Govern Microsoft 365 Copilot with Purview DSPM: Stop Oversharing Before You Deploy

Copilot does not break your permissions. It exposes them. Every "why did Copilot just show me the redundancy plan?" incident traces back to a SharePoint site that was already overshared — Copilot just made it findable in plain English. This is a walkthrough of the actual Microsoft Purview and SharePoint controls that fix this, in the order a security team should apply them, with licence and GA/preview status validated against Microsoft Learn in August 2026. It is the governance companion to our overview of what Copilot, Cowork and Work IQ actually do.

Does Copilot respect permissions?

Yes — and that is exactly the problem. Microsoft 365 Copilot grounds its answers in the Microsoft Graph and the semantic index, and every Graph query is scoped to the signed-in user's existing permissions. If a user cannot open a file through normal access, Copilot cannot summarise it for them. Copilot never elevates its own access.

The exposure comes from what users can technically reach but never realised they could. A decade of "share with Everyone except external users" (EEEU), stale "Anyone" links, and abandoned project sites means the average tenant grants far broader access than anyone intends. Copilot removes the friction — the need to know which site to navigate to — that was quietly doing your access-control job for you. That is why a Copilot rollout without a permissions clean-up is a Copilot rollout with predictable oversharing incidents.

One nuance for encrypted content: where a sensitivity label applies encryption, the user must hold both the VIEW and EXTRACT usage rights before Copilot will return the content. A user with VIEW but not EXTRACT cannot use Copilot on that item — Copilot will reference it with a link but not summarise it. S/MIME-protected mail is not returned at all, and password-protected documents are inaccessible unless the user already has them open.

What is Purview DSPM for AI and what does it show?

Microsoft Purview Data Security Posture Management (DSPM) for AI is the discovery and monitoring hub for AI-related data risk. It surfaces which AI tools are in use (Microsoft 365 Copilot, Copilot agents, and non-Microsoft generative AI), the prompts and responses in Copilot interactions, the sensitive information types referenced in those interactions, and oversharing reports (data risk assessments) that flag SharePoint sites with overly permissive access.

Two things to know as of mid-2026:

• The original DSPM for AI (formerly "AI Hub") reached general availability at Microsoft Ignite in November 2024.
• Microsoft has merged DSPM and DSPM for AI into a single unified DSPM experience, now under Solutions > DSPM in the Purview portal. The older experiences still exist as Data Security Posture Management (classic) and DSPM for AI (classic) and still work, but new features land only in the unified version, and Microsoft's in-product notice sets a sunset for the classic experiences in late September 2026. Verify the exact labels and date in your own tenant, because this navigation changed recently.

DSPM for AI automatically runs a weekly data risk assessment for the top 100 SharePoint sites by usage, and you can run custom assessments against specific users or sites. This is where you start — it tells you where to spend effort.

What licence do I need for DSPM for AI?

The marketing pages get vague here, so be precise. Reconciling Microsoft's own E3/E5/E7 feature comparison:

• Microsoft 365 E3 gets a reduced experience: view AI app info, export activity, and turn on auditing.
• Microsoft 365 E5 / E5 Compliance adds the ability to view prompt and response content and the full data-risk-assessment and one-click-policy experience.
• Monitoring actual Copilot prompts and responses requires Microsoft 365 Copilot licences and Purview auditing enabled.
• Monitoring third-party / non-Microsoft AI apps requires device onboarding to Purview (and, for some capture scenarios, pay-as-you-go billing).
• Governing Copilot agents (DSPM AI observability and IRM for agents) leans toward Microsoft 365 E7 / Agent 365.

Microsoft's licensing guidance carries a "for guidance only, no contractual commitment" disclaimer. For anything you will defend in an audit, check the Microsoft Purview service description and your own Product Terms. (For the broader tier picture, see our E3 vs E5 vs E7 comparison.)

How do I stop Copilot oversharing? The controls that matter

There are two distinct layers, and conflating them is the most common mistake:

• SharePoint Advanced Management (SAM) controls discoverability and access at the site level.
• Microsoft Purview controls classification and processing at the content level.

Neither one fixes bad permissions on its own — they surface and contain the problem while you remediate the underlying access.

