Question

Your organization has deployed Microsoft 365 Copilot and also allows employees to use consumer generative AI apps such as ChatGPT and Google Gemini from company devices. Security leadership wants a single dashboard in Purview that surfaces sensitive data being shared with BOTH Copilot and these third-party AI sites, including which sensitivity labels and sensitive info types are involved. Before this cross-app visibility works in DSPM for AI, which prerequisite must you complete for the third-party AI site activity to appear?

Accepted Answer

Onboard the devices to Microsoft Purview and enable the Microsoft Purview browser extension (or Edge integration) so that Endpoint DLP can capture activity to third-party generative AI sites

Answer

Create an Insider Risk Management policy using the data theft template and assign the Adaptive Protection connector

Answer

Configure a Defender for Cloud Apps session policy to proxy all traffic to ChatGPT and Gemini through a reverse proxy

Answer

Enable Audit (Premium) retention policies for the Copilot interaction audit records so the events are retained for one year