Microsoft Purview in 2026: DSPM, DLP for Copilot, and Auto-Labeling for AI Content

TL;DR

• DSPM is still the front door, but the product you open today is a new DSPM that went GA in May 2026. What this article originally described is now DSPM (classic) and DSPM for AI (classic).
• DLP for Copilot stops Copilot processing labelled items and sensitive prompts. It does not fix oversharing — Copilot already runs in the user's permission context.
• Auto-labeling of AI content is mostly sensitivity label inheritance in Copilot for Word, PowerPoint, and Outlook, not a blanket classify-at-creation control.
• DLP OCR is not free and not endpoint-only. It bills per image through Microsoft Syntex and only scans images uploaded after you enable it.
• Nothing here should go straight to enforce.

Corrections since this article was first published

• DSPM was rebuilt. The current Data Security Posture Management reached GA in May 2026 with expanded data sources, guided workflows, and AI observability. The previous experiences were renamed DSPM (classic) and DSPM for AI (classic); all three still appear in the portal, so a guide written in early 2026 sends you to the wrong one.
• "Enable DLP for Copilot from the admin center" was wrong. There is no admin center toggle — build the policy in the Purview portal, or accept a one-click remediation policy from DSPM. A new external-email condition also arrived in June 2026, in preview.

What the new DSPM actually gives you

Purview used to be a toolbox: labels here, DLP there, Insider Risk somewhere else. The current DSPM organizes around outcomes instead. Sign in to the Microsoft Purview portal and choose Solutions > DSPM — not the entries suffixed (classic). Objectives is the part worth your time: each objective, such as Prevent data exposure in Microsoft 365 Copilot and Microsoft Copilot interactions, bundles the relevant DLP, labeling, and Insider Risk work into one prioritized workflow with its own metrics.

Budget a day before judging it — setup tasks must complete and tenant data does not populate immediately. Processing also pauses for tenants inactive over 60 days.

DLP for Copilot: the exact configuration

1. In the Microsoft Purview portal, go to Data Loss Prevention > Policies > + Create policy.
2. Choose the Custom template, then Custom policy. The Copilot location exists only here.
3. On Locations, turn on Microsoft 365 Copilot and Copilot Chat. Every other location is disabled automatically — this location cannot be combined.
4. Add rules, then run the policy in simulation before you enforce.

Three condition types are supported, and the distinction between them matters:

Five gotchas, each worth an afternoon:

• A SIT condition and a sensitivity label condition cannot share a rule. Use one rule per condition type in the same policy.
• Policy changes take up to four hours to reach Copilot. Do not conclude your rule is broken at minute thirty.
• Files uploaded directly into a prompt are not scanned. DLP evaluates the typed prompt text, nothing attached to it.
• In Word, Excel, and PowerPoint the policy is evaluated at file open. Apply a label mid-session and enforcement waits for the next open.
• Administrative units are unsupported, Exchange coverage starts at emails sent on or after 1 January 2025, and calendar invites are out of scope entirely.

What DLP for Copilot does not do

This is where the original article overreached, and where most rollout plans go wrong. Every Copilot prompt runs in the security context of the user who typed it — if a user can already open a file, Copilot could always surface it, and no DLP rule changes that. DLP for Copilot narrows what Copilot will process; it is not an access control and does not repair permissions.

Microsoft's own deployment blueprint inverts the usual assumption: DLP for Copilot and SharePoint Advanced Management's Restricted Content Discovery are interim protections applied while you remediate oversharing, to be removed once permissions are fixed. Treat DLP for Copilot as the destination and the oversharing stays exactly where it was — the failure mode we covered in Missing AI Guardrails.

The real prerequisite for a broad Copilot rollout is therefore permissions hygiene, not a DLP policy: run the DSPM risk assessments and the SAM Content Management Assessment, then fix company-wide sharing links, broken inheritance, and ownerless sites — see our SharePoint permissions guide, Copilot rollout guide, and Copilot mid-2026 roundup.

