Microsoft 365 Copilot Ignores Sensitivity Label on SharePoint File: Fix

You apply a sensitivity label to a SharePoint file to restrict access or prevent Copilot from reading it. But Copilot still summarizes, rewrites, or references the file in its responses. This happens because Copilot reads files based on SharePoint permissions and Microsoft Graph indexing, not solely on the label’s encryption or marking settings. The label alone does not block Copilot unless you configure the label to enforce encryption that removes the user’s read permission. This article explains why Copilot bypasses the label and how to configure sensitivity labels so Copilot respects your data protection rules.

Why Copilot Does Not Respect a Sensitivity Label on Its Own

A sensitivity label in Microsoft 365 can apply visual markings, encryption, or both. When you apply a label without encryption, Copilot can still read the file because the label only adds a header, footer, or watermark. The file remains fully accessible through SharePoint permissions and Microsoft Graph search indexing.

Copilot retrieves content from Microsoft Graph, which indexes files based on the user’s existing access rights. If a user has at least Read permission on the SharePoint file, Copilot can read the file regardless of the sensitivity label’s marking. The label does not revoke or modify the user’s SharePoint permission. Only encryption that explicitly removes the user’s read access will stop Copilot from processing the file.

Microsoft 365 treats sensitivity labels as metadata for classification and protection. Protection, meaning encryption, is optional. To block Copilot, you must configure the label to encrypt the file and then assign permissions that exclude the user or group that should not access the content.

Steps to Configure a Sensitivity Label That Blocks Copilot

1. Open the Microsoft Purview compliance portal
   Go to https://compliance.microsoft.com and sign in with a Global Administrator or Compliance Administrator account.
2. Navigate to sensitivity labels
   Select Information protection from the left menu, then click Labels under the Sensitivity labels section.
3. Edit the existing label or create a new one
   Click the label you want to modify. If you need a new label, click + Create a label. Provide a name and description, then click Next.
4. Enable encryption
   On the Define protection settings page, select Control access and then Assign permissions now or Let users assign permissions. For strict control, choose Assign permissions now.
5. Configure encryption permissions
   Click Assign permissions. In the panel, click + Add any authenticated users or add specific users or groups. For the users or groups you want to block, do NOT add them. Only add the users or groups that should have access. For example, add only the legal team and exclude all other users.
6. Set the access level
   Under Choose which permissions you want to grant, select View and Edit for the allowed users. Do not grant View to users who should be blocked. Click Save, then click Next.
7. Apply the label to the file
   After the label is published, apply it to the SharePoint file. In SharePoint, select the file, click the three dots, choose Details, then apply the sensitivity label from the label picker. The file will be encrypted. Users not listed in the label’s permissions will see an access denied error. Copilot will not be able to read the file.

If Copilot Still Reads the File After Label Encryption

Copilot returns content from the file even though I applied an encrypted label

This usually happens when the label uses the Let users assign permissions option and the user who applied the label granted themselves all permissions. In that case, the file is encrypted but the user who owns the file can still read it. To fix this, change the label to Assign permissions now and explicitly list the users who should have access. Remove any default entries that give full control to the file owner.

Copilot returns a generic error instead of file content

When Copilot cannot read an encrypted file, it should show an error like Unable to access this file due to sensitivity label restrictions. If you see a different error, check the file’s encryption status. Open the file in the desktop app, go to File > Info > Protect Document > Restrict Access. Confirm the label is applied and encryption is active. If the label shows as applied but the file is not encrypted, the label may not have encryption enabled. Return to the Purview portal and verify encryption is turned on.

Copilot reads files from a SharePoint library that has no sensitivity labels

If your tenant does not use sensitivity labels, you can block Copilot from accessing SharePoint content entirely. Go to the Microsoft 365 admin center, select Settings > Org settings > Copilot. Under Data sources, uncheck SharePoint. This prevents Copilot from reading any SharePoint file, regardless of labels. This is a tenant-wide setting and affects all users.

Copilot Behavior With Sensitivity Labels: Label Only vs Label With Encryption

Item	Label Without Encryption	Label With Encryption
Copilot can read the file	Yes, if user has SharePoint Read permission	No, unless user is explicitly granted access in the label
Visual marking applied	Yes	Yes
File remains searchable in Microsoft Graph	Yes	No, encryption removes the file from Graph index for blocked users
User sees access denied	No	Yes, for users not listed in the label permissions
Requires additional configuration	No	Yes, you must assign specific users or groups

Final Checks and Alternative Approaches

After configuring the label, test by signing in as a user who should be blocked. Open the file directly in SharePoint. The user should see an access denied message. Then open Copilot and ask a question about that file. Copilot should respond with an error stating it cannot access the file. If Copilot still returns content, the label is not encrypting the file or the user still has direct SharePoint permissions.

You can also use SharePoint site permissions to block specific users from the entire site. This works independently of labels but removes all access, not just Copilot access. For granular control, combine encrypted labels with SharePoint permission trimming. Review the Microsoft Purview audit log for label application events to confirm the label was applied correctly.

If your organization uses Microsoft 365 Copilot and requires strict data protection, configure sensitivity labels with encryption and assign permissions explicitly. This ensures Copilot respects the label and does not expose protected content to unauthorized users.