Microsoft 365 DLP gaps expose the limits of Purview alone

At a glance

What this is: This is an analysis of where Microsoft 365 DLP breaks down, with Nightfall claiming that Purview misses common exfiltration paths such as screenshots, post-download transfers, and AI prompt leakage.

Why it matters: It matters because IAM, DLP, and identity governance teams need visibility into how data moves across users, devices, and AI tools, not just inside a single SaaS boundary.

By the numbers:

• Nightfall says 95% precision is achievable out of the box with its pre-trained detection models, reducing the tuning burden that often slows DLP rollout.

👉 Read Nightfall's analysis of Microsoft 365 DLP gaps and Copilot prompt exposure

Context

Microsoft 365 DLP is no longer just a question of matching patterns in email or documents. The real problem is that sensitive data now moves through screenshots, browser uploads, endpoint sync, clipboard actions, and AI prompts, which means control has to follow the data rather than stop at the application boundary.

Purview remains useful for baseline policy enforcement, but the governance gap appears when data leaves the text layer or crosses into unmanaged destinations such as personal cloud storage and Shadow AI. For identity and access teams, that gap overlaps with lifecycle controls, device trust, and the challenge of proving who moved what, where, and when.

Key questions

Q: What breaks when DLP only covers Microsoft 365 apps?

A: Coverage gaps appear wherever sensitive work happens outside the Microsoft stack. Source code, CAD files, proprietary formats, and non-Microsoft applications can move data without matching policy enforcement, so the organisation gets selective protection instead of enterprise coverage. That is why teams should validate actual file classes, endpoint types, and workflow paths before treating native DLP as complete.

Q: Why do screenshots and clipboard actions create DLP blind spots?

A: They convert sensitive text into formats that older DLP logic does not inspect well. Screenshots become images, and clipboard content can move into AI tools without a file event. That means PHI, PCI, PII, and secrets can leave policy boundaries through everyday user behaviour that looks legitimate unless the control is real-time and content aware.

Q: How do you know if data lineage is actually working?

A: Lineage is working when controls continue to follow the data after export and transformation, and when teams can reconstruct the file path without manual log stitching. If the system only classifies data at creation, the lineage model is incomplete.

Q: Who is accountable when sensitive data is retained in a third-party AI tool?

A: Accountability sits with the organisation that allowed the data into the tool, even if the provider stores or processes it. Teams need clear ownership for prompt retention, deletion requests, and vendor data processing terms. If the provider cannot prove erasure or lineage, the organisation still carries the compliance and privacy risk.

Technical breakdown

Why pattern-based DLP misses screenshots and image-based leakage

Traditional DLP rules look for strings, labels, or file metadata. That works when data is copied as text, but screenshots convert sensitive content into pixels, which defeats pattern matching unless optical character recognition and computer vision are applied in real time. In Microsoft 365, this matters because screenshots often carry PHI, PII, PCI, or secrets in a form that looks harmless to text-first controls. The architectural issue is not just detection accuracy. It is detection timing, content understanding, and whether the control can act before the image is shared beyond recovery.

Practical implication: add image-aware inspection on collaboration channels where screenshots are routine, and require real-time intervention before transmission.

How data lineage changes the meaning of Microsoft 365 alerts

A single download alert is not the same as a data loss event. Data lineage connects the source document, endpoint activity, browser upload, and later sharing path into one chain of custody. Without that linkage, security teams see isolated events and cannot distinguish normal business movement from exfiltration. For identity and governance teams, lineage also helps attribute risky behaviour to a user, device, and destination context rather than treating every file event as independent noise. The control value is forensic continuity, not just detection volume.

Practical implication: require DLP tooling to preserve source-to-destination lineage across SharePoint, endpoints, browsers, and external storage services.

Why AI prompts are now a data-loss boundary

Copilot, ChatGPT, and similar tools create a new egress path because users can paste sensitive material directly into prompts without using a file upload or email workflow. That breaks older controls that only watch attachment content or sanctioned sharing actions. Once a prompt is sent, the organisation may lose control over retention, reuse, and downstream exposure. This is where AI governance and identity governance meet: the system must know which user, which device, and which content class is crossing into an external or semi-external model environment. Prompt inspection is now a DLP and Shadow AI control, not a niche AI security feature.

Practical implication: extend DLP policy to clipboard and prompt activity, especially where users can move regulated or proprietary data into AI services.

Threat narrative

Attacker objective: The objective is to move sensitive enterprise data out of monitored Microsoft 365 workflows and into destinations the organisation cannot reliably inspect or revoke.

1. Entry occurs when a user captures regulated or proprietary information in a screenshot, downloads a file from SharePoint, or copies content into an AI prompt.
2. Credential or access abuse follows when the user moves that same content into personal cloud storage, external email, or unmanaged AI services outside approved governance.
3. Impact is the loss of visibility, traceability, and control over sensitive data, which can lead to exposure, regulatory breach, or uncontrolled secondary sharing.

