Episode Details

In this episode of the M365FM Podcast, Mirko Peters sits down with Microsoft MVP Alan Cox to explore one of the biggest security and governance challenges facing enterprises today: securing Microsoft Copilot before AI begins surfacing sensitive organizational data at scale. The conversation dives deep into Microsoft Purview, Data Loss Prevention, Insider Risk Management, AI governance strategy, and why organizations must rethink permissions, sharing, and compliance before rolling out Copilot broadly.

AI DOES NOT CREATE RISK — IT EXPOSES IT

Alan explains that Copilot itself is not the true danger. Instead, AI exposes the hidden weaknesses already living inside most Microsoft 365 environments. Overpermissioned SharePoint sites, forgotten Teams channels, excessive sharing, and missing governance controls suddenly become visible the moment AI can summarize and retrieve information instantly. The biggest mistake organizations make is assuming that because employees technically already had access to the data, there is no additional risk. In reality, Copilot dramatically accelerates discoverability. Data that once remained buried inside folders and old conversations can suddenly surface through a single prompt. 

WHAT MICROSOFT PURVIEW REALLY IS

Alan breaks Microsoft Purview down into simple terms. At its core, Purview is about protecting organizational data and bringing hidden risks into focus. Instead of viewing governance purely as restriction and compliance enforcement, he frames governance as a proactive strategy designed to prevent future incidents before they happen. He simplifies Purview into three foundational areas:

• Data Loss Prevention
• Retention
• Sensitivity Labeling

These three pillars ultimately determine what Copilot can access, process, summarize, or expose across Microsoft 365 workloads.

INSIDER RISK IS NOW AN AI PROBLEM

One of the most important themes in the discussion is how Insider Risk Management changes in the age of generative AI. Alan explains that most insider threats are not malicious attacks. Most incidents happen because employees unintentionally expose sensitive information without understanding the consequences. AI amplifies this problem because natural language prompts make it easier than ever to retrieve information from across the organization. Insider Risk Management helps organizations detect suspicious access patterns, risky prompts, unusual sharing activity, and abnormal behavior before those actions become full-scale incidents. 

DSPM FOR AI CHANGES GOVERNANCE

A major focus of the episode is Microsoft’s evolving DSPM for AI capabilities. Alan explains how Microsoft is consolidating AI governance features into centralized dashboards that simplify policy creation for Copilot protection. Organizations can now deploy controls that restrict AI access to sensitive information in only a few clicks rather than building highly complex manual rule sets. The goal is to make AI governance operationally scalable instead of turning it into an overwhelming compliance project. 

WHY AUTO-LABELING MATTERS

Alan strongly recommends automated sensitivity labeling over manual classification by end users. He explains that users should not be responsible for making security decisions every time they create content. Instead, organizations should automatically identify sensitive information and apply governance policies behind the scenes. His preferred strategy is straightforward:

• Automatically apply sensitivity labels
• Use DLP policies tied to those labels
• Prevent Copilot from accessing protected content

This allows organizations to block AI processing for specific SharePoint sites, document libraries, or files automatically.

THE HIDDEN RISK OF TEAMS TRANSCRIPTS

One of the more surpris