AB-900 Microsoft Purview and Copilot Data Security: Sensitivity Labels, DLP, Retention and Responsible AI
Microsoft Purview and Copilot data security is the set of controls that classify, protect, retain and monitor Microsoft 365 data, together with the rules that decide which of that data Microsoft 365 Copilot can use in an answer. This lesson covers AB-900 task 2.1: what Information Protection, DLP, Insider Risk Management, Communication Compliance, DSPM for AI and Data Lifecycle Management each do; when to use sensitivity labels and how they're applied; how Purview classifies data; how retention works; and how Copilot reaches data through Microsoft Graph while honouring permissions, labels, DLP and Defender controls and Microsoft's responsible AI principles.
On this page10 sections
- What each Microsoft Purview solution does
- DSPM for AI: the Purview hub for AI activity
- Use cases for sensitivity labels
- How sensitivity labels get applied
- Data classification in Microsoft Purview
- Retention: policies, labels and the principles of retention
- How Copilot accesses data and how Microsoft Graph shapes its answers
- Microsoft's data commitments for Copilot
- How Copilot honours Microsoft 365, Purview and Defender controls
- Microsoft's responsible AI principles
- Match a requirement to the right Microsoft Purview solution: Information Protection, DLP, Insider Risk Management, Communication Compliance, DSPM for AI or Data Lifecycle Management.
- Identify use cases for sensitivity labels on files, emails, groups and sites, and choose how labels should be applied: manual, default, mandatory, client-side or service-side auto-labeling.
- Choose between sensitive information types, trainable classifiers and exact data match to classify data.
- Distinguish retention policies from retention labels and apply the principles of retention, including where retained and Copilot content is stored.
- Explain how Microsoft 365 Copilot grounds answers in Microsoft Graph as the user, why permissions decide what it can see, and how Copilot connectors bring in external content.
- Describe how Copilot honours sensitivity label usage rights, label inheritance, DLP for the Copilot location and Defender for Cloud Apps controls.
- Recognise Microsoft's six responsible AI principles in practical situations.
What each Microsoft Purview solution does
Microsoft Purview is Microsoft's family of data security, governance and compliance solutions, and each one answers a different question about your data. AB-900 names six of them, and most questions on this task describe a requirement and expect you to pick the solution whose job matches it.
| Solution | Its job | When it acts | Typical requirement |
|---|---|---|---|
| Information Protection | Discover, classify and protect data with sensitivity labels (encryption, markings, container settings) | When content is created, edited or labeled, and from then on wherever the file goes | "Board papers must stay readable only by directors, wherever a copy ends up" |
| Data Loss Prevention (DLP) | Stop sensitive data leaving through risky actions, with policy tips, warnings and blocks | In real time, at the moment of sharing, sending, copying or prompting | "Warn users, and block if needed, when they email bank account numbers outside the company" |
| Insider Risk Management | Correlate risky user activities into risk scores and alerts, with users pseudonymized by default | Over time, across sequences of activity | "A departing employee mass-downloaded files and copied them to USB" |
| Communication Compliance | Detect inappropriate or sensitive message content and route it to designated reviewers | After messages are sent, through a review workflow | "Find harassment or threats in Teams chats, email and Copilot interactions" |
| DSPM for AI | Show how people use Microsoft 365 Copilot and other AI apps, what sensitive data is in those interactions, and recommend ready-made policies | Continuously, as a reporting and recommendations hub | "One place to see sensitive data shared with AI apps and turn on protections" |
| Data Lifecycle Management | Retain content for a required period and delete it when it's no longer needed, using retention policies and retention labels | For the whole retention period, then at expiry | "Keep everything in the project sites for six years, then remove it" |
Two near-neighbours appear as distractors: eDiscovery searches for and holds content for legal cases (a hold preserves content for as long as the case needs it, with no automatic deletion), and Compliance Manager tracks regulatory controls and improvement actions. Neither replaces the six solutions above. Using these tools to investigate risk (Compliance Manager, Data explorer, Activity explorer, alert triage, Content search) is covered in the lesson on data protection risks and SharePoint oversharing.
