6.2.4. Microsoft Purview and Microsoft Defender for AI Workloads
💡 First Principle: Purview and Defender answer two different questions about the same agent. Purview governs the data plane — what sensitive information is flowing through prompts and responses, who is accountable for it, and how long it is kept. Defender protects the threat plane — is someone attacking this workload right now. Neither substitutes for the other, and neither is the same thing as the Power Platform's own governance controls.
The three control planes, and why they are confused:
| Plane | Control | Scope |
|---|---|---|
| Platform governance | Power Platform DLP policies, environment strategy, admin center | Which connectors an agent may combine; where agents may be built |
| Data security & compliance | Microsoft Purview | What content moves through prompts, responses, and grounding data |
| Threat protection | Microsoft Defender | Attacks against the AI workload — jailbreak, data poisoning, credential theft |
⚠️ Common Misconception: "DLP" means one thing. It means two, and they do not overlap. Power Platform DLP classifies connectors into business/non-business groups and blocks agents from combining them — it never inspects content. Purview DLP performs deep content inspection on the data itself. An exam scenario about stopping an agent from joining an HR connector to a public one is Power Platform DLP; a scenario about preventing credit-card numbers from reaching a model is Purview DLP.
Microsoft Purview for Copilot Studio agents:
DSPM for AI is the front door — the discovery and posture surface where you see what AI usage exists before you decide what to control. From there, the individual Purview solutions apply to agent interactions:
| Purview capability | What it does for agent interactions | Supported for Copilot Studio |
|---|---|---|
| DSPM / DSPM for AI | Discovers AI usage, surfaces risks, offers one-click policies | ✓ |
| Audit | Captures prompts and responses in the unified audit log | ✓ |
| Data classification | Finds sensitive info types in prompts and responses | ✓ |
| Sensitivity labels | Enforces label protection on grounding data and citations | ✓ |
| Data Loss Prevention | Content inspection; endpoint policies against third-party AI sites | ✓ |
| Insider Risk Management | Risky AI usage policy template — detects prompt injection and protected-material access | ✓ |
| Communication compliance | Detects conduct violations in prompts and responses | ✓ |
| eDiscovery | Search, hold, review, and export agent interactions | ✓ |
| Data Lifecycle Management | Retention and deletion of prompts and responses | ✓ |
| Compliance Manager | Regulatory templates and assessments for AI regulations | ✓ |
| Encryption without sensitivity labels | — | ✕ Not supported |
Details that scenarios turn on:
- Auditing must be turned on for the tenant before any of this produces data. DSPM for AI's Overview flags it if it is off.
- Sensitivity labels apply when the knowledge source is SharePoint/OneDrive, or Dataverse with auto-labeling. Encryption is honoured only through sensitivity labels and only for the SharePoint knowledge source.
- Where a label applies encryption, the user must hold the EXTRACT usage right as well as VIEW for the agent to return that data. This is the mechanism behind "Copilot won't show me a document I can open" questions.
- The response displays the highest-priority label among the sources used, following the label priority order defined in the Purview portal.
- Retention policies use the location "Microsoft Copilot Experiences."
- eDiscovery finds these interactions via the
ItemClasspropertyIPM.SkypeTeams.Message.Copilot.Studio.*, because prompts and responses are stored in the user's mailbox. - Reading actual prompt and response text in activity explorer requires the Content Explorer Content Viewer role — visibility of the event is not visibility of the content.
- Managing interactions for agents published to non-Microsoft channels requires pay-as-you-go billing to be enabled.
Microsoft Defender for AI workloads:
| Defender surface | Role |
|---|---|
| Defender for Cloud — AI threat protection (Defender for AI Services) | Real-time alerts on generative AI workloads: data leakage, data poisoning, jailbreak, credential theft. Works alongside Azure AI Content Safety Prompt Shields and Microsoft threat intelligence |
| Defender XDR | The correlation surface — AI workload alerts land here alongside identity, endpoint, and Purview Insider Risk signals so an incident can be seen whole |
| Defender for Cloud Apps | Discovers shadow AI — third-party generative AI apps detected through browser activity and catalogued under "Generative AI" |
Coverage limits that scenarios exploit: AI threat protection covers Azure OpenAI and Azure AI Model Inference models, scans text tokens only (images and audio are not scanned), and is available in commercial clouds only — not Azure Government, not 21Vianet, not connected AWS accounts.
⚠️ Exam Trap: Prompt Shields and Defender for Cloud are complementary, not alternatives. Content Safety Prompt Shields blocks a jailbreak attempt inline as part of the request path. Defender for Cloud alerts and correlates — it tells the security team an attack is happening and joins it to the wider incident. A scenario asking how to stop the injection points at Prompt Shields; a scenario asking how the SOC finds out points at Defender for Cloud and Defender XDR.
⚠️ Exam Trap: Purview Insider Risk Management's Risky AI usage template also detects prompt injection — but from the insider angle, scoring user risk rather than protecting the workload, and its signals flow into Defender XDR. When a scenario stresses "an employee is deliberately probing the agent," that is Insider Risk Management; when it stresses "our AI endpoint is under attack," that is Defender for Cloud.
Troubleshooting Scenario: A compliance officer asks which employees have pasted customer PII into any AI tool over the last quarter — including tools the company never sanctioned. No single product answers this. Purview DSPM for AI provides the discovery surface and reports; data classification identifies the PII inside prompts; Audit supplies the per-user event record; and for the unsanctioned tools, Defender for Cloud Apps is what surfaced them at all, since agents and apps the organization never registered are only visible through browser-activity discovery. The Copilot Studio Monitor page contributes nothing here — it reports on one agent's effectiveness, not on tenant-wide data movement.
Reflection Question: An agent grounded on a SharePoint site returns a document summary to a user who cannot open the underlying file. Which control failed, and which two usage rights would have had to be present for this to be correct behaviour rather than an oversharing incident?
