Step 1 – Requirement analysis

You need to prevent users from:

Pasting credit card numbers into ChatGPT/Google Gemini.

Uploading classified documents into ChatGPT/Google Gemini.

Both scenarios involve AI websites. Microsoft Purview provides Data Security Posture Management for AI and Endpoint DLP integrations that work through Data Loss Prevention (DLP) and Insider Risk Management policies.

Step 2 – Credit card numbers

Credit card numbers are structured sensitive information types (SITs).

DLP policies are the correct Microsoft Purview solution for detecting and blocking sensitive info (e.g., credit card, SSN, health ID) from being copied, pasted, or uploaded into restricted destinations like AI apps.

Therefore, Data Loss Prevention is the right choice.

???? Reference: Learn about Endpoint DLP and AI sites

Step 3 – Documents

Documents containing classified or labeled data (via sensitivity labels) fall under insider risk activity detection when exfiltrated.

Insider Risk Management policies can monitor and block uploads of classified/labeled files to AI services such as ChatGPT or Gemini.

Therefore, Insider Risk Management is the right choice for preventing document uploads.

???? Reference: Insider Risk Management – risky AI activity detection