ShadowAI Defense GitHub
← All detections
DET-MS-PV-002 Purview DLP DLP config Severity: High

Purview DLP — Sensitive label content uploaded to AI services

Detects when documents with Microsoft Purview sensitivity labels (Confidential, Highly Confidential, Restricted) are uploaded, pasted, or shared to consumer AI services, leveraging label-based detection for higher precision than content inspection alone.

Rule

# Purview DLP — Sensitivity Label-Based AI Upload Detection
# Navigation: Microsoft Purview > Data Loss Prevention > Policies > Create policy
#
# Policy: Block Labeled Content to AI Services
# Scope: Endpoint DLP (Edge for Business, Chrome/Firefox with Purview extension)
#
# Rule 1: Block Highly Confidential / Restricted to AI services
#   Conditions:
#     - Content contains sensitivity label: 'Highly Confidential' OR 'Restricted'
#     - Activity: Upload to cloud service, Paste to browser, Copy to clipboard
#     - Destination: Service domain group 'Consumer LLM Domains'
#   Actions:
#     - Block (no override)
#     - Notify user: toast with explanation and link to approved AI tools
#     - Generate incident: severity Critical
#     - Alert: AI Governance + Security Operations
#
# Rule 2: Warn on Confidential to AI services
#   Conditions:
#     - Content contains sensitivity label: 'Confidential' OR 'Internal'
#     - Activity: Upload to cloud service, Paste to browser
#     - Destination: Service domain group 'Consumer LLM Domains'
#   Actions:
#     - Block with override (user provides business justification)
#     - Notify user: toast explaining risk and approved alternatives
#     - Generate incident: severity High
#     - Log override justification for weekly review
#
# Rule 3: Audit General labeled content to AI services
#   Conditions:
#     - Content contains sensitivity label: 'General'
#     - Activity: Upload to cloud service
#     - Destination: Service domain group 'Consumer LLM Domains'
#   Actions:
#     - Audit only (log event, no block)
#     - Severity: Informational
#
# Service domain group 'Consumer LLM Domains':
#   Purview > DLP > Endpoint settings > Service domains
#   Populated from /watchlists/ConsumerLLMDomains.csv
#
# Prerequisites:
#   - Sensitivity labels deployed and adopted (minimum 60% label coverage target)
#   - Auto-labeling policies active to ensure unlabeled content is minimized

How it works

Builds on DET-MS-PV-001 by using sensitivity labels as the primary detection signal instead of (or in addition to) sensitive information types. Label-based detection has significantly higher precision than content-pattern matching because the label reflects a deliberate classification decision, either by the user or by auto-labeling policies. The tiered approach (block for Highly Confidential, warn for Confidential, audit for General) matches the severity of the action to the classification of the data. This policy is most effective in organizations with mature sensitivity-label adoption — pair with auto-labeling to maximize coverage of unlabeled content.

Required data sources

  • Microsoft Purview Endpoint DLP enabled
  • Microsoft Purview Information Protection (sensitivity labels deployed)
  • Devices onboarded to Microsoft Purview
  • Edge for Business (or Chrome/Firefox with Purview browser extension)
  • Service domain group: ConsumerLLMDomains

Prerequisites

  • Microsoft 365 E5 Compliance or Purview Information Protection add-on
  • Sensitivity labels published to users and auto-labeling policies active
  • Minimum 60% label coverage across documents and emails (measure via Content Explorer)
  • Devices onboarded to Purview Endpoint DLP
  • Service domain group populated from /watchlists/ConsumerLLMDomains.csv
  • Users trained on sensitivity labels and AI acceptable use policy

Expected volume

Lower than DET-MS-PV-001 because label-based matching is more precise. Expect 2-15 events/day per 10k users for Confidential tier, 0-3/day for Highly Confidential tier. Audit-mode events for General label will be higher (20-80/day).

False-positive guidance

Primary FP source: auto-labeling over-classification. Documents auto-labeled as Confidential that contain only public information will generate unnecessary alerts. Refine auto-labeling policies based on DLP incident feedback. Also watch for label inheritance — a document may carry a Confidential label because it was copied from a Confidential template even though the current content is benign.

Tuning steps

  1. Verify sensitivity-label adoption rate before deploying — low adoption means low coverage, not low risk.
  2. Start Rule 2 (Confidential) in audit mode for 2 weeks to baseline volume.
  3. Review auto-labeling policy accuracy — over-classification drives FPs in this rule.
  4. Coordinate with Information Protection team to align label definitions with AI policy.
  5. Monitor override justifications weekly — recurring overrides indicate a workflow gap.
  6. Add new AI service domains to the Consumer LLM Domains service domain group monthly.

Framework mappings

  • NIST AI RMF: GOVERN-4.1, MEASURE-2.7, MANAGE-2.2
  • ISO/IEC 42001: 8.2, 8.3, 8.4
  • MITRE ATT&CK: T1567.002
  • NIST CSF: DE.CM-3, PR.DS-5, PR.IP-1

Related AI Controls Catalog entries