Insider Risk Management vs Communication Compliance vs DLP
Insider Risk Management looks at what users do, Communication Compliance looks at what users say, and DLP evaluates a single action as it happens. All three can involve sensitive data, which is why they are easy to confuse.
| Insider Risk Management | Communication Compliance | DLP | |
|---|---|---|---|
| Looks at | Sequences of user activities: downloads, copying to USB, printing, uploading to cloud storage, sharing externally, risky AI use | The content of messages in Teams, Exchange email, Viva Engage and Copilot interactions | One action on one item, such as sending an email or sharing a file |
| Typical trigger | An HR signal such as a resignation date, then activity around it | Policy conditions such as harassment, threats, profanity or sensitive information types | Content that matches a sensitive information type or label |
| Output | Risk scores, alerts and cases for investigators | Matching messages in a queue for reviewers to remediate | A policy tip, a block (optionally with override) and an alert |
| Privacy | Usernames are pseudonymized by default; authorized investigators can reveal them | Reviewers see the flagged messages; access is limited to assigned roles | The user sees the tip; admins see the alert |
Choose DLP when the requirement is to warn or stop someone while they share. Choose Insider Risk Management when several signals must be correlated over time, especially around a departure. Choose Communication Compliance when the concern is the tone or content of messages and people need to review them.
DSPM for AI: the Purview hub for AI activity
Data Security Posture Management (DSPM) for AI is the place in the Microsoft Purview portal that shows how people in the organization use AI apps and what sensitive data flows through them. It covers Microsoft 365 Copilot and Copilot Chat, Copilot Studio agents and third-party AI apps, including consumer chatbot websites.
- Reports show AI interactions, which users and apps are involved and which sensitive information types appear in prompts and responses.
- Recommendations create supporting policies in one click: DLP policies (for example, to stop sensitive data being pasted into AI sites), Insider Risk Management policies for risky AI usage, Communication Compliance policies for inappropriate AI interactions, and collection policies that capture interactions so they can be reported on.
- Third-party AI sites are seen mainly from devices onboarded to Microsoft Purview (endpoint DLP) with the Microsoft Purview browser extension, or through a network data security integration with a SASE/SSE provider; connectors also cover some enterprise AI apps. With none of these in place, DSPM for AI can't see what users type into a consumer website.
DSPM for AI tells you what data goes into AI apps. Microsoft Defender for Cloud Apps answers a different question, which AI apps are being used, and can block them (see the Defender section below). Microsoft now labels this experience DSPM for AI (classic) and is moving its features into the newer, unified Data Security Posture Management, which covers AI apps and agents alongside other data; the exam guide still uses the name DSPM for AI. Day-to-day use of DSPM for AI to discover and manage AI activity is covered in the lesson on data protection risks.
Use cases for sensitivity labels
A sensitivity label classifies an item and can protect it. Labels are published to users through label policies, and each label carries settings that take effect when it is applied. Labels have two scopes.
Files and emails
- Encryption: the label specifies who can open the content and what they can do (usage rights such as VIEW, EDIT, PRINT, EXTRACT). Encryption is embedded in the file, so it travels with it: a downloaded copy or an attachment forwarded outside the company still checks permissions whenever someone tries to open it.
- Content marking: headers, footers and watermarks such as "Confidential – internal only".
- Classification on its own: a label without protection still records how sensitive an item is, which DLP policies, Copilot and reports can use.
Groups and sites (containers)
When labels are configured for groups and sites, a user picks the label while creating a team, Microsoft 365 group or SharePoint site, and the label sets the container's privacy (public or private), whether guests can be added, the site's external sharing level and access from unmanaged devices. No admin has to configure each site by hand. A container label does not label the files stored inside it.
Sensitivity labels vs retention labels
| Sensitivity label | Retention label | |
|---|---|---|
| Purpose | Classify and protect | Keep for a period, then delete (or review) |
| Can do | Encrypt, add markings, set container privacy and sharing | Retain, delete, declare an item a record |
| Belongs to | Information Protection | Data Lifecycle Management (and Records Management) |
An item can have one sensitivity label and one retention label at the same time, because they do different jobs. Neither one places an item on legal hold; that's eDiscovery.
