If you spend your days in Microsoft 365 security, you’ll recognise this pattern. Most organisations think they understand their data. They don’t.

They know where some of it lives. They know where they hope it lives. They rarely know where it all lives.

That’s the exact problem Microsoft Purview Data Security Posture Management (DSPM) solves.

For years, we’ve poured our attention into identities, endpoints and infrastructure. Fair enough — attackers hit those areas daily. But data is still what criminals are after when the attack finally lands.

DSPM drags the conversation back to the data itself.

About time, frankly.

What Is Microsoft Purview DSPM?

Purview DSPM gives you visibility into sensitive data across your estate and flags where the risk sits. It boils down to four questions:

• What sensitive data do we actually have?
• Where does it live?
• Who can get to it?
• How well is it protected?

It isn’t a bolt-on product. DSPM pulls together intelligence you’re probably already generating through:

• Data Loss Prevention (DLP)
• Sensitivity labels
• Insider Risk Management
• Data Security Investigations
• Activity monitoring and reporting

Instead of hopping between five different portals trying to piece together a picture, you get one view of data risk.

The Real Problem DSPM Solves

Every time I run a security assessment, the same pattern shows up.

The customer is confident their sensitive data is under control.

Then we look.

Within a few hours, we’re usually staring at:

• Thousands of unclassified files
• SharePoint sites shared far too widely
• Sensitive documents open to entire departments
• Old data nobody remembered existed
• Staff sharing information externally with no bad intent whatsoever

None of this is sophisticated. It’s simply what happens after years of growth, mergers, and “quick” collaboration decisions nobody ever revisited.

DSPM shines a light on it. It moves security teams away from guesswork and toward evidence — which, in my experience, completely changes the conversation with leadership.

Data Discovery Is Worth More Than People Expect

Sensitive data discovery is one of DSPM’s strongest features.

Microsoft continually scans the environment, identifies sensitive information, and checks how exposed and protected it actually is.

Sounds routine. It isn’t, once you see the output.

Most organisations turn up a surprising volume of:

• Financial information
• Personal data
• HR records
• Customer information
• Commercially sensitive documents

sitting in places nobody ever intended it to be.

This is shadow data, and it’s often the biggest risk in the building, purely because nobody’s watching it. DSPM is built to dig this stuff out and put a number on the risk it carries.

In practice, discovery alone tends to justify the licence cost before you’ve done anything else.

Oversharing Is the New Front Line

Security teams used to spend their energy on external attackers.

These days I spend just as much time talking about oversharing.

Microsoft 365 made collaboration effortless. Great for productivity. Not so great for risk.

A file doesn’t need to be public to be exposed. It just needs to be visible to the wrong colleague.

DSPM includes workflows aimed specifically at spotting and reducing oversharing, particularly across Microsoft 365 and AI-enabled services.

This matters more as Copilot rolls out.

Copilot only sees what a user already has permission to see. If permissions are too loose, Copilot doesn’t create a new problem — it just finds your existing one faster.

That’s not a Copilot issue.

It’s a governance issue you were always going to have to fix.

DSPM lets you find it before Copilot does.

DSPM and AI: More Useful Than the Marketing Makes It Sound

There’s a lot of noise about AI security right now. Some of it’s worth your time. Most of it isn’t.

The genuinely useful part of DSPM is that it tackles AI security from the data side, not the model side.

Microsoft has built in dedicated visibility into AI apps, agents and data interactions — so you can watch for oversharing, odd access patterns and potential exfiltration through Copilot and other AI tools.

I think that’s the right way round.

Most AI risk is data risk wearing a new outfit. Classify, protect and govern the data properly, and a lot of the AI worry sorts itself out.

Turning Visibility Into Action

A dashboard full of problems isn’t much use on its own. I’ve sat through enough of those reviews to know that.

What I rate about DSPM is that it doesn’t stop at “here’s your risk.” It gives you a path: apply a label, build a DLP policy, investigate the odd activity, cut back the exposure. It also tracks whether your posture actually improves over time.

That’s the difference between “I found a problem” and “I fixed a problem” — and in my experience, that’s exactly where most projects stall.

My View

Purview DSPM isn’t the flashiest product in the Microsoft security line-up. It won’t steal headlines the way Security Copilot or Defender XDR does.

But it solves the problem I run into most often on customer sites: organisations don’t actually know their own data estate.

That blind spot is where the risk lives.

DSPM gives you a genuinely practical way to find sensitive data, understand where it’s exposed, spot oversharing and work out what to fix first. It pulls together several Purview capabilities into one coherent view instead of five disconnected ones.

If you’re investing in Microsoft 365, Purview or Copilot, I’d treat DSPM as foundational, not optional. That’s increasingly where I land with every customer I advise.

Because you can’t protect data you can’t see.

And for most organisations I work with, that’s still the hardest question on the table.