DSPM for AI: what it shows, and what it cannot see

DSPM for AI is the part of Microsoft Purview that shows how people in your organisation use AI, and what sensitive data goes into it. It is genuinely useful, and it is often switched on as a readiness check. That is where the trouble starts, because DSPM for AI reports what AI touched. It does not report everything AI could reach.

An empty dashboard is evidence that the dashboard has limited coverage. It is not evidence of a clean estate. This article sets out what DSPM for AI needs, what each licence lets you see, what it costs beyond the licence, and what it cannot show however it is configured.

The short answer, as Microsoft’s documentation stands on 11 November 2026: DSPM for AI now lives inside a single Microsoft Purview Data Security Posture Management (DSPM) solution, generally available since May 2026. It records Copilot and agent activity once auditing and Copilot licences are in place. It reaches ChatGPT and other third-party AI sites used in a browser only through onboarded devices and the Purview browser extension, or through Edge or a network integration, and that coverage is billed pay-as-you-go. Its data risk assessments start from the 100 most-used SharePoint sites, its item-level scan looks for sharing links rather than membership, and nobody reads prompt text without a dedicated role. Microsoft’s licence comparison no longer breaks DSPM down by licence, so the licensing section below is rebuilt from Microsoft’s current pages.

DSPM for AI is now part of DSPM

First, a naming point that confuses most conversations about it. Microsoft has folded DSPM for AI into a single Data Security Posture Management experience. In Microsoft’s words, the two “have converged into a single, central solution”, and the new DSPM became generally available in May 2026. The earlier pages are now labelled classic, and Microsoft states that “These improvements won’t be added to this classic version.”

In the Purview portal the new version sits under Solutions, then DSPM. Microsoft’s DSPM overview says most new features will be added to it only, although the classic versions can still be opened. The pages that matter for AI are:

• AI observability, an inventory of AI apps and agents with activity in the last 30 days, including Microsoft Agent 365;
• Apps and agents, with detail on the sensitive data accessed by the 20 most recently used agents;
• Activity explorer, whose AI activities tab shows prompts, responses and policy matches;
• Data risk assessments, under Discover, which are Microsoft’s oversharing checks;
• Remediation actions, which lists automatic policies, most of them carried over from DSPM for AI.

Two parts of the new DSPM were still in preview when it became generally available, according to Microsoft’s Purview release notes: connections to partner solutions for non-Microsoft data sources, and the Data Security Posture Agent.

Microsoft has also renamed Microsoft 365 Copilot to Microsoft Copilot, and Copilot Chat with it. Purview’s DSPM pages still use the old names throughout, and Purview lists the consumer version of Microsoft Copilot among its “other AI apps”, next to ChatGPT and Gemini. In the portal the same name can therefore mean two different products for a while. This article says Copilot for the work product.

What it needs before it shows anything

The prerequisites look short: “a supporting license for this Microsoft Purview solution”, Copilot licences for the users, and Purview auditing switched on. For AI tools other than Microsoft’s own, the list is longer. Devices have to be onboarded to Purview, the Purview browser extension “deployed to Windows users”, an Edge configuration policy in place, and pay-as-you-go billing switched on. Several of Microsoft’s own AI tools, Security Copilot and Copilot in Fabric among them, need the billing too.

That last group is where coverage quietly narrows. Microsoft’s documentation for other AI apps says most of what Purview offers for ChatGPT and similar tools needs the browser extension and devices onboarded to Purview. The exceptions are browser data security inside Edge, and network data security, which inspects traffic through a Secure Access Service Edge or Security Service Edge integration and has been generally available through Microsoft Entra Global Secure Access since September 2026. A user on an unmanaged personal laptop or phone that neither integration reaches is outside it. Even where it does reach, the same documentation notes that sensitivity labels are not supported for these apps, and that Communication Compliance is restricted to the Edge browser.

What DSPM for AI covers: Copilot, agents and other AI apps

Microsoft’s overview of Purview for AI apps sorts the AI apps Purview supports into three groups, and what it takes to see each one differs.

