Skip to main content

Challenge 26: AI Security – Data Overexposure in SharePoint & Purview DSPM

Exam skills covered​

  • Identify and mitigate data overexposure risks before deploying AI workloads
  • Configure Microsoft Purview Data Security Posture Management (DSPM) for AI
  • Assess SharePoint site permissions for oversharing
  • Implement sensitivity labels to protect data surfaced by Copilot
  • Monitor data exposure risks through Purview compliance portal

Scenario​

Contoso Ltd is preparing to deploy Microsoft 365 Copilot to 5,000 users. The CISO is concerned that Copilot will surface sensitive documents that are currently overshared via SharePoint Online — including HR records, financial forecasts, and M&A documents stored in broadly permissioned sites. You must assess and remediate data overexposure risks using Purview DSPM for AI before enabling Copilot.

Prerequisites​

  • 🔒 License required: Microsoft 365 E5 + Microsoft Purview DSPM for AI add-on
  • Global Administrator or Compliance Administrator role in Microsoft 365
  • SharePoint Administrator role
  • Microsoft Purview portal access
  • Azure AD PowerShell module or Microsoft Graph PowerShell SDK installed

Task 1: Assess current SharePoint oversharing risks​

Run the SharePoint Advanced Management (SAM) oversharing report to identify sites with broad access.

# Connect to SharePoint Online
Connect-SPOService -Url "https://contoso-admin.sharepoint.com"

# Get sites with "Everyone except external users" permissions
Get-SPOSite -Limit All | ForEach-Object {
    $site = $_
    $groups = Get-SPOSiteGroup -Site $site.Url
    $overshared = $groups | Where-Object {
        $_.Users -contains "c:0-.f|rolemanager|spo-grid-all-users/$($site.Url)"
    }
    if ($overshared) {
        [PSCustomObject]@{
            SiteUrl = $site.Url
            Title = $site.Title
            OversharedGroups = ($overshared.Title -join ", ")
            StorageUsageMB = $site.StorageUsageCurrent
        }
    }
} | Export-Csv -Path "oversharing-report.csv" -NoTypeInformation
# Identify sites with anonymous sharing links
Get-SPOSite -Limit All -IncludePersonalSite $false | Where-Object {
    $_.SharingCapability -eq "ExternalUserAndGuestSharing" -or
    $_.SharingCapability -eq "Anyone"
} | Select-Object Url, Title, SharingCapability

Task 2: Enable Purview DSPM for AI​

Configure the Data Security Posture Management dashboard for AI workloads.

  1. Navigate to Microsoft Purview portal → Solutions → DSPM for AI
  2. Click Get started to activate the DSPM for AI solution
  3. Under Data assessments, click New assessment
  4. Configure the assessment:
    • Name: "Pre-Copilot Data Exposure Assessment"
    • Scope: All SharePoint Online sites
    • Assessment type: Oversharing detection
  5. Click Start assessment and wait for completion (may take 24-48 hours)
# Use Microsoft Graph API to check DSPM assessment status
Connect-MgGraph -Scopes "InformationProtection.Read.All"

# Query Purview DSPM assessments via Graph
$uri = "https://graph.microsoft.com/beta/security/informationProtection/datasecurityposture/assessments"
Invoke-MgGraphRequest -Method GET -Uri $uri

Task 3: Configure sensitivity labels for AI-critical content​

Create and apply sensitivity labels to protect high-value content from being surfaced by Copilot.

# Connect to Security & Compliance PowerShell
Connect-IPPSSession

# Create sensitivity label for highly confidential data
New-Label -DisplayName "Highly Confidential - No AI" `
    -Name "HC-NoAI" `
    -Tooltip "Content excluded from AI processing" `
    -Comment "Applied to content that should not be surfaced by Microsoft 365 Copilot" `
    -ContentType "File, Email, Site"

# Configure label encryption settings
Set-Label -Identity "HC-NoAI" `
    -EncryptionEnabled $true `
    -EncryptionProtectionType "Template" `
    -EncryptionDoNotForward $false `
    -EncryptionOfflineAccessDays 30

# Create auto-labeling policy for financial documents
New-AutoSensitivityLabelPolicy -Name "Auto-Label-Financial-NoAI" `
    -SharePointLocation "All" `
    -ExchangeLocation "All" `
    -Mode "Simulate"

New-AutoSensitivityLabelRule -Policy "Auto-Label-Financial-NoAI" `
    -Name "Financial-Pattern-Match" `
    -SensitiveInformationType @{
        Name = "Credit Card Number"; minCount = 1
    }, @{
        Name = "U.S. Bank Account Number"; minCount = 1
    } `
    -ApplySensitivityLabel "HC-NoAI"

Task 4: Restrict SharePoint site access to reduce oversharing​

Remediate the top overshared sites identified in Task 1.

