Purview DLP and sensitivity labels for Microsoft 365 Copilot

Copilot answers a prompt from Microsoft Graph and the semantic index built over your tenant. It runs in the security context of the person asking, and results are trimmed to what that account could already open. Copilot does not widen access. It removes the effort of finding content. Before a rollout, an over-permissioned site was protected mostly by obscurity, because staff only opened the folders they already knew about.

With Copilot, one prompt can pull an answer from any document the account can open, including documents the person has never seen.

Permissions decide what Copilot can retrieve. DLP and sensitivity labels decide what happens when sensitive content turns up in a prompt or an answer.

Where the tenant is licensed for it, Purview DLP has a dedicated policy location for Copilot, named Microsoft 365 Copilot and Copilot Chat. It is available only in the Custom policy template. Selecting it switches off every other location in the same policy.

A Copilot DLP policy is therefore a policy of its own. The policies that protect Exchange, SharePoint, OneDrive and Teams do not carry over to Copilot interactions by adding a location to them. Plan the Copilot policy as a separate object with its own owner, its own mode and its own review date, and record it in the same register as the other DLP policies.

Microsoft creates a default policy named Default DLP policy - Protect sensitive M365 Copilot interactions. Its settings are fixed at creation and stay that way until someone changes them.

A tenant that never switched the default policy to enforce mode is logging those information types in prompts and stopping none of them. Read the policy's mode before treating it as a control. The alerts raised in simulation show which information types appear in prompts across the organisation, and that record is the evidence for deciding which conditions to enforce and for whom.

Changing the mode is a decision for the policy owner, taken with the business areas that handle the information types concerned. A tax file number in a payroll team's prompts has a different meaning from the same number appearing in a general staff prompt.

The Purview or Entra AI roles that can create or edit a Copilot DLP policy are separate from the SharePoint and Exchange administrator roles. An administrator who runs SharePoint does not, by holding that role, control the Copilot policy. The holders of the Purview and AI roles form their own list, and that list needs the same review as any other privileged assignment.

An account holding Global Administrator, SharePoint Administrator or a Purview role can change the controls that limit Copilot's reach. List every standing assignment to those roles and check it against PIM, admin roles and break-glass accounts. An assignment left standing after a project ended is one of the defects Copilot makes easier to exploit.

Microsoft's Purview sensitivity label documentation states that where a label applies encryption, Copilot returns content from that item only when the user holds the usage rights to view and extract it. The same documentation states that content Copilot creates from labelled sources inherits the highest priority label among them.

Labels only do that work on content that carries them. An unlabelled file is governed by its permissions alone. Three settings decide how much of the tenant's sensitive content is labelled:

Check the label policies and the library settings together. A published taxonomy with no defaults and no auto-labelling leaves labelling to individual staff decisions, file by file.

Microsoft's Purview retention documentation states that Copilot prompts and responses are stored in a hidden folder in the user's mailbox, and that Purview retention policies have a location for Copilot interactions. Compare that retention policy with the organisation's records obligations, so prompts and responses are kept for as long as required and deleted on schedule.

Microsoft's Purview audit documentation describes a Copilot interaction event in the unified audit log. Confirm auditing is turned on, that audit retention suits the organisation's investigation needs, and that the events reach whatever system the security team monitors.

DLP acts on what Copilot retrieves, and retrieval follows permissions. The patterns that widen retrieval in SharePoint and OneDrive are the Everyone except external users group in a site's membership or a library's permissions, Anyone and organisation-wide sharing links on restricted material, and inheritance broken somewhere under a large audience.

Restricted Content Discovery is the SharePoint setting tenants reach for part-way through a rollout. It drops a site out of organisation-wide search and the tenant-wide discovery Copilot answers from. Content a person owns or already has open stays reachable, nothing is removed from the search index, and the site's permissions are unchanged. The setting needs a Microsoft Copilot licence and SharePoint Advanced Management. It applies to a ceiling of 20,000 sites, and a site over 500,000 items can take more than a week to drop out of search and Copilot.

Microsoft documents it as a temporary governance control. Treat each restricted site as an open finding with a named owner and a date for fixing the underlying permissions.

Copilot inherits identity controls from Entra ID. The review reads each Conditional Access policy and its exclusions. It checks MFA coverage across every account that matters, including break-glass accounts.

Application consent matters because third-party apps, connectors and agents can hold Graph permissions such as read access to every site. List applications with tenant-wide read permissions and check who granted them, using the method in app consent and service principals in Entra.

Guest accounts widen the audience for content in any team or site they are added to. Remove guests with no recent sign-in, map guests out of sites that hold sensitive content, and review the Entra cross-tenant access settings.

Run this before Copilot licences are assigned, and again once remediation lands. Permission changes in SharePoint and Entra take time to propagate through the search index, so the second pass confirms each fix is live.

Black Shard's Microsoft Copilot security review covers Conditional Access, privileged roles, app consent, SharePoint and OneDrive sharing, Copilot DLP, agents and Restricted Content Discovery with reader-level access, delivers the findings with a remediation plan, and re-checks the tenant once the fixes are in place.