Purview DSPM for AI: What It Shows About Copilot and ChatGPT Use

DSPM for AI is a solution inside the Microsoft Purview portal that reuses Purview's classification, labeling, DLP and audit signals and arranges them around AI use (Microsoft Learn, Learn how Microsoft Purview DSPM for AI provides data security and compliance protections for Copilots and other generative AI apps, checked October 2026). After about a day of data, the Reports page shows:

• Total interactions over time, split by AI app, so Microsoft 365 Copilot sits next to Copilot Studio agents and the third-party sites people visit.
• Sensitive interactions per AI app: prompts or responses that contained a sensitive information type or a labeled file, with the type named.
• Insider risk severity for the users behind the sensitive interactions, when an insider risk policy for AI is on.
• Unethical AI interactions, surfaced through communication compliance classifiers.

Selecting View details on any graph opens Activity explorer, where each record is one interaction: the user, the app, the time, the sensitive information types matched and, for Microsoft 365 Copilot and Copilot Studio agents, the prompt and response text Purview captured. An Apps and agents view lists every AI app and agent seen in the organization and, for each agent, the sensitive data it accessed and which Purview policies cover it. Microsoft labels these pages classic and is moving the same functions into a newer DSPM experience with an AI observability page, so report names differ between the two.

The fourth piece is data risk assessments: a scan of SharePoint sites for overshared content before Copilot or an agent can read it, the exposure our Copilot oversharing guide describes. Item-level scanning needs Microsoft Graph application permissions, which the setup wizard requests; the assessment finds the sites, and someone still has to change the sharing.

Coverage depends on where the AI app runs and what Purview can observe (Microsoft Learn, Considerations for deploying DSPM for AI, and Use Microsoft Purview to manage data security and compliance for other AI apps, checked October 2026).

Two limits follow. A personal phone on cellular data is invisible, so the controls are about managed devices. And for AI apps outside Microsoft 365, communication compliance and retention apply only through Edge and only to the apps Microsoft names: ChatGPT, the consumer Copilot, Google Gemini and DeepSeek. Our shadow AI guide covers the broader control model; the ChatGPT Enterprise connector is described in Copilot vs ChatGPT for a Microsoft 365 organization.

Prices are per user per month on an annual term, Commercial segment (Microsoft list price, October 2026 price list); the list carries annual figures, so the Purview Suite is $144.00 per user per year, and $144.00 ÷ 12 = $12.00.

Microsoft's DSPM documentation states the E5 or Purview Suite requirement (Microsoft Learn, Get started with Data Security Posture Management, checked October 2026), and its billing documentation states that AI apps other than Microsoft 365 Copilot require pay-as-you-go billing, with a meter per feature (Microsoft Learn, Learn about Microsoft Purview billing models, checked October 2026). The Business Premium add-on is newer and documented more thinly than E5, so ask your CSP to confirm DSPM for AI appears in your tenant on one seat before ordering a hundred. The meters appear on your own Azure bill; Azure rates sit outside the October 2026 price list, so none are quoted here.

The DSPM for AI Recommendations page offers preconfigured policies grouped by goal. Each creates an ordinary Purview policy you can later edit (Microsoft Learn, DSPM for AI, checked October 2026):

1. Capture Copilot prompts and responses. A collection policy that records Microsoft 365 Copilot interactions for audit, eDiscovery and the reports. Without it, the Copilot graphs stay empty.
2. Protect sensitive data referenced in Microsoft 365 Copilot. A DLP policy that blocks Copilot and agents from processing items carrying the sensitivity labels you pick, typically Highly Confidential.
3. Detect sensitive info shared in AI prompts in Edge. A DLP policy for Edge for Business that watches text typed or pasted into AI sites.
4. Detect sensitive info shared with AI via network. The network data security policy for devices, which sees AI traffic from any browser or app.
5. Block sensitive information from reaching AI sites. An endpoint DLP policy that warns or blocks uploads and pastes of sensitive content to the AI site list.
6. Detect risky AI usage. An insider risk management policy that scores users whose AI activity combines with other risk signals, which feeds the insider risk severity graph.

Turn them on in audit or warn mode first. The DLP policy for labeled content changes behavior immediately, so pick the label carefully; our first five DLP policies guide explains the warn-then-block sequence.

This is the sequence our Purview and Copilot engagements follow; it takes about two calendar weeks, most of it waiting for data.

If Copilot is the reason for the project, the data risk assessment on day 4 decides whether to proceed; it is the center of our Copilot readiness checklist.

