Microsoft · Technologies
Microsoft Purview
Find out what Copilot can already see, before you switch it on.
Purview is where you find out which files are overshared, which carry a sensitivity label, and what your AI tools are allowed to read. It is the least glamorous part of an AI rollout, and the part that decides whether the rollout is safe.
DATA RISK ASSESSMENT · EXAMPLE TENANT
SITE
ITEMS
SENSITIVE
STATUS
Finance-Reporting
4,120
86
LABELLED
Executive-Team
1,845
212
LABELLED
HR-Records
2,660
340
LABELLED
Project-Archive
18,904
1,271
REVIEW
All-Company
32,517
2,088
OVERSHARED
Sample tenant
labelled · review · overshared
In plain terms
Copilot does not leak data. It surfaces what was already open.
Every file a person could already find, Copilot can find faster.
Without it
- Nobody knows which sites are shared with everyone
- Sensitive files sit unlabelled next to ordinary ones
- Old project folders stay open years after the project ended
- The first sign of a problem is someone seeing a payslip
With it
- Oversharing is measured rather than guessed at
- Sensitive content carries a label that travels with the file
- AI tools are blocked from summarising what they should not
- You can show a risk committee where the exposure went
What CG TECH can do with Microsoft Purview
Measure the oversharing first. Then turn the AI on.
Purview automatically runs a weekly data risk assessment across the top 100 SharePoint sites by usage, and we add custom assessments for the sites that matter to you but never make that list. The output is a plain list of places where too many people can see too much.
Labels are what let everything else work. We agree a label set your staff will actually use, apply it to existing content where that can be automated, and make sure the label travels with the file rather than the folder it happens to sit in.
Microsoft 365 Copilot honours labels and only shows a person files they could already open. Purview goes further: a data loss prevention rule can stop Copilot and agents summarising content that carries labels you choose.
We leave you with the assessment output, the policies that are now in place, and a record of what changed. That is the pack a board or risk committee asks for when it wants to know AI is under control.
How an engagement runs
From an unknown risk to something you can report on.
01
Assess
We turn on the assessments and find out how much is overshared, before anyone forms an opinion about it.
02
Label
We agree a label set that fits how your people actually work, then apply it to existing content where that can be automated.
03
Restrict
We put policies in place so AI tools cannot summarise the content you have ruled out.
04
Report
You get the evidence pack, and a schedule for checking it again.
Questions we hear a lot
Common questions about Microsoft Purview
What is Microsoft Purview?
Purview is Microsoft’s data security and compliance product. For most businesses looking at AI, the part that matters is Data Security Posture Management for AI, which shows what your AI tools can see and where content is overshared.
Why does Purview come up in every Copilot conversation?
Because Copilot inherits the permissions people already have. If a folder is shared with everyone, Copilot will find it and quote from it. Purview is how you measure that before it becomes a problem, rather than after.
What is a data risk assessment?
Purview automatically runs a weekly assessment of the top 100 SharePoint sites by usage in your tenant, and you can add your own for sites that matter but do not make that list. It reports where sensitive content sits and how widely it is shared.
Can we stop Copilot reading certain documents?
Yes. A data loss prevention policy can stop Microsoft 365 Copilot and agents summarising items that carry sensitivity labels you choose. That is a deliberate block, separate from ordinary file permissions.
Do we need Purview if our permissions are already set up?
Permissions tell you who can open a file. They do not tell you how many files are overshared, which of them hold sensitive information, or what your AI tools did with them. Purview answers those, and gives you something to put in front of a risk committee.
Does this only cover Microsoft AI tools?
No. Purview reports on AI use across Copilot, agents and other generative AI apps, including ones built on third-party models. That matters if staff are already using tools nobody formally approved.
How long does a first assessment take?
The assessment starts producing results quickly once it is switched on. The work that takes time is deciding what to do about what it finds, agreeing a label set, and remediating the worst sites.
Do we need Purview before Copilot, or can they run together?
You want the assessment done before you widen a Copilot rollout. A pilot with a small, trusted group can run alongside the clean-up. What you should not do is switch Copilot on for everyone and hope the content is tidy.
Ready when you are
Worried Copilot will surface something it should not?
That is the right worry, and it is measurable. A readiness assessment tells you how much of your content is overshared today, and what it would take to fix before anyone turns AI on across the business.
What to expect
- A consultant replies within 4 business hours
- Session booked to understand your requirements
- We will provide you with a fixed price quote