Skip to content

Control 1.6 — Portal Walkthrough: Microsoft Purview DSPM for AI

Control: 1.6 Microsoft Purview DSPM for AI Audience: M365 administrator (US financial services) Last UI Verified: April 2026 Cloud coverage: Commercial · GCC · GCC High · DoD (see sovereign cloud table below)

Sovereign cloud URLs and feature parity

Cloud Portal URL DSPM for AI (classic) Unified DSPM (preview) IRM-backed templates Adaptive Protection
Commercial https://purview.microsoft.com GA Preview (May 2026 GA expected, MC1191257) GA GA
GCC https://purview.microsoft.com GA Preview (commercial-first) GA GA
GCC High https://purview.microsoft.us GA (May 2025) Not GA as of April 2026 Limited (verify per workload) Not at parity
DoD https://purview.microsoft.us (DoD instance) GA (May 2025) Not GA as of April 2026 Limited (verify per workload) Not at parity

Verify your tenant's cloud before relying on preview features. Insider Risk Management is not at parity in US Government clouds — IRM-backed one-click templates may be unavailable.

Prerequisites & licensing matrix

Capability Required entitlement / configuration
Visibility of M365 Copilot interactions Microsoft 365 Copilot per-user license; Microsoft 365 E5 / E5 Compliance / Microsoft Purview Suite per monitored user
Coverage of non-Microsoft AI apps (ChatGPT Enterprise, Gemini, Foundry, Other) Purview pay-as-you-go (PAYG) billing linked to an Azure subscription
Long-term CopilotInteraction retention (>180 days) Audit (Premium) + retention policy — see Control 1.7
Endpoint AI signals Defender for Endpoint or standalone Purview device onboarding
Edge AI/DLP signal capture Microsoft Edge configuration policy (NOT browser extension)
Third-party AI (Chrome/Firefox, Windows-only) Microsoft Purview browser extension
Entra-registered AI apps / Foundry Microsoft Purview SDK integration

Roles required per Get Started step

Get Started step Role group(s) that can complete
Activate Audit Microsoft Exchange Organization Management or Exchange Compliance Management or Records Management — NOT Purview Compliance Admin alone
Install browser extension / configure Edge Endpoint admin (Intune) + Compliance Admin
Onboard devices Defender for Endpoint admin + Compliance Admin
Extend your insights Insider Risk Management role group (for IRM-backed templates) + Compliance Admin
Create one-click policies (DSPM Policies pane) Per-template — see control doc Roles & Responsibilities table

Least privilege: Avoid Global Admin where the workflow is achievable with Compliance Admin or a workload-specific role group. Tenant-restricted (administrative-unit-scoped) admins cannot create DSPM/DLP/IRM one-click policies as of April 2026.

Step-by-step walkthrough

Step 1 — Open DSPM for AI (classic)

  1. Sign in to your tenant cloud's Purview URL (see sovereign cloud table)
  2. Solutions > DSPM for AI (classic)
  3. Confirm the Overview page loads (this gates further role-related troubleshooting)

Step 2 — Complete Get Started · Activate Audit

Audit ingestion has been on by default in all new tenants since 2023. Detect first; only mutate if disabled. Verify state from Exchange Online PowerShell (Get-AdminAuditLogConfig.UnifiedAuditLogIngestionEnabled) — the value from Security & Compliance PowerShell (IPPS) is unreliable.

  1. Open Get Started > Step 1 (Activate Audit)
  2. If marked complete, capture screenshot for evidence and continue
  3. If incomplete, hand off to a holder of an Exchange role group (see table above)
  4. Cross-reference Control 1.7 portal walkthrough for the audit baseline

Step 3 — Get Started · Install browser support

  • Edge: push the Edge configuration policy via Intune (NOT the browser extension). Document policy ID + scope.
  • Chrome / Firefox (Windows only): push the Microsoft Purview browser extension via Intune
  • Capture per-device coverage report; sites or users without coverage will silently miss third-party AI events (silent-zero-row trap)

Step 4 — Get Started · Onboard devices

  • Confirm Defender for Endpoint or standalone onboarding state for in-scope devices
  • Export device inventory; reconcile to monitored-user list

Step 5 — Get Started · Extend your insights

  • Requires Insider Risk Management role group
  • Enables IRM-backed signals (Adaptive Protection, Risky AI usage)
  • Not available at parity in GCC High / DoD — record the exception in your Zone-3 register

Step 6 — Inventory & enable one-click policy templates

In DSPM for AI > Policies, the templates surfaced are named workflows, not generic solution categories. Pick by name from the list and confirm the underlying solution and role.

