Use Network Data Security to help prevent sharing sensitive information with unmanaged AI

This article uses the process you learned in Design a data loss prevention policy to show you how to create a Microsoft Purview data loss prevention (DLP) policy that helps prevent sharing sensitive information with unmanaged AI apps through network data security using an integrated SASE solution, such as Microsoft Entra GSA Internet Access. Work through this scenario in your test environment to familiarize yourself with the policy creation UI.

How you deploy a policy is as important as policy design. This article shows you how to use the deployment options so that the policy achieves your intent while avoiding costly business disruptions.

Prerequisites and assumptions

• For Microsoft Entra GSA Internet Access apps, the device must be Entra ID joined.
• For Microsoft Entra GSA Internet Access apps, you've configured a file policy for network content filtering in Microsoft Entra GSA Internet Access.
• For third party SASE providers, ensure you've completed the integration steps outlined in your provider's documentation.
• This procedure uses hypothetical distribution groups, one named Finance Team, and another group for the Security Team. You have to create these groups in your environment or substitute your own groups.

Policy intent statement and mapping

We want to embrace responsible AI use within our organization while protecting customer and organizational sensitive data from intentional or accidental exposure. Because the Finance department regularly handles highly sensitive information, we need to create a policy that blocks Finance users from sharing sensitive content with any unsanctioned generative AI application. Since many of our users have flexibility in which browser they choose to use, as well as the ability to use locally installed AI apps and Office add-ins, we need to ensure broad endpoint coverage through network data security protection. Given the sensitivity of the Finance department’s access to data, we need to prevent financial data, personally identifiable information (PII), or confidential documents from being shared through text prompts or uploaded files. Then, to ensure efficient and quick incident management, we must generate alerts and ensure our security team is notified via email any time a block occurs. Lastly, we want this policy to take effect immediately to begin protecting company data as soon as possible.

SASE provider ingtegration

1. Sign in to the Microsoft Purview portal.
2. Open Settings (in the upper right hand corner) > Data loss prevention > Integrations
3. Select Get started for the Microsoft Global Secure Access (Preview).
4. Complete the steps provided in the integration wizard.

Steps to create policy

1. Sign in to the Microsoft Purview portal.
2. Select Data loss prevention > Policies > + Create policy.
3. Select Inline web traffic.
4. Select Custom from the Categories list and then select Custom policy from the Regulations list.
5. Choose Next.
6. Enter a policy name and provide an optional description. You can use the policy intent statement here.
7. Choose Next.
8. Select + Add cloud apps.
9. Select the Adaptive app scopes tab, then choose All unmanaged AI apps and select Add (1).
10. Select Edit scope on All unmanaged AI apps.
11. Select the Include only specific option on the Add or edit the scope for All Unmanaged AI Apps.
12. Select + Add inclusions.
13. Select Specific users and groups.
14. Search for and select the Finance department group, then select Add.
15. Select Save and close.
16. Choose Next.
17. On the Choose where to enforce the policy page, ensure Network is On, then select Next.

1. On the Define policy settings page, ensure Create or customize advanced DLP rules is selected and select Next.
2. On the Customize advanced DLP rules page, select + Create rule.
3. Give the rule a unique name and optional description.
4. Under Conditions
   1. Select + Add condition then choose Content contains.
   2. Select Add and choose Sensitive info types.
   3. Choose ABA Routing Number, U.S. Bank Account Number, Credit Card Number, U.S. Social Security Number (SSN) and select Add.
   4. Select Add and choose Sensitivity labels
   5. Choose Confidential and select Add.
   6. Ensure the Group operator is set to Any of these for the Content contains group.
5. Under Actions
   1. Select + Add an action and choose Restrict browser and network activities.
   2. Select Text sent to or shared with cloud or AI apps and **File uploaded to or shared with cloud or AI apps.
   3. Select Block for both.

1. Under Incident reports
   1. Set the Severity level in admin alerts and reports to High
   2. Ensure Send an alert to admins when a rule match occurs is On
   3. Select + Add or remove users and choose the SecurityOps distribution group
   4. Ensure Send alert every time an activity matches the rule is selected
2. Select Save.
3. Review the rule configuration, ensure it's status is On, and select Next.
4. On the Policy mode page choose Turn the policy on immediately and then select Next.
5. Review the policy information then select Submit to create the policy.