Communication compliance monitoring is configured for enterprise AI tools

Overview

Collection Policies provide the data ingestion layer that supports monitoring of enterprise AI app activity. When these policies are in place, Communication Compliance can collect signals from AI app interactions and help organizations understand where data protection risks may exist across AI‑enabled workflows. This visibility helps teams apply data protection controls more consistently as AI use expands beyond Microsoft 365 Copilot.

In practice, users may accidentally share sensitive data with custom AI applications, Power Automate flows, AI Builder automations, or non‑Microsoft AI services that aren’t approved to handle confidential information. However, Communication Compliance policies that cover enterprise AI app interactions can help surface potential data exposure to these services and extend data protection practices to custom and third‑party AI solutions.

Remediation

• Create and Deploy collection policies
• Create and manage Communication Compliance policies

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	Medium
Impact on users	Medium
Pillar	Data, AI
Category	Data Security Posture Management
Product	Purview
Feature	Insider risk management
Area	Logging and detection
Licence	EXCHANGE_S_ENTERPRISE
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.