Key takeaways
- AI introduces new security and governance risks: shadow AI, sensitive-data leakage, and new attacks such as prompt injection and jailbreaks.
- Microsoft splits the response across two complementary families: Purview governs and protects your data; Defender discovers and defends your AI apps and agents.
- Purview’s Data Security Posture Management (DSPM) for AI gives visibility into how AI is using your data, and where sensitive information is exposed.
- Defender discovers shadow AI, manages AI security posture, and detects real-time threats against AI applications.
- For most SMEs, corporates, and non-profits, the priority is visibility first (see what AI is in use and what data it touches) then protect and govern.
AI changes the security picture
Every wave of technology introduces new security considerations, and AI is no exception. What makes AI different is the number of areas it touches at once. It creates new pathways for sensitive information to leave the organisation, makes existing data easier to find and use, and introduces new attack techniques aimed at the AI systems themselves.
For organisations adopting AI, particularly those working with personal, client or member information, security needs to be part of the conversation from the outset. Something as simple as an employee pasting sensitive information into the wrong tool, or an AI agent being granted broader access than intended, can quickly turn a productivity gain into a privacy or compliance issue.
The encouraging news is that Microsoft has developed a comprehensive set of capabilities to help address these challenges. For organisations already invested in the Microsoft cloud, many of these protections build on technologies they may already have in place.
Broadly speaking, Microsoft’s approach falls into two complementary areas. Microsoft Purview focuses on the data itself, helping organisations understand, govern and protect the information that AI systems can access. Microsoft Defender focuses on AI applications and the security threats surrounding them, helping organisations discover how AI is being used and protect those environments from misuse and attack.
Neither is intended to operate in isolation. Purview provides visibility and control over information, while Defender helps secure the systems interacting with it. Used together, they provide a more complete foundation for adopting AI confidently and responsibly.
The new risks AI brings
Before looking at the technology, it is worth understanding the types of risks organisations are trying to manage. While many security principles remain the same, AI introduces several challenges that are becoming increasingly common.
- Shadow AI. Employees are already experimenting with generative AI tools, from public chatbots and browser extensions to meeting assistants, often without formal approval or oversight. The issue is not necessarily the tools themselves, but how organisational information is handled when they are used. For example, an employee might paste a sensitive case note into a free public chatbot to improve its wording, without realising they may be sharing information with a third-party service that has never been assessed or approved by the organisation.
- Data leakage and oversharing. AI assistants such as Copilot make it significantly easier to find and use information. That accessibility is one of their greatest strengths, but it can also expose issues that have existed in the background for years. A folder with overly broad permissions may never have attracted attention when users had to manually search for its contents. With AI, the same information can be surfaced through a simple natural-language question. AI often reveals existing oversharing issues rather than creating them, but the outcome can be the same. (We explore this further in our companion article on AI oversharing.)
- Attacks targeting AI systems. Generative AI introduces a new category of threats, including prompt injection, jailbreak attempts, data poisoning and efforts to extract sensitive information through an AI application. These attacks differ from traditional cyber threats because they target the behaviour of the AI itself. For example, a malicious instruction embedded within a document may attempt to influence how an AI agent interprets information or carries out a task. As organisations deploy more AI-powered tools, understanding and detecting these risks becomes increasingly important.
- Compliance and auditability. Many organisations are also facing growing expectations around transparency and accountability. Boards, regulators, insurers and funding bodies are increasingly asking how AI is being used, what information it can access, and whether its use can be audited if questions arise later. Having clear answers to those questions is becoming an important part of responsible AI governance.
Microsoft Purview: Governing and protecting your data
Microsoft Purview is designed to help organisations understand and protect the data that AI systems interact with. Rather than treating AI as a separate challenge, it extends many of the governance and information-protection capabilities already familiar to Microsoft 365 customers.
A central capability is Data Security Posture Management (DSPM) for AI, which provides visibility into how AI is being used across Copilots, agents and other AI applications. It helps organisations identify where sensitive information may be exposed to AI tools, understand usage patterns, and prioritise the areas that require attention.
For many organisations, this visibility becomes the first meaningful step in their AI governance journey. It is not uncommon to discover that AI tools are already being used more extensively than expected, often before any formal policies or processes have been introduced.
Purview also extends several established information-protection capabilities into the AI environment:
- Sensitivity labels and information protection. Documents and content that have been classified and protected retain those protections when accessed through Copilot. In effect, AI respects the same access and protection controls already applied elsewhere within the organisation.
- Data Loss Prevention (DLP) for AI. DLP policies can be applied to Microsoft 365 Copilot and Copilot Chat, and extended towards third-party AI services. This helps reduce the risk of sensitive information being shared with tools or locations where it should not be.
- Audit, compliance and investigation. AI interactions can be included in audit and compliance processes, supporting eDiscovery, communication compliance and insider risk investigations. This creates a clearer record of how AI is being used and allows organisations to investigate incidents when required.
In practical terms, Purview helps answer a fundamental question:
“As AI gains access to our information, are the right protections, controls and governance measures still in place?”
Microsoft Defender: Discovering and defending your AI
While Purview focuses on information, Microsoft Defender focuses on the AI applications and services themselves.
A key starting point is discovery, particularly where organisations are concerned about shadow AI. Microsoft Defender for Cloud Apps can identify generative AI services being used across the organisation, assess associated risks, and help administrators decide which tools should be approved, monitored or restricted.
Combined with Microsoft Entra for identity and access management and Microsoft Intune for device management, organisations gain greater visibility and control over where corporate information can be accessed and shared. In practice, the goal is rarely to eliminate AI usage altogether. A more effective approach is usually to guide users towards approved services while reducing reliance on tools that present unnecessary risk.
