TL;DR: Microsoft Purview alone leaves major gaps in Microsoft 365 DLP, especially for screenshots, post-download movement, outbound email, and Copilot prompt exposure, because it lacks real-time, cross-boundary data lineage and AI-native inspection, according to Nightfall. The practical issue is not alert volume but whether teams can stop sensitive data from leaving approved workflows before it reaches personal cloud, email, or Shadow AI destinations.
At a glance
What this is: Nightfall says Microsoft 365 DLP that relies on Purview alone leaves major blind spots across screenshots, downloads, email, and AI prompt sharing.
Why it matters: IAM, PAM, data security, and identity teams need controls that follow data beyond the app boundary, because access decisions and egress policy now hinge on user, endpoint, and destination context.
Context
Microsoft 365 DLP only works when the control can see the full path of data movement, not just the first policy violation. In practice, modern loss happens through screenshots, downloads, browser uploads, email forwarding, and clipboard copy-paste into AI tools, which means the security problem is data exfiltration across workflow boundaries rather than a single app event.
This is also an identity governance issue because the risk often starts with a legitimate user, a valid session, and approved access. Once a file is downloaded or copied, conventional app-bound DLP loses context about who handled it, where it moved, and whether the destination was sanctioned, personal, or Shadow AI.
The article's examples are typical of current enterprise data loss patterns: the abuse is not exotic, but the control boundary is too narrow.
Key questions
Q: How should teams stop Microsoft 365 data loss when users can move content outside the app boundary?
A: Use controls that follow the data after download, copy, or export, not just rules inside Microsoft 365. The practical test is whether the policy still works when a user renames the file, pastes text into another service, or sends the content from a different device or account.
Q: Why do valid Microsoft 365 users still create data exfiltration risk?
A: Because legitimacy of access does not equal legitimacy of destination. A user can have the right to open a file and still move it into personal cloud storage, external email, or AI tools that the organisation does not control, which turns normal workflow into an exfiltration path.
Q: What are the signs that Office 365 DLP policies are not working well enough?
A: Common warning signs include repeated policy matches, frequent user exceptions, and reports that show incidents but little improvement over time. If sensitive data still appears in channels, attachments, or shared files despite controls, the policies are probably too weak, too broad, or too hard for users to follow. Effective DLP should reduce both incidents and manual intervention.
A: Security teams should combine session-aware controls, browser enforcement, and endpoint inspection so uploads are checked before data leaves sanctioned environments. The practical goal is to distinguish business from personal use, block transfers to unsanctioned destinations, and educate users at the moment of enforcement. This works best when policy scope is tied to real user context and monitored across browsers and endpoints.
Technical breakdown
Why Purview misses cross-boundary data movement
Purview is strongest when policy checks can be made inside Microsoft 365 on labelled content or pattern matches. It struggles when the data changes form or leaves the original control plane. Screenshots turn text into pixels, renamed files break simple traceability, and browser uploads create a new session on a different service. Without endpoint telemetry and destination context, DLP becomes a set of isolated alerts rather than a continuous control over data movement.
Practical implication: Treat app-native DLP as one layer and add endpoint and egress visibility for any workflow that can convert, copy, or re-share sensitive content.
How AI-native inspection changes the control point
The technical difference is not just better detection, but earlier interception. AI-native inspection uses computer vision for images, content classification for documents, and clipboard or browser monitoring for prompt-based transfers into AI services. That lets a control decide before transmission whether a file, screenshot, or prompt contains regulated or proprietary content. In identity terms, this shifts enforcement from post-event audit to session-level behaviour control, which is where exfiltration is often actually happening.
Practical implication: Move high-risk policy checks to the point of paste, upload, or send, especially where data can be repackaged for external tools.
Why data lineage matters for investigation and response
Data lineage links the source object, the user action, the endpoint, and the destination into one chain. That is different from log collection, where SharePoint, browser, email, and SIEM events may all exist but remain disconnected. When lineage is missing, analysts cannot tell whether an alert is a benign download, a sanctioned collaboration flow, or active exfiltration. With lineage, teams can distinguish one event from a complete path of movement and respond proportionately.
Practical implication: Build incident handling around path reconstruction so investigators can see the source-to-destination chain, not just individual alerts.
Threat narrative
Attacker objective: The objective is to move regulated or proprietary data out of monitored Microsoft 365 workflows and into destinations the organisation cannot govern in real time.
- Entry occurs through legitimate Microsoft 365 access, where a user can view or download sensitive content without triggering a boundary-based DLP rule.
- Credentialed user action then repackages the data through screenshots, file renaming, browser uploads, email forwarding, or clipboard paste into AI tools, which bypasses app-scoped controls.
- The impact is sensitive information leaving approved workflows into personal cloud services, external email, or Shadow AI infrastructure with little or no usable lineage for response.
Breaches seen in the wild
- Millions of Misconfigured Git Servers Leaking Secrets: Nearly 5 million misconfigured Git servers expose sensitive secrets and credentials online.
- Hugging Face Spaces breach 2024: Unauthorised access to Hugging Face Spaces may have exposed secrets users stored for AI apps; tokens were revoked and org tokens removed.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
App-bound DLP is not a data-loss strategy: it is a detection layer that only works while content remains inside the original platform boundary. Once users can screenshot, reformat, copy, or upload the same data through another channel, the control no longer governs the real exfiltration path. Practitioners should treat boundary leakage as the default failure mode, not the exception.
Cross-boundary lineage is the missing control concept: organisations need a way to preserve object identity from source to endpoint to destination, even when the file name, container, or format changes. That is the only way to distinguish collaboration from exfiltration when a valid user moves data through SharePoint, OneDrive, browser storage, email, or AI tools. Practitioners should prioritise controls that track data movement, not just content at rest.
