What Purview DLP Really Controls in Copilot
Diesen Beitrag auf Deutsch lesen
Purview DLP can restrict Copilot web searches, prompts, labeled files and external emails, but it does not fix permissions or inspect uploaded files by content.
TL;DR
Microsoft Purview DLP uses separate controls for Microsoft 365 Copilot: it can stop external web search, block sensitive prompts, exclude labeled files or emails, and reject external email sources. It does not repair permissions or inspect directly uploaded files for Sensitive Information Types through this policy location.
Original by Julian Kusenberg, on MVPTreff. Read the original
This is our own summary, not a republication or full translation.
Governance takeaway
- Admins/CoE: Map each DLP rule to the processing step it should restrict, because web search, prompt handling, labeled items and external email sources have different effects.
- Security/Compliance: Keep permissions as the first control and add DLP for Copilot processing, since DLP does not correct excessive SharePoint access.
- Makers: Do not assume a sensitive direct upload will be detected by the Copilot DLP location, because its file content is not checked for Sensitive Information Types.
Frequently asked questions
How does Purview DLP prevent Microsoft 365 Copilot from using external web search?
Purview checks the prompt for defined Sensitive Information Types and prevents external web search when one is detected. Internal responses can still continue.
What happens when a Microsoft 365 Copilot prompt contains a Sensitive Information Type?
A matching Sensitive Information Type can prevent Copilot from answering the prompt at all. Another prompt without the sensitive information may still work.
Can Copilot DLP inspect a file uploaded directly to a Copilot prompt?
No. This Copilot DLP location checks the user-entered prompt text, not the uploaded file contents for Sensitive Information Types.