A Note on Northwave’s Approach

At Northwave, our sanctioned enterprise LLM is Microsoft Copilot. For Microsoft-centric environments, it offers the least friction and the most integrated experience, provided your data foundation is sound. Copilot drafts, summarises, and retrieves information only from data the user is already entitled to access. That condition matters. Copilot inherits Entra ID permissions and Purview labels, so the quality of your access model and labels becomes your safety margin.

In short, Copilot is a sound choice for many organisations but it not a shortcut around governance.

How to Use Microsoft Purview to Protect Data

With a sanctioned LLM selected, the next challenge is ensuring that data remains protected when employees begin using AI tools. This is where technology plays a supporting role. It does not replace governance, but helps enforce it. Northwave’s Data Security Cycle (see image below) shows how policy, behaviour, and technology must work together as a continuous process.

Governance decisions shape which data needs protection. Classification labels identify that data. Technology enforces the rules. Monitoring and reporting provide evidence of what happened. When something changes, such as an updated retention policy, the cycle must be adjusted again. This is the ongoing nature of data security.

Within this cycle, Microsoft Purview makes it possible to identify data, monitor data and users, and block actions such as sharing certain information with external parties. Think of Purview as the policy engine and the evidence system for how users and AI assistants handle sensitive data across Microsoft 365 and connected services.

Identifying and Labelling Sensitive Data

Purview supports secure AI use by scanning documents and emails for sensitive information and applying labels such as “Personal Data”, “Financial”, “Health Data”, “Contracts”, or “Source Code”. Automatic classification helps organisations label information at scale and keep labels updated for consistent protection.

These labels indicate how the data should be handled: who may access it, if it can be shared externally or used in an AI tool, and what retention requirements apply. When labels carry protection, applications and AI assistants must adhere to them. With Purview, that is enforced by policy rather than left to judgement.

Enforcing Data Rules Without Disrupting Productivity

Once data is labelled, Purview ensures those rules are followed. With the right configurations, Microsoft 365 DLP and Endpoint DLP can:

• block uploads of sensitive files to public AI tools
• prevent copying or pasting protected content into unsanctioned apps
• stop the export of sensitive data to unmanaged devices

Adaptive Protection applies stricter controls automatically to users or roles whose behaviour indicates elevated risk. Meanwhile, low-risk users experience minimal disruption. This avoids the all-too-common situation where everything is blocked and employees resort to shadow AI tools.

Monitoring, Alerting, and Reporting

Visibility is essential for security operations, internal accountability, and regulatory requirements. Purview Audit and Insider Risk Management help detect unusual activity, such as repeated attempts to move sensitive data into external tools or interactions with AI that conflict with policy.

By feeding these signals into your Security Operations Centre (SOC) through Microsoft Sentinel, analysts can then correlate them with other security events. Purview’s eDiscovery and Data Lifecycle Management capabilities ensure that documents and communication records remain compliant with retention and legal-hold obligations, even as generative AI speeds up content creation.