Worth a direct correction before anything else: Purview’s job description changed meaningfully with the arrival of Copilot and enterprise AI adoption, in a way most overviews of it haven’t caught up to yet. This post skips the invented “a healthcare provider…” vignettes that usually pad this topic and goes straight to what Purview’s individual capabilities actually do, plus the one genuinely current addition worth knowing about specifically because of how much AI oversharing risk has become a real, current concern.
In this post: The core capabilities · DSPM for AI: the genuinely current addition · Compliance Manager and Audit · Where Purview genuinely struggles · Getting started without boiling the ocean · Related reading
The core capabilities
Worth being specific about what each piece actually does, rather than treating “Purview” as one undifferentiated product:
- Data Loss Prevention (DLP): detects patterns — credit card numbers, national ID formats, custom regex — in emails, Teams messages, and files, and can block, warn, or silently audit the action depending on the policy.
- Sensitivity labels: classify and, where the file format supports it, encrypt content directly, following the file wherever it’s copied or shared rather than staying tied to its original location.
- Retention policies and labels: enforce how long content has to be kept (legal/regulatory holds) or how long it can be kept before deletion, applied at the site, mailbox, or individual-item level.
- Insider Risk Management: correlates signals across a user’s activity (large downloads, unusual access patterns, resignation status) to flag genuine risk rather than relying on any single triggering event.
These four are the actual building blocks — most of what gets described as a single “Purview does data governance” pitch is really one or more of these four applied to a specific scenario.
DSPM for AI, generally available since June 2026, identifies oversharing risk in SharePoint and OneDrive specifically because Copilot can now surface that overshared content directly in a chat response — a genuinely new exposure path that didn’t exist before AI assistants could read across a tenant’s content on a user’s behalf.
DSPM for AI: the genuinely current addition
Worth knowing this exists as a real, current, GA capability rather than something still in preview: Data Security Posture Management (DSPM) for AI reached general availability in June 2026, purpose-built for a problem that’s specific to AI assistants rather than traditional data governance — Copilot can surface content a user technically has permission to see but was never realistically going to find on their own, which turns years of loose, over-broad sharing into an active exposure the moment someone asks Copilot the right question. DSPM for AI runs data risk assessments that specifically identify overshared SharePoint and OneDrive content before it becomes a Copilot response, offers ready-made DLP policies scoped to AI prompts and responses, and extends Audit, eDiscovery, and Data Lifecycle Management to Copilot-generated content itself, not just the source documents it draws from.
Worth watching for directly: Microsoft has confirmed Purview’s oversharing-risk visibility and Copilot DLP controls are being integrated straight into the Microsoft 365 admin center by October 2026, giving IT admins a single place to see exposure and act on it rather than needing to work across the separate Purview and admin center portals as two disconnected tools.
Compliance Manager and Audit
Compliance Manager scores an organization’s actual configuration against a chosen regulatory template (GDPR, HIPAA, ISO 27001, and others) and gives specific, actionable improvement items rather than a generic checklist — worth treating the resulting score as a live, changing number tied to real tenant configuration, not a one-time assessment. Purview Audit records activity across Exchange, SharePoint, Teams, and (per the DSPM for AI addition above) Copilot itself — worth confirming which audit retention tier a license actually includes before assuming a 12-month lookback is available, since the standard and premium audit tiers genuinely differ on retention length.
Where Purview genuinely struggles
Worth being honest about the real limitations rather than presenting this as a universal fit: coverage outside the Microsoft ecosystem is genuinely shallower than coverage inside it — third-party SaaS and non-Microsoft cloud platforms need Microsoft Defender for Cloud Apps or explicit connectors to get the same classification and DLP depth that’s native for SharePoint, Exchange, and Teams. Initial rollout is also genuinely non-trivial: a tenant with years of unmanaged, unclassified content needs a real discovery-and-classification project before policies can enforce anything meaningful, not a same-day configuration change. Licensing is the other real friction point — several of the capabilities described here (DSPM for AI and Insider Risk Management specifically) require E5 or E5 Compliance add-on licensing, not included in the base Microsoft 365 plans most organizations already have.
Getting started without boiling the ocean
- Run a data risk assessment (DSPM for AI, if licensed, or a standard Purview data estate scan otherwise) before writing a single enforcement policy — know what’s actually overshared before restricting it.
- Start DLP policies in audit-only mode, not block mode, for the first review cycle — a policy that blocks on day one with no tuning generates false positives that erode trust in the whole rollout before it has a chance to prove its value.
- Apply retention labels to the highest-risk content categories first (financial records, HR, legal) rather than attempting a tenant-wide retention scheme in one pass.
- Revisit Compliance Manager’s score periodically, not once — it reflects live configuration, and drift happens as new sites, teams, and sharing settings get created after the initial rollout.
Related reading
- What You Need to Know About SharePoint Administration — SharePoint Advanced Management’s oversharing (DAG) reports, the SharePoint-specific counterpart to DSPM for AI’s tenant-wide view.
- SharePoint Permissions: A Comprehensive Guide — the permission-model fundamentals that oversharing risk assessments are actually measuring.
Purview’s core building blocks — DLP, sensitivity labels, retention, insider risk — haven’t changed conceptually in years. What’s genuinely new, and worth prioritizing over a generic rollout of the basics, is DSPM for AI: the exposure Copilot creates for content that was already technically shared too broadly isn’t hypothetical, and it’s specifically what Microsoft built this capability to catch before an AI assistant surfaces it in a chat response.
App Catalog Authentication Automation Backup Compliance Content Type CSS Flows Google Javascript Limitations List Metadata MFA Microsoft Node NodeJs O365 OneDrive Permissions PnP PnPJS Policy PowerApps Power Automate PowerAutomate PowerPlatform PowerShell React ReactJs Rest API Rest Endpoint Security Send an HTTP Request to SharePoint SharePoint SharePoint List SharePoint Modern SharePoint Online SPFX SPO Sync Tags Teams Termstore Versioning