# Remove "Everyone except external users" from specific sites
$sitesToRemediate = @(
    "https://contoso.sharepoint.com/sites/HRConfidential",
    "https://contoso.sharepoint.com/sites/Finance-MA",
    "https://contoso.sharepoint.com/sites/ExecutiveComp"
)

foreach ($siteUrl in $sitesToRemediate) {
    # Restrict site sharing capability
    Set-SPOSite -Identity $siteUrl -SharingCapability "Disabled"

    # Remove broad access groups
    $groups = Get-SPOSiteGroup -Site $siteUrl
    foreach ($group in $groups) {
        $broadUsers = $group.Users | Where-Object {
            $_ -like "*spo-grid-all-users*" -or
            $_ -like "*nt:s-1-1-0*"
        }
        if ($broadUsers) {
            foreach ($user in $broadUsers) {
                Remove-SPOUser -Site $siteUrl -Group $group.Title -LoginName $user
                Write-Host "Removed $user from $($group.Title) on $siteUrl"
            }
        }
    }
}
# Enable Restricted Access Control for sensitive sites
Set-SPOSite -Identity "https://contoso.sharepoint.com/sites/HRConfidential" `
    -RestrictedAccessControl $true

# Configure site-level Conditional Access policy
Set-SPOSite -Identity "https://contoso.sharepoint.com/sites/Finance-MA" `
    -ConditionalAccessPolicy "AllowLimitedAccess" `
    -LimitedAccessFileType "WebPreviewableFiles"

Task 5: Monitor DSPM for AI recommendations​

Review and act on DSPM recommendations to improve data security posture before Copilot deployment.

  1. Navigate to Microsoft Purview portal → DSPM for AI → Recommendations
  2. Review the following recommendation categories:
    • Overshared content: Sites with broad permissions containing sensitive data
    • Unlabeled sensitive content: Files matching sensitive info types without labels
    • External sharing risks: Content shared externally that AI could reference
  3. For each high-priority recommendation:
    • Click View details to see affected sites/files
    • Click Take action to apply suggested remediation
    • Set Priority to track remediation progress
# Use Graph API to retrieve DSPM recommendations
$uri = "https://graph.microsoft.com/beta/security/informationProtection/datasecurityposture/recommendations"
$recommendations = Invoke-MgGraphRequest -Method GET -Uri $uri

# Filter high-severity recommendations
$recommendations.value | Where-Object { $_.severity -eq "high" } | ForEach-Object {
    [PSCustomObject]@{
        Title = $_.title
        Category = $_.category
        AffectedAssets = $_.affectedAssetsCount
        RecommendedAction = $_.recommendedAction
    }
}

Task 6: Create a Copilot readiness report​

Generate a summary report combining oversharing findings with DSPM insights.

# Generate readiness summary
$report = @{
    AssessmentDate = Get-Date -Format "yyyy-MM-dd"
    TotalSitesScanned = (Get-SPOSite -Limit All).Count
    OversharedSites = (Import-Csv "oversharing-report.csv").Count
    SitesWithAnonymousLinks = (Get-SPOSite -Limit All | Where-Object {
        $_.SharingCapability -eq "Anyone"
    }).Count
    SensitivityLabelsApplied = $true
    DSPMAssessmentComplete = $true
}

$report | ConvertTo-Json | Out-File "copilot-readiness-report.json"

# Verify no remaining high-risk sites
Get-SPOSite -Limit All | Where-Object {
    $_.SharingCapability -eq "Anyone" -and
    $_.StorageUsageCurrent -gt 100
} | Select-Object Url, Title, SharingCapability | Format-Table

Break & Fix​

Scenario 1: Copilot surfaces confidential M&A documents to all employees​

Users report that Microsoft 365 Copilot is returning content from the "Project Titan" M&A site when they ask about company acquisitions. The site was created 6 months ago with "Everyone except external users" as members.

