Configure a Communication Compliance policy to detect generative AI interactions

You can use Communication Compliance to analyze interactions (prompts and responses) to detect inappropriate or risky interactions or sharing of confidential information entered into numerous generative AI applications.

These applications include Microsoft 365 Copilot, Copilots built with Microsoft Copilot Studio, AI applications connected by Microsoft Entra or Microsoft Purview Data Map connectors, and more.

Microsoft Copilot experience

Communication Compliance can detect interactions in any message with the IPM.SkypeTeams.Message.Copilot.application item class. These item classes include Copilot applications in Microsoft solutions like Teams, Outlook, and many more.

For example, Communication Compliance detects interactions in Copilot messages with the IPM.SkypeTeams.Message.Copilot.Teams, IPM.SkypeTeams.Message.Copilot.Outlook item classes, and others.

Connected generative AI application

Communication Compliance can detect prompt and response interactions with non-Copilot AI applications. These applications are generative AI applications connected by using Microsoft Entra and Microsoft Purview Data Map connectors.

Other AI applications

Communication Compliance can also detect interactions with AI applications from browser and network activity by users in your organization. This capability helps you detect inappropriate or risky interactions or sharing of confidential information that users enter into AI applications outside of your organization.

Prerequisites

To investigate Copilot interactions in Communication Compliance, you must be assigned one of the following roles:

• Communication Compliance
• Communication Compliance Investigators
• Communication Compliance Analysts

You must also be assigned as a reviewer of the policy in the Reviewers field during policy creation.

How it works

You can take advantage of all Communication Compliance features when you create a Communication Compliance policy that detects Microsoft 365 Copilot and Microsoft 365 Copilot Chat interactions, including:

• Sensitive information types
• Keywords
• Microsoft provided trainable classifiers
• Content safety classifiers for Teams based on large language models
• Conditions

Any prompt or response that a user enters into a supported generative AI app and that matches a Communication Compliance policy appears as a policy match on the Policies page on the Pending tab, with separate entries for prompts and responses. If only the prompt or only the response matches a policy, the Pending tab shows an item just for that policy match. You can remediate policy matches for generative AI apps in the same way that you remediate any other policy match.

The following information appears for each item on the Pending tab for AI policy matches:

• Icons: The Copilot icon identifies the policy match as a generative AI interaction with a Microsoft-based Copilot For all other generative AI interactions, this icon is an email icon.
• Subject column: The [Copilot] value in this column identifies the policy match as a generative AI interaction with Microsoft-based Copilots. The [AI app] value in this column identifies the policy match for all other generative AI interactions.
• Sender column: Sender of the message. Depending on the source AI application, the sender appears as follows:
  • If the policy match is a response from a Copilot application, the value is Copilot.
  • If the policy match is a response from a connected AI application, the value is Connected AI app.
  • If the policy match is a response from a cloud AI application, the value is Cloud AI app.
• Recipient column: Recipients included in the message. This value is the user interacting with the AI application.
• Message text: The message text that the user entered (the text that caused the policy match) appears on the right side of the screen in its entirety.

Create a policy that detects Microsoft Copilot interactions

1. Sign in to the Microsoft Purview portal with credentials for an admin account in your Microsoft 365 organization.
2. Go to the Communication Compliance solution.
3. Select Policies in the left navigation.
4. Select Create policy, then select the Detect Microsoft Copilot interactions template.
5. Enter the policy name, select the users and groups to apply the policy to, and select the reviewers for the policy. Learn more about these options when creating a policy from a template
6. Review the list of settings chosen for you based on the template. Select Create policy to create the policy or select Customize policy if you want to make any changes before creating the policy.

Add a generative AI app as a location for an existing policy

1. Sign in to the Microsoft Purview portal with credentials for an admin account in your Microsoft 365 organization.

2. Go to the Communication Compliance solution.

3. Select Policies in the left navigation.

4. Select More actions (ellipsis) in the row for the policy you want to change, then select Edit.

5. Select Next two times in the policy creation workflow to go to the Choose locations to detect communications page.

6. Select one or more of the following checkboxes to add a generative AI application as a location:

   • Microsoft Copilot experiences
   • Enterprise AI apps
   • Other AI apps

7. Make any other changes to the policy, then on the Review and finish page, select Save.

Create a policy to review all generative AI interactions

When you first work with generative AI interactions, consider reviewing all AI interactions to understand how people in your organization use these applications. To create a policy that reviews all generative AI interactions, when you create or edit the policy:

• Set the location to include all generative AI applications:

  • Microsoft Copilot experiences
  • Enterprise AI apps
  • Other AI apps

• Set the Review percentage option on the Choose conditions and review percentage page to 100%.

• Don't set any conditions for the policy.

Remediate policy matches and alerts that contain generative AI interactions

Remediate policy matches and alerts that contain generative AI interactions the same way you remediate any policy match or alert in Communication Compliance. For example, you can tag a policy match, escalate it, resolve it, download it, or export it. Learn more about resolving policy matches and alerts in Communication Compliance.

Reports

AI interactions that you bring into the scope of a Communication Compliance policy appear in Communication Compliance reports and audit data. Learn more about Communication Compliance reports and audits.

See also

• Microsoft Purview data security and compliance protections for generative AI apps
• Investigate and remediate Communication Compliance alerts
• Use Communication Compliance reports and audits