Microsoft Purview: Data Loss Prevention-Admin Units Support for Copilot & Cowork DLP

🚨 The Signal: Purview DLP now supports Administrative Units for Copilot and Cowork, enabling delegated policy management without granting tenant-wide permissions. This improves security posture by enforcing least privilege for DLP administration.

The Impact

Security teams and delegated administrators are affected, reducing the risk of over-privileged access to DLP policy management.

• Security Teams: Reduced risk of broad DLP policy misconfiguration due to over-privileged administrators.
• Delegated Administrators: Can manage Copilot DLP policies for their scope without tenant-wide permissions, improving security.
• Compliance Officers: Enhanced ability to meet regulatory requirements for data protection within specific organizational units.
• Tenant Administrators: Reduced burden of managing all DLP policies centrally, while maintaining overall control.

The Action

1. Review existing Purview DLP policies for Copilot and Cowork to identify candidates for AU-scoped management.
2. Identify and create appropriate Administrative Units in Microsoft Entra ID for DLP policy delegation.
3. Assign relevant administrators to the newly created Administrative Units with appropriate Purview DLP roles.
4. Configure new or modify existing Copilot DLP policies to be scoped to specific Administrative Units in Microsoft Purview.
5. Regularly audit delegated DLP policy assignments and Administrative Unit memberships to ensure least privilege.

Domain: Purview · Impact: high · Workload: Microsoft Purview · Essential Eight: Restrict Administrative Privileges · ISM: ISM-0445, ISM-1175, ISM-1380, ISM-1507, ISM-1508, ISM-1509, ISM-1647, ISM-1648, ISM-1650, ISM-1686, ISM-1688, ISM-1689, ISM-1883, ISM-1897, ISM-1898