Microsoft subscription prices are the customer's own (Microsoft list price, October 2026 price list, annual term, Commercial):

• 100 users on Microsoft 365 E3 ($39.00): add the Purview Suite at $12.00, 100 × $12.00 = $1,200.00 per month, $14,400.00 per year. Moving the same users to E5 at $60.00 costs 100 × $21.00 = $2,100.00 more per month and also brings the Defender suite and Entra ID P2; the E5 add-ons versus full E5 article does that comparison.
• 100 users on Business Premium ($22.00): the Purview Suite for Business Premium add-on at $10.00, 100 × $10.00 = $1,000.00 per month, $12,000.00 per year.
• Copilot for a 25-user pilot: 25 × $30.00 = $750.00 per month for Microsoft 365 Copilot, or 25 × $21.00 = $525.00 for Copilot Business on a Business plan.
• Pay-as-you-go meters for third-party AI apps: Microsoft's rate on your Azure bill; set the budget alert before turning them on.

IT Partner's fixed-price work is quoted in writing before work begins: the Microsoft 365 Copilot Readiness Assessment at $4,950.00 covers the data risk assessment, the licensing map and the policy plan; the Copilot Oversharing Assessment and Remediation at $4,950.00 per project changes the sharing the assessment flags; Configure and Enable DLP Policies at $8,000.00 builds the policy set; Microsoft Purview Data Governance for Microsoft 365 Copilot from $14,500.00 is the full labeling and remediation program for larger tenants.

What is DSPM for AI in Microsoft Purview?

Data Security Posture Management for AI is a solution in the Microsoft Purview portal that reports on how people use Microsoft 365 Copilot, Copilot Studio agents and other AI apps, flags prompts and responses that contain sensitive data, and offers one-click DLP, collection and insider risk policies to control that use.

What license do I need for DSPM for AI?

Microsoft 365 E5, or the Microsoft Purview Suite added to E3 or Office 365 E3, at $12.00 per user per month (Microsoft list price, October 2026 price list). Business Premium tenants use the Purview Suite for Microsoft 365 Business Premium add-on at $10.00. Seeing Copilot prompts also needs a Copilot license on the user.

Does DSPM for AI work with Microsoft 365 Business Premium?

Through the Purview Suite for Microsoft 365 Business Premium add-on, listed at $10.00 per user per month since 1 February 2026. Microsoft's documentation for the add-on is thinner than for E5, so confirm the solution appears in your tenant on one seat before buying for everyone.

Can Purview see ChatGPT usage?

Yes, in two ways. Visits to the public ChatGPT site from onboarded devices are reported through the Purview browser extension, and with Edge for Business the text pasted or uploaded is inspected. ChatGPT Enterprise can be connected as a data source so prompts and responses are audited; both routes bill on Purview's pay-as-you-go meters.

Does DSPM for AI block Copilot from reading sensitive files?

It offers a one-click DLP policy that stops Microsoft 365 Copilot and agents from processing items that carry the sensitivity labels you select. Files without a label are not affected, which is why labeling the sensitive sites comes before turning the policy on.

How long until the reports show data?

Microsoft says to wait at least a day after the policies are on. In practice a week of data is needed before the sensitive-interaction counts mean anything, and the insider risk severity view needs longer.

• Learn how Microsoft Purview Data Security Posture Management for AI provides data security and compliance protections for Copilots and other generative AI apps — Microsoft Learn, checked 2026-10-11
• Considerations for deploying Microsoft Purview Data Security Posture Management (DSPM) for AI — Microsoft Learn, checked 2026-10-11
• Use Microsoft Purview to manage data security and compliance for other AI apps — Microsoft Learn, checked 2026-10-11
• Use Microsoft Purview to manage data security and compliance for Microsoft 365 Copilot and Microsoft 365 Copilot Chat — Microsoft Learn, checked 2026-10-11
• Get started with Data Security Posture Management — Microsoft Learn, checked 2026-10-11
• Learn about Microsoft Purview billing models — Microsoft Learn, checked 2026-10-11
• View Copilot Studio audit logs in Purview — Microsoft Learn, checked 2026-10-11
• Learn about Data Loss Prevention for Cloud Apps in Edge for Business — Microsoft Learn, checked 2026-10-11
• Use Microsoft Purview to manage data security and compliance for ChatGPT Enterprise — Microsoft Learn, checked 2026-10-11
• Microsoft US Commercial price list, October 2026: Microsoft 365 E5, Microsoft Purview Suite, Microsoft Purview Suite for Microsoft 365 Business Premium, Microsoft Purview Suite Add-on FLW, Microsoft 365 Copilot, Microsoft 365 Copilot Business