Microsoft Purview | Data Loss Prevention | Administrative Units | AI Governance
As organisations introduce Microsoft 365 Copilot, Copilot Chat and Copilot Cowork, protecting sensitive information is only part of the challenge. Another question quickly follows:
How do you let regional or departmental teams manage their own DLP policies without giving them control over the entire tenant?
Microsoft Purview Roadmap 575287 aims to address this by extending Administrative Units support to Data Loss Prevention (DLP) for Microsoft 365 Copilot, Copilot Chat and Cowork.
The roadmap currently lists a preview date of October 2026 and General Availability in November 2026. The feature is in development, and release dates may change.
Roadmap details: https://www.microsoft.com/microsoft-365/roadmap?id=575287
👉 What is changing?
Administrative Units (AUs) allow organisations to define administrative boundaries, often aligned to departments, business units or geographical regions.
This roadmap item extends AU support to the management of supported Copilot DLP policies. The intention is to let administrators manage policies within their assigned administrative boundaries without requiring tenant-wide policy-management permissions.
Existing tenant-wide policies continue to apply, and organisations can choose whether to use AU-scoped management.
That distinction matters: this is primarily about delegated administration and policy scope, not a replacement for DLP itself.
👉 Why does this matter?
1. Delegation without tenant-wide control
Imagine a multinational organisation with separate teams responsible for the UK, Europe and North America.
Each team may need to manage DLP policies relevant to its users and regulatory obligations. Giving every regional administrator unrestricted control over all Copilot DLP policies creates unnecessary risk.
Administrative Units offer a way to delegate supported policy-management responsibilities while maintaining clearer boundaries.
2. More practical AI governance
Microsoft Purview DLP can help organisations control how Copilot experiences process sensitive prompts, files and emails, depending on the configured policy and supported scenario.
As Copilot usage expands, governance teams need to consider both the protection controls and who is authorised to manage them.
A regional team might understand its local regulatory requirements better than a central team. Delegation can help bring that expertise into policy management without automatically granting access to the whole tenant.
3. Separation of duties
Good governance is not just about what a policy does. It is also about who can create, change and oversee it.
Scoping administrative responsibilities can reduce the number of people who need broad permissions, support clearer accountability and make ownership easier to define.
However, Administrative Units do not remove the need for role assignments, change control, monitoring or central oversight.
👉 What should organisations do now?
I’d prepare in five areas:
1. Map your administrative boundaries. Identify the departments, regions or business units that need delegated responsibility. Check that your Entra Administrative Units reflect your intended operating model.
2. Review existing Copilot DLP policies. Document the policies already in place, their scope, conditions, actions and owners. Identify which responsibilities genuinely need to be delegated.
3. Define roles and responsibilities. Agree who can create, edit and review policies, who handles incidents, and which changes require central approval.
4. Plan a controlled pilot. When the capability is available in your tenant, test the experience with a small group of restricted administrators. Validate policy scope, permissions, visibility of alerts and activity, and the interaction with existing tenant-wide policies.
5. Keep central governance in place. Establish standards for naming, documentation, testing, exceptions and periodic reviews. Delegated administration should operate within a common governance framework.
💡 The Jim Talks takeaway
AI governance at scale cannot depend on giving every administrator unrestricted control-or forcing every decision through one central team.
The goal is to find the right balance between local accountability and organisation-wide consistency.
Roadmap 575287 is worth watching because it could help organisations delegate Copilot DLP policy management more deliberately, while retaining existing tenant-wide controls.
Give teams the scope they need, keep permissions proportionate, and make sure every delegated policy operates within a clear governance framework.
References
- Microsoft 365 Roadmap 575287: https://www.microsoft.com/microsoft-365/roadmap?id=575287
- Microsoft Learn – DLP for Microsoft 365 Copilot, Copilot Chat and Cowork: https://learn.microsoft.com/en-us/purview/dlp-microsoft365-copilot-location-learn-about
- Microsoft Learn – Administrative Units in Microsoft Purview: https://learn.microsoft.com/en-us/purview/purview-admin-units
#MicrosoftPurview #Microsoft365Copilot #CopilotCowork #DataLossPrevention #IdentityGovernance #AIGovernance #GovernanceJim
Leave a Reply