Template (portal label) Underlying solution Role to create Default scope
Detect risky AI usage in apps Insider Risk Management IRM role group All users
Detect risky interactions in AI apps Insider Risk Management (Risky AI usage) IRM role group All users
Detect sensitive info shared with AI via network Endpoint DLP DLP Compliance Admin All managed devices
Secure interactions for Microsoft Copilot experiences Collection / DLP for Copilot location DLP Compliance Admin M365 Copilot users
Capture interactions for Copilot experiences Collection policy (content capture) Compliance Admin M365 Copilot users
Capture interactions for enterprise AI apps Collection policy (content capture) Compliance Admin PAYG-billed AI apps
Discover and govern interactions with ChatGPT Enterprise AI Collection + extended insights Compliance Admin ChatGPT Enterprise tenant
Secure data in Azure AI apps and agents DLP / Purview SDK DLP Compliance Admin Azure AI / Foundry apps

Content capture must be explicitly enabled for any "Capture …" template — otherwise Activity Explorer rows appear but prompt/response content is not stored.

For each enabled template, record: name, mode (Enable / TestWithNotifications / TestWithoutNotifications / Disable / PendingDeletion), scope, exclusions, content-capture state, role used to create.

Step 7 — Reports

In DSPM for AI > Reports, capture timestamped exports for:

  • AI interactions over time (filter to in-scope user populations)
  • Sensitive info detected in prompts and responses
  • App / agent inventory

Allow up to 24 hours for new policies to surface in reports; allow up to 3 days for initial analytics.

Step 8 — Activity Explorer (deterministic interaction test)

Do not treat "table renders" as PASS. Generate a known interaction and assert the row exists.

  1. Pick a named user with M365 Copilot license
  2. At a recorded UTC timestamp, have them issue a known prompt (e.g., reference a labeled document)
  3. Wait the documented window (24 h baseline)
  4. In Activity Explorer, filter by user + activity type + UTC window
  5. Assert event count ≥ 1 with matching user / app / activity
  6. To view prompt/response content, the reviewer must hold Purview Data Security AI Content Viewer

Step 9 — Data risk assessments

  1. Confirm the Default Weekly Assessment is running (top 100 SharePoint sites by usage)
  2. For Zone 3 sites outside the top 100, queue Custom Site Assessments in a CAB-tracked register
  3. Initial results display: allow up to 4 days; refresh after a run: allow at least 48 hours
  4. Walk the four tabs: Overview · Identify · Protect · Monitor
  5. Capture Protect-tab oversharing list with site, sharing scope, sensitivity-label coverage, and remediation owner

Step 10 — Apps and agents inventory

In Apps and agents, export the inventory and reconcile to your CMDB / agent register (Control 1.4 / Control 2.16). Untagged or unknown apps are an N3.4 default-exclusion symptom — investigate before signing off.

DSPM (preview) — unified experience callout

The unified DSPM (preview) experience consolidating DSPM and DSPM for AI is rolling out per MC1191257 with GA expected May 2026 (Commercial / GCC). Specific UI affordances change frequently; verify against current Microsoft Learn (data-security-posture-management-learn-about) at each portal session and do not commit to specific widget names, dashboard digest schedules, or "Enhanced CSV" semantics in your evidence binder until they appear on Learn.

Evidence pack

Use a consistent file naming convention:

Control-1.6_{TenantId}_{Cloud}_{ArtifactType}_{YYYYMMDD-HHmm-UTC}.{ext}
Control-1.6_{TenantId}_{Cloud}_{ArtifactType}_{YYYYMMDD-HHmm-UTC}.{ext}.sha256
Artifact Source Format Frequency
Get Started step status screenshots DSPM for AI > Get Started PNG On change
Roles-by-step record Internal tracker JSON On change
One-click policy inventory (template, mode, scope, exclusions, content capture, owner) DSPM > Policies + Compliance portal JSON + CSV Weekly
Activity Explorer deterministic test result (user, prompt, UTC, event count) Activity Explorer + tester log CSV + log Weekly (Zone 3) / Monthly (Zone 2)
Weekly Risk Assessment summary Data risk assessments > export PDF + CSV Weekly
Custom assessment register (Zone 3 sites > top 100) Internal tracker CSV Quarterly review
Adaptive Protection threshold + IRM policy snapshot Insider Risk Management JSON On change
Tenant cloud + license entitlement snapshot Graph Get-MgSubscribedSku + per-user Get-MgUserLicenseDetail JSON Monthly

Store in immutable storage (Purview retention label, SharePoint hold, or WORM blob) aligned to Control 1.7 retention.

Cross-references

Updated: April 2026 | Version: v1.4.0 | UI Verification Status: Current (commercial); GCC High / DoD verified per cloud-availability table