How sensitivity labels get applied
Labels can be applied by users, by defaults in the label policy, or automatically from content. The method you choose depends on whether a user will be involved and whether the content is new or already stored.
| Method | Where it's set | What happens | Needs a user to act? |
|---|---|---|---|
| Manual labeling | Published label policy | The user picks a label in an Office app or Outlook | Yes |
| Default label | Label policy | Unlabeled documents and emails get the label automatically, whatever their content: new ones, and existing ones when they're opened in supported Office apps | No, but it acts only inside the apps, when someone creates or opens an item |
| Mandatory labeling | Label policy | The user is prompted to choose a label when they open or save an unlabeled document, or send an unlabeled email | Yes, the user picks |
| Client-side auto-labeling | The label's own auto-labeling settings for files and emails | When the user edits content that matches conditions (for example, a credit card number), the Office app either recommends the label, which the user can dismiss, or applies it | Yes, it runs while the user works in the file |
| Service-side auto-labeling policy | An auto-labeling policy for SharePoint, OneDrive and Exchange | The service labels matching content with no user involvement | No |
Two details decide many scenarios:
- Files nobody will open. Every client-side method acts only when someone creates, edits or saves a file. To label thousands of existing files at rest in SharePoint or OneDrive, use a service-side auto-labeling policy. Service-side policies can't recommend a label, because no user sees them.
- Email at rest vs in transit. A service-side policy for Exchange labels emails as they are sent or received after the policy is on. It does not label emails already stored in mailboxes, so an old backlog stays unlabeled. SharePoint and OneDrive files, by contrast, can be labeled at rest.
Data classification in Microsoft Purview
Data classification is how Purview recognises sensitive content so labels, DLP and retention can act on it. There are three main methods, and the requirement tells you which one fits.
| Method | How it recognises content | Best for | What you supply |
|---|---|---|---|
| Sensitive information type (SIT) | Patterns (regular expressions), checksums, keywords and proximity, with confidence levels | Structured values: credit card numbers, passport numbers, bank account numbers | Nothing for the many built-in types; a pattern for a custom SIT |
| Trainable classifier | A machine-learning model that recognises a kind of document | Content with no consistent pattern: resumes, source code, contracts, harassment | Nothing for pre-trained classifiers; sample documents to train a custom one |
| Exact data match (EDM) | Checks detected values against a table of your own real data | Cutting false positives: only numbers that belong to actual customers or employees | An uploaded table of sensitive values (stored hashed) |
A stricter regular expression is still only a pattern: it can't tell a real policyholder number from a well-formed fake. Only EDM compares against your own records. Document fingerprinting is a further SIT option that recognises documents based on a standard template, such as a blank form.
Classification results feed the rest of Purview: they are the conditions in DLP policies, auto-labeling policies and auto-apply retention labels, and they show up in Data explorer and in DSPM for AI reports.
Retention: policies, labels and the principles of retention
Retention in Microsoft Purview Data Lifecycle Management keeps content for as long as it's required and deletes it when it isn't. A retention setting can retain only, delete only, or retain and then delete.
| Retention policy | Retention label | |
|---|---|---|
| Applies to | Whole locations: all or selected mailboxes, sites, OneDrive accounts, Teams chats, Copilot interactions | Individual items: one document or one email |
| Applied by | The admin, with no user action | Users, defaults on a library or folder, or auto-apply policies |
| Records | No | Can declare an item a record (or regulatory record), which restricts editing and blocks deletion |
| Per item | Several policies can cover the same item | One retention label at a time |
Use a retention policy for "keep everything here for N years". Use retention labels when items in the same place need different settings, or must become records. For example, invoices that must be locked as records for longer than the other files stored alongside them in the same finance site.
When settings conflict: the principles of retention
- Retention wins over deletion. An item that one setting must keep isn't permanently deleted by another setting.
- The longest retention period wins.
- Explicit wins over implicit for deletion: a retention label on the item beats a policy on the location.
- The shortest deletion period wins when only deletion settings remain.
Where retained content goes
If a user deletes or edits a retained file in a SharePoint site or OneDrive account, a copy of the original is kept in that site's Preservation Hold library until the retention period ends. Users no longer see it, but compliance tools can. The recycle bins are short-term and aren't where retained copies live. Mailbox items go to the Recoverable Items folder instead. Teams and Copilot messages are kept in hidden mailbox folders (the SubstrateHolds folder once deleted).