SharePoint Advanced Management (SAM)

• Data Access Governance (DAG) reports (SharePoint admin center → Reports → Data access governance) flag sites with the most sharing links, content shared with "Everyone except external users," and sites holding sensitive/labelled content, based on the last 28 days of activity. There is a "Get AI insights" button to prioritise. This is your building survey.
• Site access reviews delegate remediation to site owners (up to 100 sites at a time) rather than centrally cleaning up every site. Compliance reasons prevent admins from seeing file-level detail, so owners are better placed anyway.
• Restricted Content Discovery (RCD) — a per-site setting that removes a site's content from organisation-wide search and Copilot responses, and removes AI entry points (the Copilot button, Create-page-with-AI, agent creation). It does not change permissions — authorised users can still open files directly, and it does not remove content from the search index. It is the scalpel for individual high-risk sites.
• Restricted Access Control (RAC) — genuinely restricts site access to members of a named Entra security or Microsoft 365 group; users outside the group lose access even if they had it before. This is a real access boundary, not just a discovery filter.
• Restricted SharePoint Search (RSS) — a tenant-wide blunt instrument that limited enterprise search and Copilot to a curated allow-list of up to 100 sites. Important 2026 change: RSS is retiring. As of 31 July 2026 new enablement is blocked, and Microsoft directs customers to Restricted Content Discovery instead. If RSS is already on in your tenant it continues to function, but it is no longer a tool you can newly switch on — plan your containment around RCD.

RCD is the scalpel; RSS was the tenant-wide gate — and that gate is now closed to new tenants. Do not build a governance model on RSS.

SAM licensing: SAM is included when a user is assigned a Microsoft 365 Copilot licence — for E3 and E5 that means the Copilot add-on; E7 ("The Frontier Suite," GA 1 May 2026) includes Copilot and therefore SAM. It is also purchasable as a standalone SharePoint Advanced Management Plan 1 add-on. Analysts flag a licensing ambiguity: Microsoft's Product Terms arguably require a per-user SAM licence for every SharePoint/OneDrive user, even though tenants get broad access from a single Copilot seat today. A few features, notably Restricted site creation, always require the standalone SAM Plan 1 add-on. DAG reports are also available with Microsoft 365 E5 without the rest of SAM.

Sensitivity labels and DLP for Copilot

• Sensitivity labels with encryption are the only content-level control that gates what Copilot can process. A label that encrypts and withholds EXTRACT rights means Copilot cannot summarise that content even for a user who can see the file. A "Confidential" label that does not encrypt is a sticker — Copilot processes it normally. Copilot-generated content also inherits the highest-priority label of the files it references.
• Purview DLP for the Microsoft 365 Copilot and Copilot Chat location lets you exclude labelled content from being processed. You create a Custom DLP policy, select the Microsoft 365 Copilot and Copilot Chat location (selecting it disables all other locations in that policy), and add a rule with the Content contains → Sensitivity labels condition. Labelled items still appear in the response citations, but their content is not used in the answer. This "restrict Copilot from processing sensitive files and emails" capability is generally available. Related controls remain in preview as of August 2026: blocking sensitive information types in prompts, and restricting Copilot from processing external email. Note one rule limit Microsoft documents: you cannot combine the "sensitive info types" and "sensitivity labels" conditions in the same rule — use a separate rule per condition. Allow at least 24 hours for new Copilot DLP policies to take effect.

Retention, eDiscovery, and audit for Copilot

Copilot prompts and responses are stored as individual message-class items in a hidden folder in the initiating user's Exchange Online mailbox (the same substrate model as Teams messages). This is what makes Purview compliance work on Copilot at all:

• Audit logs record that a Copilot interaction happened (time, user, workload) but not the prompt/response text.
• Content Search / eDiscovery retrieves the actual text: search Exchange mailboxes, add condition Type → Copilot interactions. Premium eDiscovery can include the full conversation within a 12-hour window.
• Retention policies cover Copilot via the "Microsoft Copilot experiences" location (Teams chat is now a separate location).
• Gotcha: Copilot Pages live in user-owned SharePoint Embedded containers, not the mailbox — an eDiscovery hold on the mailbox does not automatically cover them. And Copilot memory items (stored as IPM.Contact) are not currently covered by retention policies or eDiscovery holds.

Decide your audit retention period early — the default window is frequently shorter than the time before an AI-related question gets asked, and you cannot recover events that already aged out.

