Data loss prevention for Microsoft 365 Copilot

The Microsoft 365 Copilot and Copilot Chat policy location lets DLP control what Copilot, Copilot Chat and Cowork can use or process. It is available only in the Custom policy template, and choosing it disables every other location in that policy. Updates can take up to four hours to reach Copilot.

The four controls

Key points:

• A single rule cannot combine a sensitive information type condition and a sensitivity label condition. Use two rules in the same policy.
• Blocking sensitive prompts supports only built-in and custom SITs.
• Label blocking covers stored and open files, and emails sent on or after 1 January 2025. Calendar invites are not supported.
• DLP checks only the text typed into a prompt. It cannot scan the contents of files uploaded directly into a prompt.
• External email blocking checks sender metadata (the domain against accepted domains) and never inspects the body. It exists to reduce the risk of prompt injection through untrusted email.
• In Word, Excel and PowerPoint the label-based policy is evaluated when the file opens, so a label applied mid-session is enforced only the next time the file is opened. If a labelled file is open and the policy blocks it, Copilot skills in the app are disabled.
• The Learn about access restrictions link in a policy tip points to Microsoft Learn by default. A compliance URL (starting with https://) can replace it.
• Copilot prompts run as the user. DLP only excludes content the user could already see; it does not change permissions.

Roles that can create or edit these policies include Microsoft Entra AI Admin, Purview Data Security AI Admin (which cannot read prompts and responses), Purview Compliance Administrator, Purview Information Protection Admin, Purview Security Administrator and Entra Global Administrator.

Default Copilot policy

The default policy, named Default DLP policy - Protect sensitive M365 Copilot interactions, starts in simulation mode with policy tips shown. It logs matches and sends a low-severity alert email if one is configured, but it blocks nothing until the state is changed to turn it on. Microsoft recommends turning on incident reports and adding the security team as recipients.

Common trap: Leaving the default Copilot policy in place and assuming prompts containing credit card numbers are blocked - it starts in simulation mode, so it only records matches until an administrator enforces it.

Get the whole book

This note is one section of Ultra Transcenders AB-650: Administering Microsoft 365 and AI Services, an independent study guide that explains every topic the exam covers by technology, with comparison tables, diagrams and the common traps, plus a glossary linked to Microsoft Learn.

About the book · AB-650 terms in the glossary · All AB-650 study notes