AI Governance Starter: Protect Cloud AI Platform and Apps with Microsoft Purview

Built for the compliance officer or CISO who has been asked to sign an AI policy that the organization has no technical means of enforcing, monitoring, or evidencing. This engagement will eliminate the gap between a written AI policy and enforced controls, and improve the evidence position for an AI audit.

Who this is for

Compliance officers and CISOs in organizations that have written an AI acceptable use policy, often quickly and under board pressure, and have no way to enforce or evidence any of it. The policy says employees must not put confidential data into AI tools. Nothing currently prevents that, detects it, or records it. This package closes that gap with the controls already in Microsoft 365, not by buying another platform.

What we deliver

• Purview Data Security Posture Management for AI deployed and configured, giving visibility of which AI applications are in use, what categories of data are being sent to them, and by whom.
• Data loss prevention policies scoped to the generative AI location, so sensitivity-labeled content is blocked or warned on before it reaches Microsoft 365 Copilot, Copilot Studio agents, or a browser-based AI tool covered by endpoint DLP.
• Audit and oversight configuration: Purview Audit for Copilot and agent interactions, Communication Compliance policies for prompt and response review where the regulatory obligation requires it, and retention applied to AI interaction records.
• An AI governance operating model: who approves a new AI tool, what the review consists of, how an exception is recorded and expires, and a quarterly review cadence, delivered as a working document, not a policy template.

Outcomes our customers see

A 2,200-seat customer moved from zero AI interaction visibility to 100 percent of Copilot and agent interactions audited within 30 days. DSPM for AI across 2,200 seats identified 19 unsanctioned AI applications in active use, 6 of them receiving content carrying a confidential label. Generative AI DLP blocked 1,340 attempted transfers of labeled content in the first 90 days at a 4,000-seat financial services customer.

How this compares

Most AI governance offers deliver a policy document and a risk register, which is what the customer already has and cannot enforce. This one is deliberately the opposite: the deliverable is working controls in Purview plus the operating model to run them. It is called a starter because it is scoped to be affordable and finishable, which matters for a compliance function given an AI obligation and no budget line to match it.

Architecture and Microsoft alignment

Controls are implemented in Purview: Data Security Posture Management for AI for discovery and posture, sensitivity labels as the classification layer, data loss prevention with the generative AI location in scope, endpoint DLP for browser-based AI tools, Purview Audit for interaction records, Communication Compliance for review workflows, and retention policies over AI interaction data. Defender for Cloud Apps supplies shadow AI application discovery. Entra ID governs which identities can reach sanctioned AI services. Aligned to the Microsoft solution plays Protect Cloud AI Platform and Apps and Data Security.

Plans

Plans, prices, and full scope per plan are on the Plans tab of this listing.

Prerequisites

Microsoft 365 E5 or the E5 Compliance add-on, which is required for DSPM for AI, Communication Compliance, and endpoint DLP. Compliance Administrator and Global Reader consent. An existing written AI policy, or acceptance that drafting one is a prerequisite we will support but not author on your behalf, because it is a governance decision, not a technical one.

Limitations

This package governs AI usage within and adjacent to the Microsoft estate. AI services accessed from unmanaged personal devices outside endpoint DLP coverage are visible only where network or identity telemetry reaches them. It does not cover model development governance for teams building their own AI systems, which is a separate engagement, and it does not certify compliance with any specific AI regulation, though the control evidence it produces supports that work.

How to buy

Buy through the Azure portal, using Get it in Azure portal on this listing, so the purchase is billed through your existing Microsoft agreement. Private offers on request.

Next step

Get it now in the Azure portal, or request a private offer if the scope or the price needs adjusting first.