Insider Risk Management for Copilot

Purview Insider Risk Management (IRM) provides indicators for risky AI usage: "entering risky prompts in Copilot," "receiving sensitive responses from Copilot," and equivalents for enterprise AI apps. A June 2026 update lets you choose exactly which AI apps trigger these indicators. Adaptive Protection can then feed IRM risk levels into Conditional Access to block high-risk users from Copilot or sensitive SharePoint sites — which is where this connects to your Conditional Access baseline. IRM is an E5 / E5 Compliance-tier capability.

The pre-deployment control plan (in order)

This sequence is drawn from Microsoft's "Address oversharing in Microsoft 365 Copilot" blueprint (Pilot → Deploy → Operate) and the SAM "Get ready for Copilot" guidance. Do it in this order — the later controls depend on the earlier ones.

• 1. Turn on Purview auditing (usually on by default; verify it) so interaction telemetry is captured from day one.
• 2. Run the assessment. Use DSPM for AI data risk assessments and SAM DAG reports to find overshared sites holding sensitive data, risky links, and EEEU exposure. Export the top 100 most-active sites.
• 3. Contain the worst sites. Apply RCD to individual high-risk sites while you review. (RSS is no longer available for new enablement, so RCD is the containment tool.) These buy time — they are not the fix.
• 4. Build the classification layer. Design a tight sensitivity-label taxonomy (aim for a handful of tiers), run auto-labelling in simulation mode first, review, then enforce. Labels are the foundation every downstream control references.
• 5. Configure DLP for the Copilot location to exclude your most sensitive labels from Copilot processing.
• 6. Remediate the real permissions. Site access reviews delegated to owners; RAC on regulated sites as a durable fence; tighten default sharing and disable EEEU at tenant level where appropriate.
• 7. Turn on the compliance stack — retention for Copilot experiences, eDiscovery readiness, Communication Compliance, and IRM risky-AI indicators.
• 8. Monitor continuously via DSPM for AI Activity Explorer, then relax the temporary controls (remove RCD from remediated sites) as permissions are cleaned up.

Control-to-licence-to-status map

What breaks in production

• RSS is gone as a new option. If you were planning to flip on Restricted SharePoint Search as a quick tenant-wide safety net, that door closed on 31 July 2026. Build containment on RCD instead. (And even where RSS is still running from before, it disables organisation-wide enterprise search, not just Copilot, and caps you at 100 sites — never a governance model.)
• RCD does not scale endlessly. Microsoft warns that overuse degrades search and Copilot answer quality (less content to ground on). It is a per-site property that must propagate to the search index; for sites with more than 500,000 items, the update can take more than a week to fully reflect in search and Copilot. RCD also does not apply to OneDrive, does not remove content from the index, and users who interacted with a site recently may still see some results.
• Label encryption breaks Copilot summarisation — by design, and sometimes by accident. If you over-apply an encrypting label, or use "let users assign permissions" where users forget EXTRACT rights, Copilot silently stops working on legitimately needed content. If most content ends up Confidential, Copilot becomes nearly useless.
• Auto-labelling without simulation mislabels at scale. Always run simulation first, and layer DLP after labels reach steady state — DLP built on a shifting taxonomy generates alert fatigue.
• These tools surface oversharing; they do not fix it. RCD and DLP are containment. The permission model still has to be cleaned up. A weak permissions model stays weak.
• Guest and external sharing exposure is a separate axis — DAG's EEEU and "Anyone" link reports are where to look.
• DAG reports lag at scale, and the default DSPM assessment only covers the top 100 sites — large estates need custom assessments and PowerShell baselines (see our Graph PowerShell guide).
• Copilot in SharePoint went on by default. During the mid-2026 rollout Microsoft enabled site-scoped Copilot in SharePoint as an opt-out preview tenant-wide — the opt-out is the admin's action, not the user's. Know the Set-SPOTenant -DisableCopilotInSharePoint $true switch before you need it, and verify current behaviour against your Message Center.