Licensing, precisely

Auto-labeling is E5-tier, full stop. Client-side auto-labeling (on the label itself, under Auto-labeling for files and emails) and service-side auto-labeling policies (Information Protection > Policies > Auto-labeling policies) both require Microsoft 365 E5, E5 Compliance, E5 Information Protection & Governance, or standalone Azure Information Protection Premium P2. E3 and Business Premium give you sensitivity labels and manual labeling only. If the page is missing, check the licence before opening a support case.

OCR needs no Purview licence — it needs an Azure subscription, billed pay-as-you-go through Microsoft Syntex. A Global admin sets up billing before a Compliance admin can enable it.

SharePoint Advanced Management is included with Copilot licences, so Restricted Content Discovery and site access reviews are already paid for in any Copilot tenant — and many teams never turn them on.

DSPM and the Copilot DLP location sit at the E5 / E5 Compliance tier. Entitlements here have moved more than once, so the Purview service description is the only authority worth quoting to procurement. Our licensing comparison covers the tier trade-offs.

Simulation mode, and why enforce-first fails

Simulation mode replaced the old Test and Test with policy tips states, and unlike them it keeps every match and alert in a separate dashboard, so test noise never pollutes production alerting.

Connect-IPPSSession   # Security & Compliance PowerShell

# -Mode: Enable | Disable | TestWithNotifications | TestWithoutNotifications
Set-DlpCompliancePolicy -Identity "Copilot - Block Highly Confidential" `
    -Mode TestWithoutNotifications

# Enforce only after reviewing the simulation dashboard
Set-DlpCompliancePolicy -Identity "Copilot - Block Highly Confidential" -Mode Enable

Three properties shape how you read the results. A simulation runs for up to 15 days, so it is a window, not a snapshot. For SharePoint and OneDrive it evaluates existing and new or changed items; for Exchange, Teams, and Devices it evaluates only items created during the run, so a quiet week produces a misleadingly clean report. And simulation alerts surface only on the simulation alerts tab — never in the DLP alerts console or the Defender portal.

Auto-labeling AI content: what it is, and how it fails

Purview's answer here is narrower than "security by default" implies. What actually happens is sensitivity label inheritance: draft with Copilot in Word, PowerPoint, or Outlook from a labelled source and the new content inherits that label and its protections, the highest-priority label winning when several files are referenced. Useful — but it is client-side behavior, users can override it unless you enforce mandatory labeling, and it does nothing outside those apps. Service-side auto-labeling still does the heavy lifting, after the fact.

The retroactive lag is a design, not a delay. Simulation reports every file matching your conditions. On activation, the service only re-evaluates files whose state has recently changed — new, modified, or re-crawled. Files that matched in simulation but have not been touched since are never re-evaluated, so the backlog quietly goes unlabelled. Forcing a full pass requires on-demand classification after activation. This accounts for most "auto-labeling isn't working" tickets.

Over-labeling comes from throughput, not accuracy. The ceiling is 100,000 automatically labelled files per tenant per day, with a maximum of 100 policies and 100 explicitly listed locations each. Point a broad rule at All locations in a large tenant and you will meter that queue for weeks. Policy-page progress refreshes every 48 hours; use activity explorer for current numbers.

Label collisions resolve by priority, and priority is position — the label at the bottom of the list wins. Auto-labeling never overrides a manual label by default, and never overrides a higher-priority automatic one. You can opt in to overriding lower-priority manual labels, a setting that extended from email to SharePoint and OneDrive files at GA in April 2026.

Simulation is not a silent dry run, and it shows one policy. It still fires activity alerts, a new policy is unmanageable for roughly 24 hours while the backend provisions, and conflicts between policies resolve only when all of them run — so the enforced outcome can differ from any single simulation.

# Create a service-side auto-labeling policy in simulation
New-AutoSensitivityLabelPolicy -Name "Finance - Confidential" `
    -SharePointLocation "https://contoso.sharepoint.com/sites/finance" `
    -ApplySensitivityLabel "Confidential" -Mode TestWithoutNotifications

Two prerequisites the wizard never checks: sensitivity labels must be enabled for Office files in SharePoint and OneDrive, and reviewing simulation results requires the Data Classification Content Viewer role, which Global Administrators do not hold by default.