Agents follow their parent app. Microsoft’s page on AI agents says they “typically have the same security and compliance protections for AI interactions as their parent AI app”, so a Copilot Studio agent normally gets Copilot Studio’s coverage and a Foundry agent gets Foundry’s. Three cases differ. Microsoft Agent 365 agents are handled like users: each agent instance is audited automatically, you add it to policies as you would a user, and only the new DSPM shows them, on its AI observability page. Anthropic Claude agents are not supported yet, so they do not appear there at all. ChatGPT Enterprise agents get only data classification and Insider Risk Management, without the audit, eDiscovery and retention coverage that ChatGPT Enterprise itself has.

Agents built in Copilot Studio and published outside Microsoft’s own channels bring pay-as-you-go billing into what looks like an all-Microsoft deployment. What those agents cost to run is a separate question, covered in our article on Copilot Studio licensing.

What each licence lets you see

This is the part that most often surprises a CFO. Until recently, Microsoft’s Copilot licence feature overview split DSPM for AI by licence, and the first version of this article cited it. That address now redirects to Compare Copilot in E3, E5, and E7, dated 28 October 2026, which describes Purview only in broad terms and no longer lists DSPM features. Read together with the Microsoft Purview service description, updated on 9 November 2026, Microsoft’s current pages say this:

Microsoft does not say whether the E5 rule for activity explorer applies inside DSPM, and the comparison page itself warns that “Licensing availability and product terms can change.” Check the product terms before the budget is signed.

In plain terms, E3 records that Copilot is being used and where, in the audit log. E5 shows what was actually said. When Microsoft launched the new DSPM, it described it as “available for customers with Microsoft 365 E5 and E5 Compliance licenses”. If the business case for Copilot assumed that seeing what goes into it comes free with the seat, it is short. The wider licensing picture, including what E7 bundles, is in our E7 and Copilot licensing article.

What it costs beyond the licence

Some of DSPM’s coverage is metered rather than licensed. Pay-as-you-go billing has to be linked to an active Azure subscription. Microsoft states that Copilot experiences in Microsoft 365 are not charged, but activity from other AI apps is. On Microsoft’s Purview pricing page, auditing that activity is “$15 per 1M records ingested”. The same page prices other compliance work on those interactions: retention at the equivalent of $6 per million messages a month, and eDiscovery storage at the equivalent of $20 per GB a month. Security Copilot, Copilot in Fabric, Copilot Studio agents published to non-Microsoft channels, ChatGPT Enterprise, Anthropic Claude, Entra-registered AI apps and policies for Microsoft Foundry all need the same billing switched on.

The data risk assessment also offers an on-demand classification scan, which is billed per item scanned, with an estimate shown before it runs. That makes it a metered button inside a report that otherwise looks free. None of these costs is large on its own. Together they mean DSPM for AI is a recurring cost to budget, not a switch.

Microsoft’s on-demand classification page adds two details for whoever approves the spend: classification can start up to 30 days after the estimate, and the final bill can come in under it when items are skipped.

One click changes the tenant, not just the report

DSPM for AI offers one-click policies, and they are the fastest way to get data flowing. They are also more than reporting. According to Microsoft’s documentation, enabling them can:

• create a DLP policy for sensitive information going to AI sites, which runs “in audit mode only”;
• turn on Adaptive Protection “using default risk levels for all users and groups” if it is not already on;
• block users in the Edge policies from “unprotected browsers”.

Each of those is a decision with operational consequences. Blocking other browsers for a population that relies on Chrome will reach the service desk on the first morning. Switch them on deliberately, with someone accountable for each one, rather than as part of a dashboard set-up.

In the new DSPM these policies are offered from the security objectives and from Tasks and actions, then Remediation actions, and Microsoft notes that most of the policies listed there originate from DSPM for AI. Because they apply to all users, only an unrestricted administrator can create them, which in a tenant with administrative units narrows who can switch them on.

What DSPM for AI cannot see

Four limits matter more than the rest, because each makes the dashboard look cleaner than the estate is.

It starts from the most-used sites. The default data risk assessment covers the most-used SharePoint sites, as we set out in what Purview can and cannot stop Copilot doing. Microsoft puts that at the top 100 sites by usage, assessed weekly, with a four-day wait for the first results. Low-traffic repositories that are open to the whole organisation are exactly the ones that sit outside that starting point.

