Unclear test/false negative: Communication compliance monitoring is configured for enterprise AI tools (Test ID: 35040)

[JeremyFinneyOT]

Test ID: 35040 is a good example of ZTA tests that are unclear what is being tested and what is being recommended (ie really unhelpful).

The DSPM portal in purview recommends/configures a baseline policy "DSPM for AI - Capture interactions for enterprise AI apps". Surely this policy would satisfy Test ID: 35040 (but it is showing failed in my results).

To be clear, ZTA shows the 4 collection policies that DSPM configured.

Issue:
The DSPM portal shows this policy is correctly configured.
The ZTA assessment says "No Communication Compliance rules targeting enterprise AI apps were found."

And this leads to the next issue, what is this test actually looking for? the Remediation action links refer to rather generic guidance on communication compliance. It is not specific to rules targeting enterprise AI apps... so that isn't going to help admins that much.

I would think that if something is important enough to appear in the ZTA, then there should be specific official implementation guidance somewhere to link to.

In this case, better guidance might be "follow the setup tasks in the DSPM Purview module". ZTA should align with other MS guidance and tools right?

[TyGrady]

JeremyFinneyOT Thanks for raising this. The feedback is valid that Test 35040 does not clearly explain the distinction between capturing enterprise AI interactions and monitoring them through Communication Compliance.

The DSPM policy “DSPM for AI – Capture interactions for enterprise AI apps” configures the collection layer. It makes enterprise AI interaction data available to Purview, but it does not by itself configure a Communication Compliance policy to evaluate those interactions and generate policy matches. Test 35040 currently requires both capabilities, so the collection policies shown in the assessment do not on their own satisfy the test.

That said, the failure message and remediation guidance should make this distinction much clearer. They should acknowledge when collection is already configured and direct the administrator to the remaining action: create or update an enabled Communication Compliance policy and select Enterprise AI apps as a location. We also identified areas in the test logic that should be corrected to ensure it reliably associates the detected rule with the appropriate enabled policy and supports all valid enterprise AI workload identifiers.

We’ll rework the specification and implementation to improve the accuracy, explanation, and remediation guidance while keeping the collection and monitoring requirements aligned with Microsoft Purview’s documented configuration model.