Shadow AI changes the governance problem for human identities: the user still looks legitimate, but the destination may not be. Prompt submission into Copilot or other external AI services turns clipboard activity into a data-handling event, not a productivity event. That means identity governance must extend into destination risk, session context, and content classification. Practitioners should align acceptable-use policy with inline enforcement, not after-the-fact review.
Microsoft 365 DLP needs a multilayer enforcement model: labels, OCR, endpoint telemetry, browser controls, and outbound email inspection each solve a different part of the path. No single control can see screenshots, downloads, email, and AI prompts equally well. The governance lesson is simple: if the workflow can cross a boundary, the control must cross it too. Practitioners should architect for coverage across the egress path, not a single product boundary.
What this signals
Cross-boundary DLP is now the operating requirement: if a control cannot see screenshots, downloads, browser uploads, and prompt paste actions, it is not governing the real data path. Teams running Microsoft 365 should assume that the next policy failure will happen where the application boundary ends and the endpoint begins.
Identity teams need to care about destination context, not just entitlement: a permitted user can still create an unauthorised data flow when the destination is personal cloud storage, disposable email, or Shadow AI. That shifts policy from pure access control into egress governance, where user identity, device posture, and target service all matter at send time.
Data lineage is the difference between an alert and a case: without a source-to-destination trail, investigations fragment into isolated events across SharePoint, email, and endpoint logs. The operational implication is clear: if the team cannot reconstruct the path, it cannot confidently contain the risk or prove what left the environment.
For practitioners
- Extend DLP beyond the Microsoft 365 boundary Cover endpoint activity, browser uploads, email forwarding, and AI prompt transfer so policy survives once data leaves SharePoint, Teams, or Exchange.
- Add real-time inspection for images and clipboard transfers Use computer vision and prompt-aware inspection for screenshots, copied text, and pasted content where OCR or text-only rules will miss the violation.
- Rebuild incident response around data lineage Require a source-to-destination trail that shows the original file, the user action, the endpoint, and the final egress target before you triage.
- Treat personal cloud and Shadow AI destinations as egress risks Classify Dropbox, personal Gmail, disposable email services, and external AI tools as policy destinations that need blocking, quarantine, or coaching.
- Separate collaboration from exfiltration in policy design Allow legitimate sharing paths with business justification, but enforce stricter controls when the same data is redirected to unmanaged accounts or AI services.
Key takeaways
- Microsoft 365 DLP fails most visibly when content is converted, copied, or redirected across channels that app-scoped controls do not fully inspect.
- The article’s examples show that the operational problem is not lack of labels, but lack of lineage and inline coverage across endpoints, browsers, email, and AI tools.
- Practitioners need egress controls that travel with the data path, because legitimate access can still produce unauthorised movement once the workflow leaves Microsoft 365.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP API Security Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5 and CSA Cloud Controls Matrix set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0009;TA0010 — Collection; Exfiltration | The article is fundamentally about collecting and moving sensitive data out of sanctioned workflows. |
| Recommendation — Map Microsoft 365 egress paths to collection and exfiltration techniques, then monitor the channels users actually exploit. | ||
| NIST CSF 2.0 | PR.DS-01 — Data-at-rest is protected | The article highlights that data protections must persist as content moves between apps and endpoints. |
| PR.DS-10 — Confidentiality, integrity and availability of data are managed | The article focuses on preserving confidentiality as data traverses multiple outbound channels. | |
| Recommendation — Extend data protection controls so sensitive content remains protected when it leaves Microsoft 365 and reaches endpoints or external services. Manage confidentiality across the full transfer path, including screenshots, downloads, email, and AI prompt submission. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | The examples show that legitimate access still needs tight limits on what users can do with data. |
| AU-6 — Audit Review, Analysis, and Reporting | The article stresses that disconnected alerts are insufficient without reconstructable evidence. | |
| Recommendation — Limit export and sharing privileges so access to a file does not automatically permit uncontrolled redistribution. Correlate endpoint, email, and SaaS logs so investigators can review one complete data movement story. | ||
| OWASP API Security Top 10 | API9 — Improper Inventory Management | The article's Shadow AI and SaaS spread shows why teams must inventory sanctioned and unsanctioned data destinations. |
| Recommendation — Inventory every approved and unapproved data destination so policy can distinguish sanctioned sharing from unmanaged exfiltration. | ||
| CSA Cloud Controls Matrix | DSP — Data Security & Privacy | The cloud control domain fits the article's focus on protecting data in motion across SaaS and cloud destinations. |
| Recommendation — Apply DSP controls to govern sensitive data as it moves through cloud collaboration, storage, and external sharing services. | ||
Key terms
- Data Lineage: The record of how data moves across systems, applications, and workflows. In security operations, lineage shows where sensitive data propagates, which identities touch it, and how a compromise could spread across connected environments.
- Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
- Data exfiltration risk: Data exfiltration risk is the possibility that sensitive information leaves approved systems and enters an environment the organisation does not control. With Shadow AI, that often happens through ordinary user behaviour, which makes identity governance and data governance tightly linked rather than separate problems.
- Inline Enforcement: Inline enforcement is the technical act of applying access policy in the live session path, not just at approval time. It matters because identity governance without runtime enforcement can authorize access that the session layer never actually constrains, especially in distributed and third-party environments.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It gives practitioners a clearer way to connect identity controls with the data-handling risks that shape modern security programmes.
Published by the NHIMG editorial team on August 20, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org