board sites. Turn on RCD for the worst offenders as containment this week. Start driving down EEEU and company-wide links as the actual fix. Get a DLP-for-Copilot policy live against your Highly Confidential label, and confirm your audit retention covers the window your legal team will eventually ask about.
The uncomfortable truth this tool surfaces is that Copilot didn’t create your oversharing — it just stopped it from being a secret. The dashboard is finally honest. The question is whether you look at it before the next person types “summarize the layoff plan” and finds out you were, too.