DSPM for AI & Data Lifecycle
Data Security Posture Management for AI watches how your data is used with Copilot and other AI tools. Data Lifecycle Management controls how long data lives. Both are essential for Copilot governance.
Two critical concepts for the AI era
DSPM for AI is like a GPS tracker on your data when it travels through AI tools. It shows: “This confidential document was accessed by Copilot 47 times this week by 12 different users.” It helps you answer: “Is our sensitive data being used safely with AI?”
Data Lifecycle Management is like an expiry date on food. Some data must be kept for 7 years (legal records). Some data should be deleted after 90 days (old chat logs). Retention policies automate this — keep what you need, delete what you don’t, and never lose something you’re legally required to keep.
DSPM for AI — governing your AI data
What DSPM for AI shows you
| Insight | Why It Matters |
|---|---|
| Which sensitive data AI accesses | Are labelled documents being surfaced by Copilot? |
| Who’s using AI with sensitive data | Are the right people accessing the right data through AI? |
| Unlabelled data being used in AI | Data without sensitivity labels is a blind spot |
| AI interaction volume | How heavily is your org using Copilot with sensitive content? |
| Risky AI patterns | Users prompting Copilot for data they shouldn’t have access to |
Scenario: Northwave discovers AI blind spots
After deploying Copilot, Priya (Compliance) checks DSPM for AI and finds:
- 2,400 documents accessed by Copilot in the first month
- 340 of those had sensitivity labels (good — protected)
- 2,060 had NO labels (bad — blind spot)
- 15 users used Copilot to access data in SharePoint sites they hadn’t directly visited before
Actions:
- Priority: auto-label the 2,060 unlabelled documents (Information Protection)
- Review the 15 users’ access patterns — were they accessing data through oversharing?
- Set up DSPM alerts for unlabelled data accessed by Copilot
- Report to Jordan (CISO) — “Our labelling coverage is only 14%. Copilot exposes the gap.”
Key exam concept: DSPM for AI doesn’t block anything — it provides VISIBILITY. It tells you what’s happening so you can take action with other tools (labels, DLP, permissions). Think of it as the dashboard, not the brakes.
Data Lifecycle Management — retention and deletion
Retention policies vs retention labels
| Feature | Retention Policy | Retention Label |
|---|---|---|
| Scope | Applied to locations (entire mailbox, entire site) | Applied to individual items (specific document, email) |
| How applied | Admin configures for locations | Manual, auto-applied, or recommended |
| Flexibility | Broad — same rules for everything in the location | Granular — different rules per item |
| Use case | Keep all email for 3 years | Keep this specific contract for 10 years |
| Legal hold | Not designed for this | Supports legal holds on specific items |
Retention actions
| Setting | What Happens |
|---|---|
| Retain only | Keep data for X period, then do nothing (user can still delete before) |
| Retain then delete | Keep for X period, then auto-delete |
| Delete only | Auto-delete after X period (no retention requirement) |
Scenario: Clearfield Council's retention rules
Clearfield Council has regulatory requirements:
- Council meeting minutes → retain for 10 years, then delete (retention label, auto-applied to “Council Minutes” library)
- General email → retain for 3 years, then delete (retention policy on all Exchange mailboxes)
- Teams chat → retain for 1 year, then delete (retention policy on Teams)
- Active investigation documents → legal hold, retain indefinitely (retention label, manually applied by legal team)
The key principle: retain what you must, delete what you should, and never lose what you’re legally required to keep.
🎬 Video walkthrough
Flashcards
Knowledge Check
After deploying Copilot, Northwave finds that 80% of documents accessed by Copilot have no sensitivity labels. Which Purview tool revealed this insight?
Next up: How Copilot Accesses Your Data — the Microsoft Graph connection and why data governance is the foundation of safe Copilot deployment.