If you roll out Microsoft 365 Copilot, someone will eventually ask what happens when a user pastes credit card numbers or HR data into a prompt. A Purview DLP policy for Copilot answers that question with real controls. This article walks through the four controls that exist today, the setup in the Purview portal and the limits you should know before you rely on it.

Purview offers four separate controls for Copilot interactions

Everything starts with a dedicated policy location called "Microsoft 365 Copilot and Copilot Chat". Rules in that location apply only to Copilot, Copilot Chat and Cowork. According to Microsoft Learn on DLP for Microsoft 365 Copilot, four capabilities are available right now.

You can block external web search when a prompt contains specific sensitive information types (SITs). You can stop Copilot from processing the prompt at all. You can exclude files and emails that carry chosen sensitivity labels. And, still in preview, you can keep emails from external senders out of Copilot's grounding data.

Every prompt runs in the security context of the user who sends it. DLP rules therefore complement your permission model instead of replacing it. If your tenant suffers from oversharing, a DLP policy only fixes part of the problem.

A short diagram shows how a prompt is evaluated

Before you start clicking, it helps to know the order of evaluation. The policy first inspects the typed prompt and then the sources Copilot wants to use. The diagram below shows a simplified version of that flow.

flowchart TD
    A["User sends a prompt"] --> B["SIT in the prompt?"]
    B -->|"Yes, block prompt"| C["No response"]
    B -->|"Yes, block web search"| D["Internal answer only"]
    B -->|"No"| E["Sources are checked"]
    E --> F["Label or external sender?"]
    F -->|"Yes"| G["Content is excluded"]
    F -->|"No"| H["Answer uses all sources"]

Simplified evaluation flow of a Copilot DLP policy in Microsoft Purview

One point from the documentation matters a lot: DLP only checks the text typed into the prompt. Files uploaded to a prompt are not scanned for sensitive data.

You create the policy in the Purview portal in six steps

You need one of the roles Purview Compliance Administrator, Purview Security Administrator or Purview Data Security AI Admin. Licensing follows your Microsoft 365 Enterprise plan. These are the steps for blocking external web search:

  1. Sign in to the Microsoft Purview portal and open "Data Loss Prevention", then "Policies".
  2. Select "Create policy", then the "Custom" template and "Custom policy".
  3. On the "Locations" page, turn on only "Microsoft 365 Copilot and Copilot Chat". All other locations switch off automatically.
  4. Add a rule with the condition "Content contains > Sensitive information types" and pick your SITs.
  5. Set the action to "Prevent Copilot from processing content" and choose "Performing Web Searches". For the prompt block, choose "Processing prompts" instead.
  6. Save the policy and turn it on.

Changes can take up to four hours to take effect. Keep that in mind during testing, otherwise you may write off a working policy as broken.

Tip: Start in simulation mode. The Copilot location supports simulation as well as alerts and notifications, so you can see how often the rule matches before anyone is actually blocked.

Three everyday scenarios show where the rules apply

An HR specialist asks Copilot Chat to draft a rejection letter and pastes in the applicant's bank account and home address. The prompt might read: "Write a polite rejection for this candidate and do not repeat the IBAN." The prompt block with the built-in SITs for bank data and addresses handles this. Copilot does not answer, and the specialist sees a message about the organization's policy. The benefit has limits: the rule only catches patterns defined as SITs, it ignores uploaded attachments, and the documentation still labels it as preview, so it may not have reached your tenant yet.

A sales representative asks Copilot each morning: "Summarize my emails from the last three days and list open tasks." If the mailbox contains external messages with hidden instructions, Copilot could treat them as part of the task. The preview rule "Email is received from > External users" removes such mail from processing. The summary then rests on internal messages only, which obviously leaves gaps for someone who lives off customer email. The rule looks at sender metadata, not at the message body. For more background, read my article on prompt injection protection in Defender for Office 365.

The third scenario involves sensitivity labels. A legal team uses Copilot to compare contract drafts, but anything labeled "Highly Confidential" must never show up in summaries. The rule "Content contains > Sensitivity labels" covers that. Labeled items can still appear as citations, yet their content does not flow into the response. In Word, Excel and PowerPoint the policy is evaluated when the file opens, so a label applied mid-session only takes effect the next time the file is opened.

Several technical limits define the real level of protection

A single rule cannot combine the SIT condition and the sensitivity label condition. Create two rules in the same policy instead. For email, only messages sent on or after January 1, 2025 count, and calendar invitations are not covered.

One detail is easy to miss. In the rule's user notification settings you can enter your own compliance URL under "Policy Tips". The "Learn about access restrictions" link then opens an internal page, for example on SharePoint, instead of Microsoft Learn. That saves your help desk a lot of questions.

Microsoft also dropped a planned extension. Administrative units were meant to work with Copilot DLP policies, but according to Microsoft Purview What's New and the related Message Center post, that change will not ship. Tenant-wide policies stay the standard. If you also want to control Copilot costs, my article on the Copilot spending policy is the natural companion.

A small pilot with clear SITs is the fastest way to start

Begin with a policy that only blocks web search on SIT matches, then expand step by step. It barely touches productivity and closes a real gap. Review the DLP alerts before you block prompts or exclude labels. To cover endpoints as well, combine this with Endpoint DLP for AI websites, because the Copilot policy only covers Copilot itself.