Considerations for DSPM for AI to manage data security and compliance protections for AI interactions To prevent users from sharing sensitive information with third-party generative AI websites when Windows devices are onboarded to Microsoft Purview, you can configure Data Loss Prevention (DLP) policies. These policies allow you to restrict access to specific service domains and block file uploads or sensitive data sharing with those domains.
Reference:
https://learn.microsoft.com/en-us/purview/dspm-for-ai-considerations

You can use message expiration on emails that your users send to external recipients who use the OME Portal to access encrypted emails. You force recipients to use the OME portal to view and reply to encrypted emails sent by your organization by using a *custom branded template* that specifies an expiration date in PowerShell.
Reference:
https://learn.microsoft.com/en-us/purview/ome-advanced-expiration

Assign sensitivity labels to Microsoft 365 groups in Microsoft Entra ID Microsoft Entra ID supports applying sensitivity labels published by the Microsoft Purview compliance portal to Microsoft 365 groups. Sensitivity labels apply to groups across services like Outlook, Microsoft Teams, and SharePoint.
Assign a label to an existing group in the Microsoft Entra admin center Step 1: Sign in to the Microsoft Entra admin center as at least a Global Administrator.
Step 2: Select Microsoft Entra ID.
Step 3: Select Groups
Step 4: From the All groups page, select the group that you want to label.
Step 5: On the selected group's page, select Properties and select a sensitivity label from the list.
Select the Confidential - Finance label

Step 6: Select Save to save your changes.
Reference:
https://learn.microsoft.com/en-us/entra/identity/users/groups-assign-sensitivity-labels

Explanation:
Box 1: Yes
User1 is in the Contoso subscription, and has the email address [email protected] Sensitivity label Sensitiviy1 has assigned contoso.com users Co-owner permissions.
For File1 has Sensitiviy1 been automaticallyapplied by using an auto-labeling policy.
Box 2: Yes
User2 is in the Contoso subscription, and has the email address [email protected] Sensitivity label Sensitiviy1 has assigned contoso.com users Co-owner permissions.
For File3 has Sensitiviy1 been applied by User1.
Box 3: No
User3 is in the Fabrikam subscription, and has the email address [email protected] Sensitivity label Sensitiviy1 has assigned fabrikam.com users reviewer permissions.
For File2 has Sensitiviy1 been applied by User2.
Reference:
https://learn.microsoft.com/en-us/purview/encryption-sensitivity-labels

To create a sensitive information type that matches all words in a keyword list, you can use the
"All" condition instead of the default "Any" condition. Here are the steps to create such a sensitive information type:
Step 1: Go to the Microsoft 365 compliance center and navigate to the "Sensitive information types" page.
Step 2: Click on "Create a sensitive information type".
Step 3: Choose "Keyword dictionary" as the type of sensitive information you want to create.
Step 4: Enter a name and description for the sensitive information type.
Step 5: In the "Keywords" section, enter all the words you want to match separated by com-mas.
Here we enter: Tailspin, Litware, Falcon
Step 6: Click on "Add condition" and choose "Any" as the condition type.
Step 7: Click on "Create" to create the sensitive information type.
Step 8: Click on "Create" to create the sensitive information type.
With this configuration, the DLP policy will only detect the sensitive information if any the words in the keyword list are present in the content being scanned.
Reference:
https://learn.microsoft.com/en-us/answers/questions/1419105/how-to-create-sensitive- information-types-to-match