School district IT identifies sensitive information sprawl before enabling Copilot broadly. Which Purview capability supports that discovery?

School district IT identifying sensitive information sprawl before enabling Copilot broadly should use Microsoft Purview Data Explorer to locate sensitive information across municipal repositories. Broad Copilot enablement increases the value of knowing where student and staff sensitive data lives so permissions, labels, and DLP can be tightened first. Data Explorer provides that discovery lens across the organization’s data estate.

Insider Risk Management fails as a sensitive-data discovery console: it watches potentially risky user activity, not where sensitive student or staff data physically sits. Communication Compliance fails as a sensitive-data discovery tool: it reviews educator messages across school mailboxes for policy violations, not where sensitive information physically sits. Sensitivity Labels fail as a discovery method: they protect classified student records across sites, but labeling requires configuration and verification, and protection is not the same as locating sensitive-information sprawl.

Exam caveat: AB-900 pairs Copilot readiness with knowing where sensitive content lives. Data Explorer is the discovery answer; Compliance Manager, DLP, and Insider Risk are adjacent Purview capabilities with different jobs. Pick discovery when the stem emphasizes locating sprawl before broad Copilot enablement.

Operational check: Before expanding Copilot licenses for district staff, review Data Explorer results for high-risk repositories, remediate oversharing and missing labels on top hit locations, and document residual sprawl accepted by district leadership.