NHI Mgmt Group analysis

Purview-only thinking creates a visibility gap, not a compliance strategy. Pattern matching and application-bound policies can help with checkbox control, but they do not describe where data goes after it leaves Microsoft 365. The problem is control fragmentation across email, collaboration, endpoints, browsers, and personal cloud services. Security teams should treat cross-boundary lineage as a governance requirement, not a reporting enhancement.

Data lineage is now the control plane for modern DLP. When a download, rename, browser upload, and email forward are disconnected, the organisation cannot reconstruct the event chain well enough to prevent recurrence. That is the real failure mode this article exposes: alerting without custody. Teams should align DLP design to chain-of-custody evidence, not standalone policy hits.

Shadow AI turns data governance into identity governance. Once employees paste content into Copilot or other LLM services, the security question is no longer only what data was shared, but who was authorised to send it, from which device, and under what policy. AI prompt exfiltration gap: this is the specific governance blind spot where endpoint, DLP, and IAM controls must converge. Practitioners should treat prompts as governed data events.

Computer vision and OCR only matter when they are operationally connected to enforcement. Screenshot detection is useful only if the organisation can block, redact, or coach at the moment of sharing. That shifts the focus from detection coverage to actionability. For security architects, the lesson is that better classification without intervention simply improves the quality of the alert backlog.

Identity teams need to reframe DLP as an entitlement problem. Departing employees, unmanaged devices, and personal accounts all widen the paths through which data can leave the enterprise. The article’s scenario around SharePoint downloads and personal Dropbox use shows that access lifecycle and destination control are inseparable. Practitioners should connect DLP decisions to identity lifecycle, device trust, and offboarding rigor.

What this signals

Microsoft 365 DLP is converging with identity governance. Once users can move sensitive content through screenshots, personal cloud accounts, and AI prompts, the control problem is no longer just classification. It becomes a question of who had the right to move the data, from which device, and into which destination. That makes lifecycle governance and device trust central to DLP design.

AI prompt controls will become a standard enterprise exfiltration control. Teams that treat Copilot and other LLM tools as out-of-scope will miss the fastest-growing route for proprietary content leakage. The practical signal is simple: if prompt inspection is absent, policy coverage is incomplete.

Data security programmes should expect more convergence between DLP, endpoint control, and NHI governance. In environments where service accounts, user sessions, and AI tools all influence how content is shared, the boundary between access control and data control keeps shrinking. Practitioners should plan for policies that span devices, collaboration tools, and external model interactions.

For practitioners

• Implement cross-boundary data lineage Track sensitive file movement from Microsoft 365 sources to endpoints, browsers, personal cloud storage, and email so a download alert becomes a complete event chain.
• Extend policy to screenshots and images Use OCR and computer vision on collaboration channels where screenshots are common, and require inline intervention before a PHI, PCI, or PII image is posted.
• Govern clipboard and prompt activity Inspect paste actions into Copilot and other AI tools, especially when users copy proprietary code, customer data, or financial material from managed repositories.
• Link DLP to identity lifecycle controls Revise offboarding and access reviews so departed users, stale permissions, and unmanaged endpoints are assessed alongside data-sharing policy exceptions.
• Automate containment for high-risk transfers Block or quarantine outbound messages and uploads that combine sensitive content with high-risk destinations such as disposable email, personal Dropbox, or Shadow AI tools.

Key takeaways

• The core problem is not whether Purview can classify some content, but whether it can preserve custody once data leaves the visible Microsoft 365 workflow.
• Screenshot leakage, post-download transfers, and AI prompt sharing show that modern DLP failures are often cross-boundary and identity-linked rather than purely content-based.
• Practitioners need lineage, inline enforcement, and governed AI prompt controls if they want to reduce exfiltration rather than just generate alerts.

Key terms

• Data Lineage: The record of how data moves across systems, applications, and workflows. In security operations, lineage shows where sensitive data propagates, which identities touch it, and how a compromise could spread across connected environments.
• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
• Computer Vision DLP: Computer vision DLP is content inspection that understands images, screenshots, and visual text rather than relying only on string matching. It is essential where sensitive data is captured as pixels and shared through collaboration tools before traditional text-based controls can react.
• Prompt-based exfiltration: Data leakage that occurs when users paste sensitive information into GenAI prompts or browser-based AI tools. The content leaves the enterprise through interaction rather than file transfer, which makes traditional file DLP insufficient on its own.

What's in the full article

Nightfall's full post covers the operational detail this post intentionally leaves for the source:

• Inline Microsoft 365 enforcement logic for blocking, quarantining, and coaching on policy violations
• Endpoint and browser agent behaviour for tracking downloads, uploads, clipboard actions, and file renames
• Specific handling of Copilot, ChatGPT, Claude, Gemini, and other AI tool prompts
• Deployment and tuning details for Teams, SharePoint, Exchange, Slack, Salesforce, and endpoint coverage

👉 The full Nightfall post covers screenshot detection, data lineage, and AI prompt enforcement in operational detail.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, secrets management, and identity lifecycle controls. It helps security and identity teams connect access governance to the data movement risks now showing up in collaboration tools and AI workflows.