Show solution
# Immediately restrict the site
Set-SPOSite -Identity "https://contoso.sharepoint.com/sites/ProjectTitan" `
    -SharingCapability "Disabled" `
    -RestrictedAccessControl $true

# Remove broad access
Get-SPOSiteGroup -Site "https://contoso.sharepoint.com/sites/ProjectTitan" | ForEach-Object {
    $broadUsers = $_.Users | Where-Object { $_ -like "*spo-grid-all-users*" }
    foreach ($user in $broadUsers) {
        Remove-SPOUser -Site "https://contoso.sharepoint.com/sites/ProjectTitan" `
            -Group $_.Title -LoginName $user
    }
}

# Apply sensitivity label to all content in the site
# This requires SharePoint PnP module
Connect-PnPOnline -Url "https://contoso.sharepoint.com/sites/ProjectTitan" -Interactive
$items = Get-PnPListItem -List "Documents" -PageSize 500
foreach ($item in $items) {
    Set-PnPListItem -List "Documents" -Identity $item.Id `
        -Label "Highly Confidential - No AI"
}

Scenario 2: DSPM assessment shows 0 overshared sites despite known issues​

The DSPM for AI assessment completed but reports no oversharing risks, even though manual review found multiple broadly shared sites with sensitive content.

Show solution
# Verify DSPM has proper permissions
# 1. Check that the Purview service principal has SharePoint read access
Connect-MgGraph -Scopes "Application.Read.All"
$purviewApp = Get-MgServicePrincipal -Filter "displayName eq 'Microsoft Purview'"

# 2. Ensure SharePoint sites are included in assessment scope
# Navigate to Purview portal > DSPM for AI > Settings > Data sources
# Verify "SharePoint Online" is toggled ON and scope is "All sites"

# 3. Check assessment configuration
# Navigate to DSPM for AI > Assessments > Click on the assessment
# Verify:
#   - Status is "Completed" (not "In progress" or "Failed")
#   - Scope includes all SharePoint sites (not filtered to specific sites)
#   - Sensitive info types are properly configured

# 4. Re-run assessment with corrected scope
# Click "Edit assessment" > Ensure scope is "All SharePoint Online sites"
# Enable "Include sites with fewer than 10 files" if needed
# Click "Re-run assessment"

# 5. Verify sensitive info type classifiers are active
Get-DlpSensitiveInformationType | Where-Object { $_.Publisher -eq "Microsoft" } |
    Select-Object Name, State | Where-Object { $_.State -ne "Active" }

Scenario 3: Auto-labeling policy not applying labels to detected sensitive files​

The auto-labeling policy was created in simulation mode and shows matches, but after enabling enforcement, labels are not being applied.

Show solution
# Check policy status
Get-AutoSensitivityLabelPolicy -Identity "Auto-Label-Financial-NoAI" |
    Select-Object Name, Mode, Enabled, WhenChanged

# Switch from simulation to enforcement mode
Set-AutoSensitivityLabelPolicy -Identity "Auto-Label-Financial-NoAI" `
    -Mode "Enable"

# Verify the label exists and is published
Get-Label -Identity "HC-NoAI" | Select-Object Name, Enabled, ContentType

# Ensure label is published to users via a label policy
Get-LabelPolicy | Where-Object {
    $_.Labels -contains "HC-NoAI"
} | Select-Object Name, Enabled

# If no policy publishes the label, create one
New-LabelPolicy -Name "Publish-HC-NoAI-Label" `
    -Labels "HC-NoAI" `
    -ExchangeLocation "All" `
    -SharePointLocation "All"

Knowledge check​

1. What is the primary risk that Purview DSPM for AI helps address before deploying Microsoft 365 Copilot?

2. A SharePoint site has 'Everyone except external users' added to its Members group. What happens when Microsoft 365 Copilot is deployed?

3. Which action should be taken FIRST when preparing for a Copilot deployment from a data security perspective?

4. How does applying a sensitivity label with encryption affect Microsoft 365 Copilot's ability to surface that content?

Cleanup​

# Remove test sensitivity labels and policies (if created in test environment)
Remove-AutoSensitivityLabelPolicy -Identity "Auto-Label-Financial-NoAI" -Confirm:$false
Remove-LabelPolicy -Identity "Publish-HC-NoAI-Label" -Confirm:$false
Remove-Label -Identity "HC-NoAI" -Confirm:$false

# Disconnect sessions
Disconnect-SPOService
Disconnect-MgGraph
Disconnect-ExchangeOnline

# Remove generated reports
Remove-Item "oversharing-report.csv" -ErrorAction SilentlyContinue
Remove-Item "copilot-readiness-report.json" -ErrorAction SilentlyContinue