From Copilot to AI: PurLayer Brings Copilot and Third-Party AI Governance Together

AI governance, now in one place

PurLayer strategies have always included AI governance, including Microsoft Purview DSPM for AI recommendations. Until now that coverage was split across two workloads. The Copilot workload covered Microsoft 365 Copilot controls such as DSPM for AI, sensitivity labels, DLP and oversharing reviews. The Devices workload covered third-party AI usage through endpoint DLP and browser monitoring. That worked, but a partner reviewing a strategy had to read two sections to see the full AI picture.

Organisations now use far more than Copilot. Staff paste content into ChatGPT, teams register their own AI apps in Entra, developers build on Microsoft Foundry, and many organisations without a single Copilot licence still need to govern AI usage. So the fifth workload is now AI, and it brings Copilot and third-party AI together. The existing Copilot recommendations carry over unchanged, alongside expanded enterprise and third-party AI controls.

The five-workload model stays the same: Exchange, OneDrive, SharePoint, Devices and AI. Devices is still where endpoint onboarding and endpoint DLP live. Third-party AI controls point to it as a prerequisite rather than repeating those recommendations.

Three sub-groups, mirroring DSPM for AI

DSPM for AI was already part of PurLayer's recommendations. The AI workload now also mirrors its structure, grouping controls the same way Microsoft Purview Data Security Posture Management (DSPM) for AI groups AI apps. Every AI control sits under exactly one sub-group, and the sub-group headings appear in the strategy view and in the exported PDF.

• Copilot experiences & agents: Microsoft 365 Copilot, Copilot Chat, Copilot Studio agents, Security Copilot and Copilot in Fabric.
• Enterprise AI apps: ChatGPT Enterprise, Entra-registered AI apps, Microsoft Foundry and Anthropic Claude (Enterprise).
• Other / third-party AI apps: consumer AI sites such as Gemini, ChatGPT and DeepSeek, governed through the browser and the endpoint.

Only controls Purview actually provides

Every AI recommendation maps to a capability Microsoft Purview provides today. The workload draws on DSPM for AI for discovery, data risk assessments and one-click policies; DLP for generative AI sites in supported browsers, with Adaptive Protection; sensitivity labels that limit what Copilot and agents can process; retention and eDiscovery for AI interactions, including the Enterprise AI apps and Other AI apps locations; Insider Risk Management and Communication Compliance over AI prompts and responses; and auditing of AI interactions.

Where a capability is billed separately, the recommendation says so. Retention and eDiscovery for non-Microsoft AI interactions, for example, are flagged as pay-as-you-go, so a partner isn't surprised later by a charge that wasn't in the strategy.

Licence-aware, just like every other workload

AI controls use the same licence filtering as Exchange, OneDrive, SharePoint and Devices. Microsoft 365 E3 and Business Premium strategies get baseline AI visibility and manual protections. E5 and Purview Suite strategies add advanced AI DLP, DSPM for AI automations, Insider Risk over AI activity, and endpoint DLP for third-party AI sites. No E5-only control appears in an E3 strategy, and the existing licence badges and adjusted coverage apply to AI recommendations too.

The Copilot sub-group has an extra gate: it only appears when the Step 4 toggle is on and the organisation has a Copilot licence. Without both, the strategy doesn't recommend controls for a product the customer can't use.

AI governance without Copilot

The AI workload now appears in every generated strategy. Third-party and enterprise AI governance applies whether or not the organisation has bought Copilot, so a strategy with Copilot switched off still includes the Enterprise AI apps and Other / third-party AI apps sub-groups. You won't see an empty AI section.

The Step 4 control has been relabelled to reflect AI adoption generally. It still turns the Copilot-specific sub-group on and off.

A clear dependency on Devices

Monitoring and DLP for third-party AI sites happen in the browser and on the endpoint. Rather than repeat endpoint DLP in two places, the AI workload refers to the Devices workload prerequisite: devices onboarded to Microsoft Purview through Microsoft Defender for Endpoint, plus the required Edge configuration policy. A short dependency note explains this, so partners know third-party AI controls only work once devices are onboarded. The same endpoint DLP recommendation never appears in both Devices and AI.

Secure AI Adoption, tailored by sector

Secure AI Adoption is now the most complete AI objective in PurLayer. It draws on all three sub-groups in every sector and points the AI controls at that sector's specific risks:

• Healthcare: patient data.
• Financial services: inside information and market data.
• Education: student and safeguarding data.
• Manufacturing: intellectual property and trade secrets.
• Public sector: citizen and OFFICIAL-SENSITIVE data.
• Retail: customer and payment card data.

Each sector recommendation is a real Purview control at the right licence tier. There is no generic filler.

Tracking history stays intact

Renaming and restructuring a workload could break partner tracking if recommendation ids changed. They haven't. We regenerated all 42 sector, objective and licence-tier combinations and compared recommendation ids before and after the change, and every id is unchanged. Partners using strategy tracking keep their full progress history.

In the strategy view and the PDF

The AI workload and its three sub-groups appear in the generated strategy, the framework coverage section and the white-label PDF, all in PurLayer's brand styling. Product and overview copy that used to call the fifth workload Copilot now says AI.