Microsoft Purview in 2026: DSPM, DLP for Copilot, and Auto-Labeling for AI Content

TL;DR

• Data Security Posture Management (DSPM) is now the front door to Purview — it shows where sensitive data lives and where it is over-exposed before an incident forces the question.
• DLP for Copilot can be enabled directly from the admin center, so Copilot honours the same data-loss rules as the rest of Microsoft 365.
• Auto-labeling of AI-generated content means business content Copilot creates is classified and governed from the start, shrinking the "shadow data" problem.
• Endpoint DLP now reads text inside images via OCR, closing a long-standing screenshot-shaped gap.
• The theme for 2026 is security by default: governance turned on at creation time rather than retrofitted later.

Purview's center of gravity moved to posture

For years, Microsoft Purview was a toolbox: sensitivity labels here, DLP policies there, Insider Risk Management somewhere else. In 2026 the product reorganized around a simple question — where is your sensitive data, and where is it dangerously exposed? That is the job of Data Security Posture Management (DSPM), and it is increasingly the first screen administrators open.

DSPM matters because the hardest part of data protection was never writing a DLP rule; it was knowing what to protect and where it had spread. A posture view that surfaces oversharing risks — including content exposed to Copilot — turns an abstract compliance goal into a prioritized worklist.

DLP for Copilot, straight from the admin center

The most operationally important change for most tenants is that you can now view oversharing risks and enable Data Loss Prevention for Copilot directly from the admin center. Copilot is powerful precisely because it can reach across your tenant's content — which is exactly why it needs to respect your data-loss boundaries.

With DLP for Copilot enabled, prompts and responses are evaluated against your policies, so sensitive content does not leak into a generated summary or get surfaced to a user who should not see it. If you are rolling out Copilot broadly (see our Copilot mid-2026 roundup), treat this as a prerequisite, not an afterthought.

Security by default: auto-labeling AI content

A genuinely new risk in the Copilot era is the "shadow data lake" — AI generates documents, summaries, and pages at a pace no human classification workflow can keep up with. Purview's 2026 answer is security-by-default: AI-generated business content is auto-labeled and governed from the moment it is created.

That single design choice changes the economics of governance. Instead of chasing unlabeled content after the fact, the label and its protections travel with the content from birth — encryption, access restrictions, and retention all apply without a user remembering to click anything.

Endpoint DLP learns to read images

A perennial DLP blind spot was the screenshot: paste a sensitive table into an image and the text-based rules never saw it. Purview's endpoint DLP now supports Optical Character Recognition (OCR) for embedded images, so credit-card numbers, secrets, or regulated identifiers inside a screenshot are evaluated like any other text.

It is a narrow feature with an outsized impact, because exfiltration via image was a well-known workaround. Closing it removes an easy bypass.

Where DLP for Copilot fits in the flow

flowchart TD
    U[User prompt to Copilot] --> P{Purview DLP for Copilot}
    P -->|Sensitive content detected| B[Block or redact in response]
    P -->|Allowed| R[Copilot response]
    R --> L[Auto-label AI-generated output]
    L --> G[Governed: encryption + retention + access]
    DSPM[DSPM posture view] -.surfaces oversharing.-> P

A practical Purview checklist for 2026

1. Open DSPM first. Let the posture view tell you where sensitive data is concentrated and over-exposed, and work that list top-down.
2. Enable DLP for Copilot before a broad Copilot rollout. It is the control that makes "Copilot can read everything I can" safe.
3. Turn on auto-labeling for AI content. Govern at creation; do not plan to clean up later.
4. Enable OCR in endpoint DLP. Close the screenshot bypass.
5. Review Insider Risk signals alongside posture. Posture tells you what is exposed; insider risk tells you who is behaving unusually around it.

The bottom line

Purview in 2026 is built around a single conviction: governance should be on by default and posture-driven, not a manual cleanup project that runs behind your AI rollout. For IT and security teams, the move is straightforward — lead with DSPM, make DLP for Copilot a Copilot prerequisite, and let auto-labeling keep pace with the content your organization is now generating at machine speed.

Further reading

• Microsoft 365 Roadmap Updates — May 2026 (Level Up M365)
• Microsoft roadmap roundup — 01 June 2026 (SharePoint Stuff)

Image credit: U.S. Air Force (Tech. Sgt. David Salanitri) via Wikimedia Commons (public domain).