Its item-level oversharing scan looks for links, not membership. Microsoft’s oversharing documentation says items are flagged “if they have a sharing link for external or anonymous users”. A library shared to everyone through its site membership has no such link. That is the most common way content becomes readable to the whole organisation, and the scan is not built to see it. Item-level scanning is also capped at 10 SharePoint sites, and OneDrive is not supported. The SharePoint reports that do look at membership, and the controls that fix what they find, are covered in Copilot data readiness.

It looks back 30 days. Activity explorer reports on up to 30 days of data, and the AI observability inventory uses the same 30-day window. Processing pauses if nobody opens DSPM for more than 60 days, so a dashboard switched on and left alone eventually stops refreshing its Microsoft 365 data, until an administrator returns.

It needs the right role to read prompts. None of the default admin roles can see prompt text. That takes a separate content viewer role, such as “Microsoft Purview Data Security AI Content Viewer”. Who holds it is a decision for HR, legal and, in many organisations, a works council, before any prompt is captured.

Our position: it shows activity and selected risks, not readiness

In our view DSPM for AI should be switched on with the first Copilot licence and never presented as the readiness result. It shows recorded AI activity and selected exposure risks. It is not, by itself, proof that every sensitive location and permission path has been assessed, and that is the question a board actually means when it asks whether Copilot is safe.

Two corollaries follow. Budget it in layers, not as one switch: E3 records that Copilot is in use, in the audit log, E5 shows what was said, and E7 adds wider exposure visibility and protection for agents. Pay-as-you-go is not a tier but metered billing on top, for most AI apps other than Copilot itself, and for on-demand scans. And decide who may read prompts before you start capturing them, because once the data exists, the question of who can see it arrives whether or not anyone planned for it.

Usage does not equal sensitivity, which is why a usage-based assessment should not replace a review of permissions on sensitive data. Over-permissioning is the single most common finding in the tenant assessments we run before a rollout, and the item-level scan is not built to find the kind that comes through site membership.

Where to start

1. Run the permission review first, using the readiness checks, so the dashboard has something to be measured against.
2. Decide which licence tier you need to see prompts, and put the pay-as-you-go meters in the budget.
3. Name who may hold the content viewer role before switching on collection.
4. Enable one-click policies one at a time, with an owner for each, and pair the DLP side with a proper policy design.

Veratas deploys Microsoft Purview for organisations rolling out Copilot, from the permission review through to the policies that act on what DSPM finds. If you have switched DSPM for AI on and want to know what it is not telling you, talk to our team.

Frequently asked questions

What is DSPM for AI? It is the part of Microsoft Purview that shows how AI apps and agents are used in your organisation and what sensitive data goes into them. Microsoft has folded it into a single Data Security Posture Management experience, generally available since May 2026, and the separate DSPM for AI pages are now labelled classic.

What licence does DSPM for AI need? Microsoft no longer publishes a DSPM breakdown by licence. Its current pages give E3 core Purview capabilities and standard audit of Copilot interactions, and put the content and activity explorer interfaces in E5. When Microsoft announced the new DSPM, it said it would be available for E5 and E5 Compliance customers. E7 adds agent-focused governance, and visibility of Copilot and agent activity in audit and eDiscovery. Coverage of non-Microsoft AI apps also needs pay-as-you-go billing.

Does DSPM for AI cover agents, ChatGPT and other AI tools? Partly. Agents generally get the coverage of the app they were built in. Agent 365 agents appear only in the new DSPM, on its AI observability page; Anthropic Claude agents are not supported, and ChatGPT Enterprise agents only partly. ChatGPT and other browser-based AI tools need onboarded devices and the Purview browser extension, or the Edge or network integrations, plus pay-as-you-go billing. Unmanaged devices outside those integrations are not covered.

Does an empty DSPM dashboard mean our data is safe for Copilot? No. It reports recent AI activity and starts from the most-used sites, and its item-level oversharing scan looks for external or anonymous sharing links rather than broad site membership. A clean dashboard shows limited coverage, not a clean estate.

Who can see the prompts people type? Only users given a content viewer role, such as Microsoft Purview Data Security AI Content Viewer. None of the default admin roles can. Decide who holds it before capturing prompts.

Manish Kumar

Senior Business Intelligence Architect with 22 years of experience designing enterprise analytics and data platforms. Focus areas include Power BI, real-time analytics, and large-scale BI architecture across the Microsoft data stack.