Worked example: a spreadsheet in a OneDrive account is covered by "retain four years, then delete" and "delete after one year". The owner deletes it after six months. A copy is kept in the Preservation Hold library; retention wins over the one-year deletion, so the copy survives past year one, and it is permanently deleted when the four-year retention period ends.
How Copilot accesses data and how Microsoft Graph shapes its answers
Microsoft 365 Copilot answers with organizational data by retrieving it through Microsoft Graph as the signed-in user, at the moment the prompt is asked. It doesn't know your data in advance, and your data isn't built into the model.
Microsoft has begun renaming Microsoft 365 Copilot to Microsoft Copilot (and Copilot Chat to Microsoft Copilot Chat); this lesson keeps the names the exam guide and the Purview DLP location still use.
- The user enters a prompt in an app such as Word, Outlook, Teams or Copilot Chat.
- Grounding: Copilot searches Microsoft Graph for relevant emails, files, chats, meetings and calendar items the user can access, using the semantic index to find related content, and adds what it finds to the prompt. The user's working context (the open document or meeting) is included too. Web search grounding, where it's allowed, adds public web results only.
- The large language model writes a response from that grounded prompt.
- Copilot runs responsible AI checks and returns the answer with citations to its sources.
Permission trimming
Copilot only uses organizational content that the user has at least view permission to. The Copilot license, admin roles, or whether the user has opened a file before don't widen or narrow that. So two users can ask the same question and get different answers: a colleague with access to a salary review file may see it cited, while someone without access gets an answer that never mentions it. The flip side is oversharing: content that is shared too widely today (for example, a site open to everyone) becomes much easier to find once Copilot can surface it. Finding and fixing oversharing is covered in the lesson on data protection risks and SharePoint oversharing.
Bringing external content in: Copilot connectors
To let Copilot use content from a system outside Microsoft 365, such as a third-party wiki or IT service desk, an admin sets up a Copilot connector (previously called a Microsoft Graph connector) in the Microsoft 365 admin center. The connector indexes the external items into Microsoft Graph together with their access control lists, so permission trimming applies and each user sees only the items they're allowed to see in the source system. Copying an export into a SharePoint site or into an agent's knowledge flattens those permissions to whoever can reach the copy. Power Platform connectors are a different feature: they let apps and flows call services and don't feed Copilot's grounding.
Microsoft's data commitments for Copilot
Prompts, responses and the Microsoft Graph data Copilot uses are processed under the same commitments as the rest of your Microsoft 365 content. The main exception is web search: when it's allowed, Copilot sends a generated search query (not the whole prompt or your files) to the Bing search service, which sits outside the Microsoft 365 service boundary. Data-residency details also have caveats, so check Microsoft's current privacy documentation for regional commitments such as the EU Data Boundary.
- No training on your data. Prompts, responses and data accessed through Microsoft Graph aren't used to train the foundation large language models, and there's no per-tenant model trained on your data.
- Stored, not discarded. Prompts and responses form the user's Copilot activity history. Microsoft stores them in a hidden folder in the user's Exchange Online mailbox. It isn't meant to be opened directly; it exists so compliance tools can act on the messages.
- Searchable and governable. Because they sit in the mailbox, Copilot interactions can be found with Content search and eDiscovery, and kept or deleted with retention policies. The audit log records that an interaction happened, but you use eDiscovery to review what was typed.
- No human review for abuse monitoring. Microsoft 365 Copilot is opted out of the abuse-monitoring process in which people at Microsoft review flagged content.
Retention for Copilot interactions
Retention policies have a location for Copilot messages called Microsoft Copilot experiences. Microsoft used to combine Copilot interactions with Teams chats in one location and has separated them, so Copilot prompts and responses and Teams chats can each have their own retention period. The Exchange mailboxes location doesn't cover the hidden Copilot folder, and DLP policies never delete content on a schedule.
How Copilot honours Microsoft 365, Purview and Defender controls
Copilot doesn't bypass existing protections: it works inside the controls already set in Microsoft 365, Microsoft Purview and Microsoft Defender, and some of those controls have Copilot-specific settings.
Microsoft 365: permissions
SharePoint, OneDrive, Teams and Exchange permissions decide what each user, and therefore Copilot acting for them, can reach. Tightening sharing is the first control against oversharing.
