30 October 2026
AI has given your data new ways out. Here's how Microsoft Purview closes them
A simple question that very few organisations can answer with confidence: if someone pasted your client list into a public AI tool this afternoon, would you know?
For most businesses, the honest answer is no. And that's a newer version of an old problem.
The old exits are still open
Sensitive data has always found its way out through email attachments, Teams chats, USB sticks and personal cloud storage. Usually nobody means any harm. Someone wants to work from home, or send a file to their personal email account to print it. But in most organisations nothing is in place to see it happen, let alone stop it.
AI has added two more
The first is inside your tenant. Microsoft 365 Copilot only shows people what they already have permission to see. That's the right design. But it means every overshared SharePoint site, every "Everyone" link and every Teams channel nobody tidied up is now one prompt away from the wrong person. Files that were safe because nobody knew where to look are now easy to find.
The second is outside it. When someone pastes a spreadsheet or a draft contract into a public AI tool to save ten minutes, that data has left your controls entirely. There's usually no record it happened.
The Microsoft Purview controls that close them
Microsoft Purview is Microsoft's data security and compliance platform, and it's built for exactly this.
Sensitivity labels mark what's confidential, so the protection travels with the file wherever it goes, including into Copilot responses.
Data loss prevention (DLP) warns people, or blocks them, when sensitive information heads somewhere it shouldn't: an external email, a shared link, or a paste into an AI site on a managed device.
Data Security Posture Management (DSPM) for AI shows how Copilot and other AI apps are being used with your data, and where sensitive information is turning up in prompts.
Insider Risk Management flags the patterns that tend to come before a leak, like a mass download the week before someone resigns.
Retention policies make sure you're not holding personal data longer than you're allowed to.
What's probably already in your licence
This is where most organisations are surprised. Some of these controls are already in the Microsoft 365 licence you pay for and have simply never been configured. Others need an upgrade or add-on.
| Purview control | Microsoft 365 Business Premium / E3 | Microsoft 365 E5 or add-on |
|---|---|---|
| Sensitivity labels, applied manually | Included | Included |
| Sensitivity labels, applied automatically | Not included | Included |
| DLP for Exchange, SharePoint and OneDrive | Included | Included |
| DLP on devices, including AI sites in the browser | Not included | Included |
| Retention policies | Included | Included |
| Insider Risk Management | Not included | Included |
Licensing changes often, and some DSPM for AI features are billed on usage. We'll confirm exactly what applies to your tenant in the review.
Why it matters now
Three things have raised the stakes this year. Copilot rollouts are putting overshared files in front of more people. Most of the Data (Use and Access) Act came into force in February 2026, giving the ICO new powers to require technical reports and compel interviews (ICO statement, National Law Review). And cyber insurers are asking harder questions at renewal. "We've got a policy document" is no longer a strong answer.
What a Purview Gap Review tells you
We'll look at your Microsoft 365 tenant and come back with three answers:
- What you're licensed for. Which Purview controls you already pay for.
- What's actually switched on. Which of those are configured, and which are sitting idle.
- Where your exposure sits. The gaps that matter most, including Copilot and AI, and what to fix first.