Microsoft Purview: AI data controls for Microsoft 365 companies

Contents

1. What Purview does for an AI policy
2. Strengths and limits
3. Pricing
4. Questions to ask Microsoft or your partner
5. Sources

Type	Data security and compliance suite
Headquarters	Redmond, Washington, US
Pricing	Not published
Website	learn.microsoft.com

Microsoft Purview is Microsoft's data security and compliance suite. Its Data Security Posture Management for AI is the most direct way for a Microsoft 365 company to enforce the data rules of an AI policy⁠1Learn about Data Security Posture Management for AI (classic)Microsoft Learn · 15 Dec 2025.

Best for: Microsoft 365 companies that need to see and limit what sensitive data reaches Copilot, agents and outside AI sites.

Not the right fit for: Companies outside Microsoft 365, or buyers that need approval rules for actions an agent takes in a business system.

What Purview does for an AI policy

DSPM for AI provides insight into AI activity, ready-to-use policies against data loss in AI prompts, data risk assessments for oversharing and compliance controls. It covers Microsoft Copilots, agents and AI apps that use third-party models, and Microsoft lists supported third-party AI sites, including those used for Gemini and ChatGPT⁠1Learn about Data Security Posture Management for AI (classic)Microsoft Learn · 15 Dec 2025.

In practice, an administrator can activate one-click policies, run a weekly oversharing assessment of the 100 most-used SharePoint sites, use data loss prevention to stop Copilot and agents summarising content with chosen sensitivity labels, and review AI interactions, including prompts and responses for users with the right permissions, in Activity explorer⁠1Learn about Data Security Posture Management for AI (classic)Microsoft Learn · 15 Dec 2025. That maps to clauses 6 (data rules) and 15 (records) of our template.

Two cautions. Coverage of third-party AI sites requires the Purview browser extension and onboarded devices, and Microsoft notes that the classic DSPM for AI is being replaced by a new version⁠1Learn about Data Security Posture Management for AI (classic)Microsoft Learn · 15 Dec 2025. Microsoft directs buyers to Microsoft 365 E5, the Purview Suite or pay-as-you-go options for licensing⁠2Microsoft PurviewMicrosoft.

Strengths and limits

Strengths

• Data loss prevention can stop Microsoft 365 Copilot and agents from summarising content that carries selected sensitivity labels.
• Activity explorer records AI interactions, including prompts and responses for users with the right permissions.
• Detects sensitive information sent to supported third-party AI sites, through a browser extension and device onboarding.
• Links to Compliance Manager templates that map controls to AI regulations.

Limits

• Third-party AI coverage requires the Purview browser extension and onboarded devices.
• Microsoft notes the classic DSPM for AI is being replaced by a new version, so set-up guidance is changing.
• Licensing runs through Microsoft 365 E5, the Purview Suite or pay-as-you-go options; the product pages we read do not list prices.

Choose another option if: Your company runs on Google Workspace, or your main risk is what an AI agent does rather than what data it sees.

Pricing

Not published on the pages we read. Microsoft points buyers to Microsoft 365 E5, the Purview Suite or pay-as-you-go options.

Questions to ask Microsoft or your partner

• Which DSPM for AI features are included in our current licences, and which need E5, the Purview Suite or pay-as-you-go?
• Which of the AI tools our staff use are on the supported third-party list?
• How long are AI prompts and responses retained, and who can read them?
• What changes when we move from the classic to the new DSPM?

See how Microsoft Purview compares with the other tools in the main guide.

Sources

1. Learn about Data Security Posture Management for AI (classic). Microsoft Learn, 15 Dec 2025. Accessed 8 Nov 2026.
2. Microsoft Purview. Microsoft. Accessed 8 Nov 2026.

Further reading

• Template and buyer's guide · Updated quarterlyA free AI policy template for companies, and the tools that enforce itA complete AI use policy that a company can adopt this month, the regulation each clause answers to, and a sourced comparison of the tools that make it hold in daily work.
• Guide · The templateHow to adapt an AI policy template to your companyA template saves the drafting, not the decisions. These are the decisions behind each clause, and the variations that matter for small firms, regulated firms and companies in the EU.
• Guide · Acceptable useAI acceptable use and approvals: what AI may do aloneThe hardest clause in an AI policy is the one about actions. A department-by-department table of what AI may do alone, what needs a person's approval and what it must never do.