"How are you handling AI data leakage?"
"We're using Microsoft Purview."
We're hearing this a lot from folks in security, which isn't surprising. Purview is helpful for managing AI data leakage, especially if you're a Microsoft shop.
But whether Purview can manage all the avenues around AI data leakage depends on two things most security teams haven't actually checked: how much of Microsoft's deployment model is running end to end, and which AI surfaces are being covered.
Where Purview helps with DLP
If you're a Microsoft shop, Purview is a very useful part of an AI governance stack. It applies sensitivity labels to content, flags oversharing through data security posture management, and — with the right licensing — extends data loss prevention into Copilot prompts and responses (Microsoft Learn; Microsoft Security). In theory, if someone tries to get Copilot to surface a labeled "Highly Confidential" file it shouldn't; Purview controls should limit that data leakage.
But Purview alone isn't enough for DLP
Unfortunately, Purview is just one piece of Microsoft's own published AI governance model. It was never meant to do it all.
Microsoft's documented approach to securing AI runs through four services working together — Purview, Defender for Cloud Apps, Entra, and Intune — across a sequence of steps that starts with discovery and ends with active enforcement across every managed endpoint (Microsoft Security). Microsoft lays this out as a four-step deployment path: discover AI apps in use, block unsanctioned ones, block sensitive data going to sanctioned ones, then govern data sent to AI apps (Microsoft Purview deployment guide).
Discovery is largely automated, which can be very helpful. But the remaining steps require deploying Defender for Cloud Apps policies, tightening Entra conditional access, and pushing Intune configurations to every device in the fleet. That's a project most environments have started but few have finished.
"We have Purview" usually means "we have Purview enabled." It rarely means the full four-service sequence is running end to end.
Purview's AI controls are built for Microsoft's AI
There's a second, narrower catch. Purview's data loss prevention for AI is built around Copilot and Copilot Chat — it governs what happens inside Microsoft's own assistant (Microsoft Learn).
Protecting data going into third-party AI tools — ChatGPT, Gemini, Claude, and new AI tools you haven't heard of but that your workforce has already adopted — depends entirely on that extension being deployed everywhere, on top of the four-service sequence already in play. A rollout that misses even a slice of endpoints leaves a gap that data can leak through. And the gap isn't only about missed devices: for Chrome, Microsoft's Purview extension guidance states that Incognito mode isn't supported and must be disabled. An employee who opens a private tab to paste data into any AI tool — sanctioned or not — is browsing in a mode Microsoft's own guidance says the control can't reliably reach unless incognito mode itself has been separately locked down (Microsoft Purview extension for Chrome).
Key takeaway: Purview's AI-specific DLP protects what happens inside Copilot. Coverage for every other AI tool or browser your workforce uses depends on a separate, frequently incomplete deployment step.
Even Microsoft's newest AI surface has gaps Purview doesn't close
If the scope and execution gaps above sound like edge cases that get fixed with time, consider where Microsoft's own newest agentic AI surfaces stand today. Microsoft's own documentation and a recent TechTarget analysis show why that boundary matters.
First, Microsoft's baseline enterprise data protection guarantees — the assurance that prompts and data stay inside the tenant boundary — are defined specifically for Microsoft 365 Copilot and Copilot Chat. Microsoft's guidance goes further: it tells administrators to check the privacy statement and terms of use of any agent used within Copilot, because those agents are individually governed by their own data-handling terms and don't automatically inherit Copilot's protections (Microsoft Learn). Scout, Microsoft's newer autonomous agent, executes tasks locally on the device rather than in the tenant, controls the browser and shell, and inherits its model catalog from GitHub Copilot — which admins configure and which can include third-party and open-source models (Microsoft Scout FAQ; Microsoft 365 Blog). That's not the same data flow, and not the same visibility boundary, that enterprise data protection was built around.
Second, Copilot Studio agents default to requiring Microsoft authentication, but the person who creates an agent can switch that setting to "No authentication" at any time. Once they do, the agent is reachable by anyone holding the URL (Microsoft Copilot Studio). That's a self-service configuration change, not a data movement event — and Purview's DLP model is built to watch data leaving the tenant, not settings being flipped inside it. A policy engine designed to catch a file upload has no reason to fire when an access control gets toggled. (Admins can constrain which authentication methods makers may choose through the Power Platform admin center (Microsoft Learn), but that control must be actively configured.)
Both of these are Microsoft's own documented scope and their own product behavior. Don't you love it when you're told, "it's a feature, not a bug?"
What actually closes the AI data leakage gap
Purview is good as a Microsoft-ecosystem tool, doing Microsoft-ecosystem things. For the slice of risk that Purview was built to cover — Copilot and Copilot Chat, inside a fully deployed four-service stack — you can make a serious dent in managing AI data leakage.
But the shadow AI gap is a visibility problem, and closing it means seeing AI activity continuously across the most accessed applications and services. For most enterprises, that's via the browser (recent research showed that 93.4% of the workforce does their work primarily through the browser).
Before your next shadow AI and data leakage conversation, it's worth pulling up your Microsoft deployment sequence and checking how much of the deployment your organization has actually finished rolling out. For most teams, there's a gap that is letting data leak out of the company.
FAQs
Does Microsoft Purview stop employees from leaking data to AI tools like ChatGPT?
Not entirely. Purview's AI-specific data loss prevention is built for Copilot and Copilot Chat (Microsoft Learn). Coverage for other AI tools depends on a separate Endpoint DLP and browser extension deployment, which needs to reach every device to work.
What is Microsoft's full governance model for securing AI?
Microsoft's published model runs four services together — Purview, Defender for Cloud Apps, Entra, and Intune — across a sequence from discovery through enforcement (Microsoft Security). Most organizations complete discovery but not the full sequence.
Does Purview's DLP protection work in Incognito or InPrivate browser windows?
Not by default. Chromium-based DLP extensions are disabled in Incognito and InPrivate windows unless an organization has separately locked that mode down, which leaves private browsing sessions outside the control's reach (Microsoft Purview extension for Chrome).
Are Microsoft's newest Copilot agents covered by the same data protections as Copilot itself?
Not automatically. Microsoft's enterprise data protection guarantees are defined for Microsoft 365 Copilot and Copilot Chat specifically (Microsoft Learn; TechTarget). Microsoft's own guidance tells administrators to check each agent's data handling terms separately, since those protections aren't inherited automatically — and newer agents like Scout run tasks locally and switch models in ways that shift the visibility boundary (Microsoft Scout FAQ).
Can a Copilot Studio agent be made public without triggering a security alert?
Yes. An agent's creator can switch its authentication setting from "Authenticate with Microsoft" to "No authentication" at any time, making it reachable by anyone with the link (Microsoft Copilot Studio). That's a configuration change, not a data transfer, so DLP policies built to catch data leaving the tenant don't catch it.
If Purview has real gaps, what should security teams do instead?
Keep Purview for the Microsoft-native workflows it covers well. Close the rest of the gap with continuous, tool-agnostic visibility into AI activity wherever it happens — for most enterprises, that's the browser.