4.1.1. Data Exposure Risk: SharePoint and Purview DSPM for AI
💡 First Principle: Permissions that were "fine" for years under manual search and browsing can become a real exposure risk the moment an AI agent can traverse and synthesize across all of them in seconds — the underlying access was always technically correct, but AI makes previously impractical discovery practical.
Identifying overexposure of data in SharePoint means finding sites, libraries, and files with broader sharing than intended — often accumulated gradually as "just this once" exceptions over years. Microsoft Purview Data Security Posture Management (DSPM) for AI is purpose-built to surface exactly this risk in the context of Copilot and other AI apps: it identifies oversharing patterns, flags sensitive content that's more discoverable than intended, and reports on what AI interactions have actually accessed.
⚠️ Exam Trap: A scenario describing a Copilot deployment that "only surfaces documents users already had access to" is not describing a non-issue — that's precisely the oversharing scenario Purview DSPM for AI exists to catch. Technically-correct permissions being AI-scale discoverable for the first time is the risk, not a contradiction of it.
Reflection Question: Why might a SharePoint site shared broadly "just for one project" years ago become a materially bigger risk the day Copilot is enabled organization-wide, even though nothing about the site's permissions changed?