For organisations building or operating AI applications, particularly in Azure environments, Microsoft Defender for Cloud adds further protection.
- AI security posture management helps discover AI workloads, models and agents, maintain an inventory of those assets, and identify configuration issues or attack paths that could increase risk.
- AI threat protection helps detect and respond to threats aimed specifically at generative AI systems, including prompt injection attempts, jailbreak activity, credential theft and data-exfiltration attempts. These capabilities integrate with Microsoft Defender XDR, allowing security teams to investigate AI-related threats alongside their broader security operations.
Taken together, Defender helps organisations answer another important question: “What AI systems are operating across our environment, and do we have the visibility and protection needed to manage them safely?”
Who Owns It: Governance in Action
A system needs an owner. For most organisations, that role is best fulfilled by a small AI Governance Committee that oversees the AIMS on behalf of the board or executive. Its role is to make decisions, not write reports: approving high-impact use cases, maintaining the registers, pausing AI that isn’t behaving as expected, and escalating material risks when needed.
For a smaller organisation, this committee can be lean: a handful of people covering executive sponsorship, privacy, the relevant operational area, IT, and risk or quality. In a non-profit, that might be the operations manager, the person responsible for privacy, and an IT representative meeting together; the roles matter more than the headcount. What matters most is that the committee meets regularly (quarterly is sufficient for many organisations, with the ability to convene quickly if needed), has clear authority, and has a named chair responsible for driving decisions. Governance works best when ownership is clear. Otherwise, responsibility can quickly become everyone’s job, and no one’s.
Two tools, one strategy
The greatest value comes when these capabilities are used together. Microsoft reflects this in its guidance for managing AI-related data risks, bringing together Microsoft Purview, Defender for Cloud Apps, Entra and Intune as part of a coordinated approach.
A simple way to think about it is as two complementary layers of control:
- Control the applications: decide which AI tools and services are permitted, and where organisational data is allowed to go (Defender for Cloud Apps, Entra and Intune).
- Control the data: decide what information can be shared, how it should be protected, and what safeguards remain in place when AI accesses it (Purview).
In practice, many organisations find the journey follows a similar pattern: first discover the AI tools already in use, then manage those that present risk, protect sensitive information, and finally govern AI usage as an ongoing activity rather than a one-off project.
Within that model, Defender provides visibility into the applications being used and helps protect them from threats, while Purview focuses on protecting and governing the information those applications access. Both play an important role. Together, they help organisations adopt AI with greater confidence while maintaining appropriate oversight of security and compliance risks.
One way to picture the relationship is that Defender helps manage the pathways through which AI is introduced into the organisation, while Purview helps ensure the information moving through those pathways remains appropriately protected.
Getting started: A practical sequence
For many smaller organisations, the idea of implementing all these capabilities at once can feel overwhelming. Fortunately, that is rarely necessary. A more measured, phased approach is usually both more achievable and more effective.
A sensible place to begin is visibility. Enable shadow AI discovery in Defender for Cloud Apps and review DSPM for AI within Purview. Spend some time understanding which AI tools are being used and how organisational data is interacting with them. This initial discovery phase often surfaces useful insights and creates a clearer picture of where attention is most needed.
From there, address the most obvious gaps. Review the AI tools currently in use, formally approve the ones that align with your requirements, and assess whether any should be restricted. It is also worth taking the opportunity to review permissions on your most sensitive data sources and ensure appropriate sensitivity labels are in place. These foundations become increasingly valuable as AI adoption expands.
Once those basics are established, organisations can begin extending their protection controls. This may include applying DLP policies to Microsoft 365 Copilot and Copilot Chat, validating that sensitivity labels are working as intended, and ensuring appropriate audit records are available where required.
More advanced threat-protection capabilities can then be introduced as needs mature, particularly for organisations building their own AI solutions or operating AI workloads in Azure. Approached incrementally, each step builds on the previous one, making the overall programme more manageable and sustainable.
What this means for SMEs, corporates, and non-profits
At first glance, AI security can appear to be an enterprise-scale challenge. In reality, many of the same principles apply just as effectively to SMEs and non-profits, often in a much lighter-weight form.
A practical starting point is visibility. Before introducing additional controls, it helps to understand which AI tools are being used and what information they can access. Capabilities such as shadow AI discovery and DSPM for AI can provide valuable insight into the organisation’s current position and help prioritise future efforts.
From there, focus on the protections that will have the greatest impact. For many organisations, that means establishing sensible access controls, applying sensitivity labels to important information, and extending DLP protections to AI-enabled tools such as Copilot. These foundational measures often reduce risk significantly without introducing unnecessary complexity.
As AI adoption grows, organisations can then evaluate whether more advanced capabilities are required. Features focused on protecting custom AI applications, for example, tend to become more relevant when organisations begin developing or deploying their own AI-powered solutions.
It is also worth keeping in mind that Microsoft’s security and compliance capabilities continue to evolve, as do licensing options and feature availability. Before investing in additional tooling, it is often worthwhile reviewing what is already included within existing licences. Many organisations discover they have access to capabilities they have not yet enabled, particularly where higher-tier or non-profit licensing programmes are in place.
At 365 Architechs, we help SMEs, corporates, and non-profits take a practical approach to securing AI adoption, using Microsoft Purview and Microsoft Defender to protect information, strengthen governance and manage emerging risks in a way that aligns with their size, objectives and licensing environment.
Want to adopt AI with confidence while maintaining appropriate security and governance controls? Contact 365 Architechs to learn how we can help.