2026-specific changes to watch

• Restricted SharePoint Search retirement. New enablement blocked from 31 July 2026; Microsoft directs customers to RCD. Migrate any RSS-based containment plan now.
• Purview for agents (DSPM AI observability + IRM for agents) reached GA around late May 2026 for Microsoft 365 E7 or Agent 365 subscribers — extending governance to Copilot Studio and custom agents.
• Copilot oversharing alerts and DLP controls in the Microsoft 365 admin center (Roadmap ID 559617), targeted around October 2026 — a single pane for oversharing risk and Copilot DLP outside the Purview portal. Treat as forthcoming until it lands in your tenant.
• Classic DSPM and DSPM for AI experiences retire late September 2026 — confirm your migration to unified DSPM.

Before you deploy

Copilot governance is not a Copilot problem — it is a data-governance problem that Copilot makes urgent. The controls above do not create security; they surface and contain exposure that already exists. Sequence them: assess, contain, classify, restrict with DLP, remediate permissions, then monitor. Everything downstream depends on getting sensitivity labels right, so start there and give them time to stabilise. And because these controls span identity, device and data, pair this with your Conditional Access baseline and privileged-access controls — Copilot governance is one face of the same Zero Trust programme.

A note on verification

GA/preview statuses here were validated against Microsoft Learn as of 2 August 2026. Feature status changes frequently: items flagged preview or forthcoming (DLP for prompts, external-email DLP, admin-center oversharing controls) should be re-confirmed in your tenant, and the Restricted SharePoint Search retirement (new enablement blocked 31 July 2026) and the classic-DSPM sunset (late September 2026) should be checked against your own Message Center. Licensing statements reconcile the Microsoft Learn E3/E5/E7 comparison, the Purview service description, and roadmap sources; Microsoft's licensing guidance carries a "no contractual commitment" disclaimer, so confirm against your Product Terms. The SAM per-user Product Terms interpretation is a documented analyst dispute, not a settled Microsoft statement.

Frequently asked questions

Does Microsoft 365 Copilot respect existing SharePoint permissions?

Yes. Copilot only surfaces content the signed-in user already has permission to access, enforced through Microsoft Graph. Where a file is encrypted by a sensitivity label, the user additionally needs VIEW and EXTRACT usage rights. The risk is that existing permissions are broader than intended — not that Copilot bypasses them — which is why a permissions clean-up should precede any rollout.

Is SharePoint Advanced Management free with Copilot?

Assigning a Microsoft 365 Copilot licence unlocks the Copilot-supporting SAM features. For E3 and E5 that means the Copilot add-on; E7 includes Copilot and therefore SAM. SAM is also available as a standalone SAM Plan 1 add-on, and a few features such as Restricted site creation always require that standalone add-on. Watch the Product Terms — the per-user licensing interpretation is ambiguous and disputed by analysts.

What is the difference between Restricted SharePoint Search and Restricted Content Discovery?

Restricted SharePoint Search (RSS) was tenant-wide: it disabled organisation-wide search and limited Copilot to an allow-list of up to 100 sites — blunt and temporary. Restricted Content Discovery (RCD) is per-site: it removes selected high-risk sites from search and Copilot discovery without changing permissions. As of 31 July 2026, RSS is retiring and new enablement is blocked, so RCD is now the directed tool for containing high-risk sites during a Copilot rollout.

Can Purview DLP stop Copilot using a labelled document?

Yes. A Custom DLP policy on the Microsoft 365 Copilot and Copilot Chat location with a Content contains → Sensitivity labels condition prevents Copilot from using that content in responses. This is generally available. The document may still appear in the response citations, but its content is not summarised or used in the answer. Blocking sensitive information types in prompts and blocking external email are related controls still in preview as of August 2026.

Are Copilot prompts discoverable in eDiscovery?

Yes. Prompts and responses are stored in a hidden folder in the initiating user's Exchange Online mailbox and are searchable via Content Search or eDiscovery using the Type → Copilot interactions condition. Audit logs show that an interaction occurred but not its text. Copilot Pages (in SharePoint Embedded containers) and Copilot memory items need separate handling, as a mailbox hold does not automatically cover them.

What licence do I need to govern Copilot with Purview?

Sensitivity labels and basic DLP and retention start at Microsoft 365 E3. The full stack — auto-labelling, DLP for Copilot, Insider Risk Management, advanced eDiscovery, and the full DSPM for AI experience including viewing prompt and response content — is an E5 / E5 Compliance capability. Governing Copilot agents leans toward E7 / Agent 365. Seeing Copilot interactions at all also requires Copilot licences and Purview auditing enabled.