DLP OCR: closing the screenshot gap, for a price

Pasting a sensitive table into an image used to defeat text-based rules. OCR closes that, and it is broader than "endpoint" suggests — Exchange, SharePoint, OneDrive, Teams, and Windows and macOS devices all feed DLP, auto-labeling, and Insider Risk scoring from a single scan.

The part the announcements bury: OCR is consumption-billed. A Global admin sets up Microsoft Syntex pay-as-you-go billing against an Azure subscription first; after that no additional Purview licence is required. Every image is one transaction and every page of a PDF is charged separately — a 10-page scanned PDF is 10 transactions. Caching softens this, but use the OCR cost estimator before enabling it tenant-wide.

Enable it at Settings > Optical character recognition (OCR), choosing locations and the groups in or out of scope; settings take about an hour to apply. Then plan around the limits. Only images uploaded after you turn OCR on are scanned — there is no retroactive sweep. Images must be 50 × 50 px to 16,000 × 16,000 px, and endpoints default to a 1,024 MB per-device daily cap after which scanning stops. Building the underlying rules for the first time? Our DLP setup guide covers endpoint and email policy construction.

Where the controls sit relative to each other

flowchart TD
    subgraph Durable["Durable fix — first"]
        DSPM[DSPM risk assessments] --> PERM[Remediate permissions]
    end
    subgraph Interim["Interim guardrails"]
        RCD[SAM Restricted Content Discovery]
        DLP{DLP: Copilot location}
    end
    U[User prompt] --> DLP
    DLP -->|Labelled item or SIT| B[Excluded, or refused]
    DLP -->|Allowed| R[Response, in user's permission context]
    R --> L[Label inheritance:
Word / PowerPoint / Outlook]
    L --> G[Encryption + retention travel with the file]
    PERM -.retires.-> Interim
    IRM[Insider Risk: Risky AI usage] -.monitors.-> R

A sequenced first two weeks

1. Turn on auditing and open the new DSPM — not a (classic) one. Reports need a day to populate.
2. Run the data risk assessments before writing a single policy. Let the Prevent oversharing objective build your worklist, paired with the SAM Content Management Assessment for ownerless, inactive, and EEEU-exposed sites.
3. Apply the interim guardrails. Restricted Content Discovery on the worst sites, plus a Copilot-location DLP policy targeting your most sensitive labels — in simulation, not enforce.
4. Fix permissions: site access reviews, rescoped sharing links, corrected inheritance, assigned owners. This is the step that removes the risk.
5. Build labeling on top, not underneath. Publish the taxonomy, enable labels for Office files in SharePoint and OneDrive, then run auto-labeling in simulation — roughly 12 hours per run, plus on-demand classification to catch the backlog. Cost OCR separately, enable narrowly, widen.
6. Add monitoring. The Insider Risk Risky AI usage template detects prompt injection attempts and access to protected material, and since June 2026 you choose which generative AI apps to monitor — which also caps pay-as-you-go charges. Signals surface in Defender XDR.
7. Decide retention and discovery deliberately. Copilot prompts and responses live in the user's mailbox: retention policies target the Microsoft Copilot Experiences location, and eDiscovery finds interactions via the IPM.SkypeTeams.Message.Copilot.* item class. See our backup and retention guide and the Graph SDK PowerShell guide.

The bottom line

Purview in 2026 is better organized than the toolbox it used to be, and the objective-driven DSPM is the right front door. But the story the announcements tell — governance on by default, AI content classified at birth — runs ahead of what the controls do. Every one is real; every one is narrower than its headline, and that gap is where rollouts fail. Plan against the specifics, not the headline.

Further reading

• DLP for Microsoft 365 Copilot and Copilot Chat (Microsoft Learn)
• Data Security Posture Management (Microsoft Learn)
• Automatically apply a sensitivity label (Microsoft Learn)
• Optical character recognition in Microsoft Purview (Microsoft Learn)
• Data loss prevention simulation mode (Microsoft Learn)

Image credit: U.S. Air Force (Tech. Sgt. David Salanitri) via Wikimedia Commons (public domain).