purview-dlp-integration

Microsoft Purview DLP Integration for Agent 365

Trigger phrases — any of these will activate this skill automatically:

• "add Purview DLP to my agent"
• "add data loss prevention to my A365 agent"
• "block credit cards / SSNs / PII before my agent's LLM sees them"
• "enforce compliance / audit on agent prompts and responses"
• "wire a DLP gate into my agent code"
• "call the Graph processContent API from my agent"
• "add Purview blocking to my Node.js / Python / .NET agent"

---

Add a Purview data-loss-prevention gate before an existing A365 agent's LLM call: each prompt is evaluated via the Graph processContent API and blocked when an input-blocking policy matches. Optional response checks provide audit, not response blocking, for the supplied Applications policy. processContent sends the checked text to Microsoft Purview for evaluation and audit. Designed for minimal, reversible changes to the customer's agent.

When to use

• "Add Purview DLP / data loss prevention to my agent."
• "Block credit cards / SSNs / PII before my agent's LLM sees them."
• "Enforce compliance / audit on agent prompts and responses."
• Any A365 agent — Node.js, Python, or .NET — that needs inline DLP.

When NOT to use

• Adding OpenTelemetry tracing / MAC Activity telemetry → use instrument-observability.
• Diagnosing why telemetry isn't reaching MAC Activity / Defender → use a365-code-validator.
• Provisioning the blueprint / Entra permissions from scratch → use a365-setup / make-a365-agent first, then return here.

How it works

user turn ─► [INPUT gate] processContent(uploadText, /me)  ─► block? ─► reply "blocked", STOP (LLM never called)
                                                            └─ allow ─► LLM ─► optional output audit ─► reply

• Token: the agent's agentic delegated Graph token, evaluated as /me (the agent identity) — acquired via the agent's own auth handler: Node.js GetAgenticUserToken, Python authorization.exchange_token(…), .NET UserAuthorization.GetTurnTokenAsync(…). A365 blueprint apps cannot use app-only client-credentials here — Graph strips data-plane roles from that token.
• Fail-closed by default: any Purview error/timeout blocks the turn.
• Content limit: delegated guards reject messages over 100,000 characters before sending them to Graph, even in fail-open mode. They never approve a full message based on a prefix.
• Output: PURVIEW_CHECK_OUTPUT=true submits responses for audit. The supplied workload does not support DownloadText blocking; do not promise that it filters sensitive responses. With fail-closed mode, a failed output audit still withholds the reply.
• Policy: a dedicated Purview DLP policy scoped to the agent's Entra app id (portal: "Managed cloud apps" / Applications workload) with a RestrictAccess=Block rule.