Data Protection and Governance for Microsoft 365 and Copilot · Topic 1 of 6
Purview Solutions at a Glance
AB-900 Purview basics: what Information Protection, DLP, Insider Risk, Communication Compliance, DSPM for AI and Data Lifecycle Management do.
- 4 min
- Information Protection labels and protects. DLP stops sharing. Retention is Data Lifecycle Management.
- Insider Risk Management looks at user activity. Communication Compliance looks at message content.
- DSPM for AI is the Purview view of AI activity and oversharing risk.
What it is
Microsoft Purview is the set of data security, governance and compliance solutions for Microsoft 365. You use it in the Microsoft Purview portal. For AB-900 you do not need to configure these solutions in depth. You need to know what each one is for, so you can pick the right one for a simple need.
Six solutions matter here. Each answers a different question about your data.
How it works
The six solutions
| Solution | Question it answers | Typical action |
|---|---|---|
| Information Protection | How sensitive is this item, and how do we protect it? | Apply a sensitivity label that can encrypt and mark the item |
| Data Loss Prevention (DLP) | Is sensitive data about to leave the organization? | Warn, block or alert when a policy matches |
| Insider Risk Management | Is a user doing something risky with our data? | Raise an alert about patterns such as bulk downloads before leaving |
| Communication Compliance | Do messages break company or legal rules? | Flag inappropriate or risky messages for review |
| DSPM for AI | How are people and agents using AI with our data? | Show AI activity and oversharing risk, with ready made policies |
| Data Lifecycle Management | How long must we keep this, and when should it go? | Retain or delete content with retention policies and labels |
Information Protection
Information Protection discovers and classifies data, then protects it with sensitivity labels. A label can encrypt a file, add a watermark and travel with the content. The next page covers labels in detail.
Data Loss Prevention
DLP policies watch where data goes. They cover places such as Exchange email, SharePoint, OneDrive, Teams chats and devices. When a policy matches, it can show a policy tip, block the action or notify an administrator. DLP also has a location for Microsoft 365 Copilot, so you can stop Copilot using content that carries chosen labels.
Insider Risk Management
Insider Risk Management looks for risky activity by people inside the organization, whether careless or malicious. Policies are built from templates, for example data theft by departing users or data leaks. Users are analyzed with their identity hidden by default, which protects privacy. Alerts then go to reviewers.
Communication Compliance
Communication Compliance scans messages for policy violations. It covers Exchange email, Teams, Viva Engage and also Copilot interactions. Examples are harassment, sharing of sensitive information and regulatory breaches. Reviewers get a queue of flagged messages and decide what to do.
DSPM for AI
Data Security Posture Management (DSPM) for AI is a place in the Purview portal to see and secure how Copilot, agents and other AI apps touch your data. It shows AI activity, runs data risk assessments to find oversharing, and offers one click policies. Microsoft is replacing the classic DSPM for AI view with a newer Data Security Posture Management experience. The idea stays the same.
Data Lifecycle Management
Data Lifecycle Management controls how long content lives. Retention policies and retention labels keep content, delete it, or keep then delete it. This is the solution to name when a rule says "keep for seven years".
A worked example
A company is adopting Copilot. Legal says contracts must be kept for seven years, so Data Lifecycle Management gets a retention policy. Contracts are marked Confidential with a sensitivity label from Information Protection, which encrypts them. DLP blocks emailing card numbers to outsiders. Insider Risk Management watches for bulk downloads by staff who resigned. Communication Compliance reviews Teams messages for harassment. DSPM for AI shows how Copilot is being used and where data is overshared.
How the exam asks about this
- "Which solution encrypts a document and marks it Confidential?" Information Protection, with a sensitivity label.
- "Which solution detects a departing employee downloading many files?" Insider Risk Management.
- "Which solution keeps contracts for seven years and then deletes them?" Data Lifecycle Management.
What to remember for the exam
- Information Protection labels and protects. DLP stops sharing. Retention is Data Lifecycle Management.
- Insider Risk Management looks at user activity. Communication Compliance looks at message content.
- DSPM for AI is the Purview view of AI activity and oversharing risk.
- All six solutions are managed in the Microsoft Purview portal.
- Several can work together: a label can trigger a DLP rule, and a retention policy can cover Copilot interactions.
Do not mix up Insider Risk Management and Communication Compliance. The first analyzes activity such as downloads and sharing. The second reads message text for violations.
Common mistakes
Choosing DLP when the need is to keep or delete content. DLP prevents leaks. Keeping and deleting is retention, in Data Lifecycle Management.
Assuming Information Protection blocks sharing by itself. A label protects the item, but blocking a send action is the job of a DLP policy.
Treating DSPM for AI as a policy engine only. It also gives visibility: activity, reports and risk assessments for AI use.
Check yourself
Which Purview solution would you use to flag harassing messages in Teams?
Communication Compliance.
Which solution reports on Copilot and agent activity and helps find oversharing?
DSPM for AI.
Which solution applies retention policies?
Data Lifecycle Management.
Topic 1 of 6 in Data Protection and Governance for Microsoft 365 and Copilot
Test yourself on Data Protection and Governance for Microsoft 365 and Copilot
The full Microsoft AB-900 question bank has 499 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.