Microsoft Purview
A Microsoft data governance service that helps manage and govern on-premises, multicloud, and software-as-a-service data. Previously known as Azure Purview.
1,366 questions
DPSM for AI Policy Not Generating Alerts Despite Meeting Prerequisites
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(3.2, 91%, 10%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EBM%3C/text%3E%3C/svg%3E)
Brett Mitchell
21
Reputation points
We've configured a DPSM for AI policy to detect when users visit AI sites, but it's not generating any alerts despite meeting all prerequisites and testing. Does anyone have any idea why?
Here are the details:
Policy Configuration:
- Policy: DPSM for AI - Detect when users visit AI sites
- Template: Risky browser usage (preview)
- Indicator: "Browsed to generative AI websites" (1/14 selected)
- Threshold: Custom setting of 1 event per day
- Alert Levels:
- Low severity: >1 to 5 events/day
- Medium severity: >5 to 10 events/day
- High severity: >10 events/day
Prerequisites Verified:
- Microsoft Purview Audit enabled and active
- Purview browser extension installed and enabled (blue icon confirmed)
- Device successfully onboarded to Purview
- Data discovery policies configured
Testing Conducted:
- Used Purview-onboarded device
- Browser (Edge) has Purview extension enabled
- Visited multiple LLM sites including:
- ChatGPT
- Claude
- Gemini
Issue:
- No alerts are being generated
Activity insights show 0 users exceeded lowest daily thresholds in past 10 days
More detail/screenshots attached:
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(201.6, 18%, 29%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EGG%3C/text%3E%3C/svg%3E)
Ganesh Gurram 3,675 Reputation points Microsoft Vendor2025-01-31T14:57:52.19+00:00 Hi @Brett Mitchell
Greetings & Welcome to the Microsoft Q&A forum! Thank you for sharing your query.
To address the issue of your DPSM for AI policy not generating alerts despite meeting all prerequisites, let's explore some potential reasons and solutions.
Review the Selected Indicators - Since you have only selected one indicator ("Browsed to generative AI websites"), consider enabling more indicators to increase the likelihood of generating alerts. The more indicators you have, the broader the scope for detecting risky activities.
Threshold Configuration - Your custom setting of 1 event per day might be too restrictive. If the activity is not consistently meeting this threshold, it could result in no alerts being generated. You might want to review and adjust the thresholds to see if that impacts alert generation.
Activity Visibility - Ensure that the activities you are testing are indeed being logged and visible in the activity insights. If the activity insights show 0 users exceeding the daily thresholds, it may indicate that the activities are not being detected at all.
Policy Coverage - Check if the policy is adequately covering the users you are testing. If the policy has limited user coverage, it may not generate alerts for the activities performed by those users.
Browser Compatibility - Although you mentioned using the Edge browser with the Purview extension enabled, ensure that there are no compatibility issues or settings that may prevent the extension from functioning correctly.
For more details refer to these documentations:
- Best practices for managing your alert volume in insider risk management
- Learn about insider risk management policy templates
I hope this information helps.
Kindly consider upvoting the comment if the information provided is helpful. This can assist other community members in resolving similar issues.
-
Brett Mitchell 21 Reputation points
2025-02-03T00:31:46.27+00:00 Hi Ganesh ; thanks for your response. I appreciate your insights.
To clarify:
• Indicators: I’m only interested in the selected indicator—alerts when a user navigates to an LLM site.
• Triggering Threshold: Set to 1, as I want to be notified each time this occurs.
• Policy Coverage: Applied across the organisation, though only a subset of devices have the Purview Extension installed.
• Activity Visibility: This is where I believe the issue lies. I'm not seeing 'AI interactions' in the activity explorer in DPSM for AI for third party LLM sites like ChatGPT and Claude. I’m looking for additional ways to ensure that user navigation to these LLM sites is logged and appears in activity insights.
I appreciate your input and would welcome any further suggestions to improve visibility.
Sign in to comment
Sign in to answer