Purview DLP for Microsoft 365 Copilot: block labeled content and sensitive prompts

Microsoft 365 Copilot answers with whatever the signed-in user can open, so permissions and sensitivity labels are your first line of defense. Purview data loss prevention (DLP) adds a second: a dedicated policy location that keeps labeled files and emails out of Copilot's answers, stops Copilot responding to prompts that contain sensitive data, and keeps such prompts away from web search. In this post I'll set up each control, show what users see, and cover testing and the limits.

How it works#

The Microsoft 365 Copilot and Copilot Chat location covers Microsoft 365 Copilot, Copilot Chat and Cowork; the label and prompt controls also apply to Copilot in Word, Excel and PowerPoint. Copilot always runs in the user's security context, so DLP only narrows what Copilot may use from content the user can already reach.

Two design rules: the location exists only in the Custom policy template, and selecting it turns off every other location, so Copilot policies stand alone. And a single rule can't combine the sensitive information type and sensitivity label conditions; use one rule for each, in the same policy if you like.

Prerequisites#

• Roles: the Purview Data Security AI Admins role group is the least-privileged fit; its Data Security AI Admin role can edit Copilot DLP policies but can't read prompts and responses. Compliance Administrator, Compliance Data Administrator, Information Protection Admin and Security Administrator also work.
• Licensing: Microsoft points to the Microsoft 365 service descriptions; confirm your plans before you design.
• Labels in use: the label control only helps if content is labeled. See rolling out sensitivity labels.

Step-by-step#

1. Review the default policy#

In the Microsoft Purview portal, open Data loss prevention › Policies. The default policy covers all users, looks for a long list of common identity, tax and financial information types in prompts, and in simulation it blocks nothing: it raises an alert and can email admins. Microsoft recommends at least turning on incident reports with your security team as recipients. Remove information types that don't apply to you, then decide whether to enforce it, leave it off or delete it. Editing it needs DLP Compliance Management permissions.

2. Keep labeled content out of answers#

1. Select + Create policy, choose the Custom template and then Custom policy.
2. On Locations, turn on Microsoft 365 Copilot and Copilot Chat.
3. Add a rule with Content contains › Sensitivity labels (for example your Highly Confidential labels) and the action Prevent Copilot from processing content.
4. Start in simulation mode.

The same policy from Security & Compliance PowerShell, adapted from Microsoft's New-DlpCompliancePolicy example:

Connect-IPPSSession
Get-Label | Format-Table DisplayName,Guid
$labelGuid = "<label GUID>"
$loc = '[{"Workload":"Applications","Location":"470f2276-e011-4e9d-a6ec-20768be3a4b0","Inclusions":[{"Type":"Tenant","Identity":"All"}]}]'
New-DlpCompliancePolicy -Name "Copilot - Labeled content" -Locations $loc -EnforcementPlanes @("CopilotExperiences") -Mode TestWithoutNotifications
$advRule = @{ Version = "1.0"; Condition = @{ Operator = "And"; SubConditions = @(
  @{ ConditionName = "ContentContainsSensitiveInformation"; Value = @( @{ groups = @(
    @{ Operator = "Or"; name = "Default"; labels = @( @{ name = $labelGuid; type = "Sensitivity" } ) } ) } ) } ) } } |
  ConvertTo-Json -Depth 100
New-DlpComplianceRule -Name "Copilot - Exclude labeled" -Policy "Copilot - Labeled content" `
  -AdvancedRule $advRule -RestrictAccess @(@{setting="ExcludeContentProcessing";value="Block"})

3. Block sensitive prompts or web searches#

Add a separate rule with Content contains › Sensitive information types. Built-in and custom information types are supported. Choose Processing prompts to stop the answer entirely, or Performing Web Searches to let Copilot answer from internal data without sending the prompt to a search provider. In the rule's user notification settings, turn on policy tips and use Provide a compliance URL for the end user to learn more about your organization's policies with a full https:// address, so the block message points to your own guidance.

4. Optionally exclude external email (preview)#

A rule with Email is received from › External users keeps messages from domains outside your accepted domains out of Copilot's grounding. It reduces the risk of prompt injection through inbound mail; users can still open those emails themselves.

5. Simulate, then enforce#

Review matches and alerts, tune the information types, then turn the policy on. Allow up to four hours for any change to reach Copilot.

What users see#

• Blocked prompt: no answer, and a message that the request contains sensitive information your organization has blocked Copilot from using, with a Learn about access restrictions link (Microsoft Learn unless you set your own URL). During the preview, Word, Excel and PowerPoint may not say clearly that a policy caused the block.
• Labeled file open in Word, Excel or PowerPoint: Copilot skills are disabled. The policy is evaluated when the file opens, so a label applied mid-session takes effect next time.
• Excluded external email: the answer is built from internal sources, with a note that some content was excluded by an organizational policy.

Verify#

• As a test user in scope, ask Copilot Chat to summarize a document carrying the protected label: the document may be cited, but its content isn't used.
• Type a prompt containing a dummy value for a blocked information type: Copilot refuses when enforced; in simulation, the match is recorded and alerts fire if you turned them on. Check them as described in investigating DLP alerts.
• Get-DlpCompliancePolicy -Identity "Copilot - Labeled content" -DistributionDetail shows the policy distributed without errors.

Tips and limitations#

• Uploaded files aren't scanned. DLP checks only the text typed into the prompt.
• Coverage limits: the label rule covers emails sent on or after January 1, 2025, and calendar invites aren't supported.
• No admin units for this location.
• Not everything is blocked: some experiences that don't reference file content or don't use a large language model aren't blocked.
• DLP doesn't fix oversharing. Start with finding SharePoint oversharing and DSPM for AI oversharing assessments.
• Noisy prompt rules? See tuning DLP false positives.

References#

• Microsoft Purview DLP for Microsoft 365 Copilot and Cowork (Microsoft Learn)
• The default DLP policy for the Microsoft 365 Copilot location (Microsoft Learn)
• New-DlpCompliancePolicy (Microsoft Learn)