Microsoft Purview: sensitivity labels
- Encryption usage rights. To return text from an encrypted item, Copilot needs the user to have both VIEW and EXTRACT rights. With VIEW but no EXTRACT (for example, a Viewer permission level), Copilot doesn't summarize the content, but it can still return a link so the user can open the file themselves.
- Label inheritance. When Copilot creates content from labeled sources, the new content inherits the highest-priority label among them. Unusually, this replaces a lower-priority label already on the document, whether it was applied manually, automatically or as the policy default.
Microsoft Purview: DLP for Copilot
A DLP policy can target the Microsoft 365 Copilot and Copilot Chat location. Its main conditions are these two, which can't be combined in the same rule:
- Content contains sensitivity labels: Copilot doesn't use files and emails with those labels in its responses. The items can still appear as citations, and users' own access to them is unchanged.
- Prompt contains sensitive information types: Copilot can be stopped from using that prompt for web search; stopping Copilot from responding to the prompt at all is in preview.
A third condition, for email received from external users, is also in preview.
This DLP policy doesn't change labels, block users from opening files or delete interactions. Compare it with Restricted Content Discovery, a per-site SharePoint setting that hides a whole site's content from Copilot (labeled or not), and with removing EXTRACT from a label, which also stops users copying the content.
Microsoft Defender: shadow AI apps
Microsoft Defender for Cloud Apps discovers which cloud and generative AI apps employees use (Cloud Discovery, with risk scores from the cloud app catalog). Tagging an app Unsanctioned blocks it automatically on devices onboarded to Microsoft Defender for Endpoint, when the Defender for Endpoint integration is set to enforce app access. The Monitored tag watches without blocking. Conditional Access in Microsoft Entra ID only controls apps users sign in to with Entra ID, so it can't block a consumer AI website with its own sign-in.
Microsoft's responsible AI principles
Microsoft builds Copilot and its other AI systems against six responsible AI principles. AB-900 describes a situation and asks which principle it supports or violates.
| Principle | What it means | Example |
|---|---|---|
| Fairness | AI treats people equitably and allocates opportunities without bias | A model that recommends promotions less often for equally rated employees of one ethnic group violates fairness |
| Reliability and safety | AI behaves consistently and safely, including in unexpected conditions | Testing and content filters that stop harmful output |
| Privacy and security | AI protects personal and organizational data and respects permissions | Copilot using only content the user can access; no training on tenant data |
| Inclusiveness | AI is designed to empower and engage everyone, including people with disabilities | Accessible interfaces and support for many languages |
| Transparency | People can understand how the system works and its limitations | Citations to sources and notices that AI-generated content may be wrong |
| Accountability | People remain responsible for AI systems and their outcomes | Naming who answers for an agent's outcomes and who can switch it off |
The common mix-ups are fairness vs inclusiveness (biased outcomes vs designing for everyone) and transparency vs accountability (understanding the system vs who answers for it).
Tip. Expect short admin scenarios that describe a requirement and ask which Purview solution, label setting, classification method, retention option or Copilot control meets it. Questions usually add a constraint, such as whether a user will be involved, whether content is new or already stored, how precise detection must be, or what must stay unchanged, so read the whole scenario rather than matching on a feature name. Know the near-twins: DLP vs Insider Risk Management vs Communication Compliance, DSPM for AI vs Defender for Cloud Apps, sensitivity vs retention labels, default vs mandatory vs client-side vs service-side labeling, SIT vs trainable classifier vs exact data match, retention policy vs label, Preservation Hold library vs recycle bin, Copilot connector vs Power Platform connector, and fairness vs inclusiveness or transparency vs accountability. Harder items combine two rules, such as two retention principles, or label priority with inheritance. A few items ask you to select two answers.
- DLP stops risky sharing in real time; Insider Risk Management correlates user activities (pseudonymized); Communication Compliance reviews message content; DSPM for AI shows AI usage and offers one-click policies; Data Lifecycle Management retains and deletes.
- Sensitivity labels classify and protect: encryption travels with the file, markings add headers, footers and watermarks, and container labels set privacy, guest access and external sharing for teams, groups and sites.
- Client-side labeling (default, mandatory, auto-labeling in Office apps) needs a user working in the file; service-side auto-labeling policies label SharePoint and OneDrive content at rest and email only in transit.
- Sensitive information types match patterns, trainable classifiers recognise kinds of documents, and exact data match checks values against your own table.
- Retention policies cover whole locations; retention labels cover individual items, one at a time, and can declare records. Retention wins over deletion and the longest retention period wins.
- Retained SharePoint and OneDrive files that users delete are kept in the Preservation Hold library; Copilot prompts and responses are kept in a hidden folder of the user's mailbox.
- Copilot grounds prompts in Microsoft Graph as the signed-in user, so it only uses content that user can at least view, and overshared content becomes easier to find.
- Copilot connectors index external content into Graph with its access lists; prompts, responses and Graph data aren't used to train foundation models.
- Copilot needs VIEW and EXTRACT to return text from encrypted content, new content inherits the highest-priority source label, and a DLP policy for the Microsoft 365 Copilot and Copilot Chat location can keep labeled items and sensitive prompts out of Copilot's processing.
- Defender for Cloud Apps discovers generative AI apps and blocks Unsanctioned ones on Defender for Endpoint devices; the six responsible AI principles are fairness, reliability and safety, privacy and security, inclusiveness, transparency and accountability.
Frequently asked questions
Can Microsoft 365 Copilot show users files they can't normally open?
No. Microsoft 365 Copilot retrieves organizational content through Microsoft Graph on behalf of the signed-in user, so it only uses items that user already has at least view permission to. The risk is oversharing: files that are shared too widely are already open to those users, and Copilot makes them much easier to find, so permissions should be reviewed before rollout.
Is Copilot data used to train Microsoft's AI models?
No. Microsoft states that prompts, responses and data accessed through Microsoft Graph aren't used to train the foundation large language models behind Microsoft 365 Copilot. The interactions are stored in Microsoft 365 under the same commitments as other content, in a hidden folder of the user's mailbox, where eDiscovery and retention policies can act on them.
What is the difference between a sensitivity label and a retention label?
A sensitivity label classifies and protects content, for example by encrypting a file so only certain people can open it, adding watermarks, or setting a team's privacy and guest access. A retention label controls how long an individual item is kept and whether it's deleted afterwards, and it can declare the item a record. An item can carry one of each at the same time.
When should I use exact data match instead of a sensitive information type?
Use exact data match when a pattern-based sensitive information type produces too many false positives and you only care about values that belong to your real customers or employees. Exact data match compares detected values with a table of your own data that you upload, while a sensitive information type, even with a stricter pattern, flags anything in the right format.
Why didn't my Exchange auto-labeling policy label old emails?
A service-side auto-labeling policy for Exchange labels emails as they are sent or received after the policy is turned on. It doesn't inspect emails already stored in mailboxes, so an existing backlog stays unlabeled. SharePoint and OneDrive auto-labeling policies, by contrast, can label files at rest.
How can a DLP policy keep labeled content out of Copilot?
A Microsoft Purview DLP policy for the Microsoft 365 Copilot and Copilot Chat location can use a rule whose condition is that content contains chosen sensitivity labels. Copilot then doesn't use files and emails with those labels to write its responses, although they can still appear as citations. The policy acts only on Copilot's processing: it doesn't relabel content or change what users can open.
Where are Copilot prompts and responses stored, and how long are they kept?
Microsoft 365 Copilot prompts and responses are stored in a hidden folder in the Exchange Online mailbox of the user who used Copilot. How long they're kept is up to the organization: a retention policy for the Microsoft Copilot experiences location can retain them or delete them after a set period, independently of Teams chat retention, and eDiscovery can search them.
What are Microsoft's six responsible AI principles?
Microsoft's six responsible AI principles are fairness, reliability and safety, privacy and security, inclusiveness, transparency, and accountability. Fairness is about equitable outcomes, inclusiveness about designing for everyone, transparency about people understanding how the system works and its limits, and accountability about people remaining responsible for AI outcomes.
Source
This lesson covers the "Understand data protection and governance tasks for Microsoft 365 and Copilot" domain of the official AB-900 exam guide. Vendors revise their guides — check the source for the current version.
Sign up free to mark lessons complete, bookmark topics and track your exam readiness.