Official documentation checked October 14, 2026.
Microsoft Purview DLP can restrict specific Copilot interactions, but “DLP blocks Copilot” is too broad to be a useful test. Blocking a sensitive prompt, excluding a labeled source and preventing external web search are different actions with different expected results.
This guide covers organizational Microsoft 365 Copilot and Copilot Chat. Do not assume that a policy for these services also protects every personal-account chatbot, agent or browser upload.
Identify the Action You Want to Prevent
The current Copilot DLP documentation distinguishes these controls:
- Sensitive prompt processing: restrict a prompt that matches configured sensitive information types. This feature is documented as preview/rolling out.
- External web search: prevent the web-search action for a matching sensitive prompt, while permitted internal grounding can still return an answer.
- Labeled source processing: exclude supported files or emails with specified sensitivity labels; a citation can remain without the content being used.
- External email grounding: a separate preview control excludes qualifying external email based on sender-domain metadata.
A rule that blocks external sharing in Exchange or SharePoint is not automatically the same as any of these actions. Nor is a Graph connector or Microsoft Graph Data Connect a prerequisite for a universal prompt-and-response interception layer.
Configure a Rule for the Correct Location
Have the authorized DLP administrator verify the current licensing and tenant availability. In Purview, use a custom policy with the Microsoft 365 Copilot and Copilot Chat location and the supported condition/action corresponding to the intended outcome.
Do not add the Devices location solely because the user runs Copilot on a computer. Endpoint controls protect different activities. Microsoft’s AI protection overview distinguishes those device/browser capabilities from the Copilot policy location.
Use separate rules where the supported condition combinations require it. In particular, sensitive-information-type and sensitivity-label conditions cannot be combined in the same Copilot rule. A trainable classifier available in another Purview feature is not proof that it is a supported blocking condition here.
Test Detection and Enforcement Separately
Follow the DLP deployment workflow with a limited approved scope. Where supported, simulation helps inspect matches and impact; it is not an enforcement test. After enabling the pilot, repeat the same controlled case.
Use synthetic data designed to match the selected detector, never real customer identifiers. For a labeled-file test, use a harmless unique fact in a correctly labeled source and compare with an approved unrestricted control. Record the user, product, rule, action, time and result.
A typed-prompt test does not establish that uploaded file contents were inspected. A missing response does not by itself identify a DLP block. Likewise, an internally grounded answer does not establish that a web-search restriction failed.
Interpret Messages and Logs Without Assuming a Universal Banner
Do not expect one exact red banner in every app. Preview experiences can have less specific messages. Check the applicable policy evidence and the actual action rather than using the color or wording as the only acceptance criterion.
The Copilot audit schema documents interaction and resource metadata, including policy details where applicable. Do not rely on an invented universal DlpBlocked event with identical fields for every Copilot experience.
A blocked interaction is not a guarantee that no record exists. Investigation, audit and content-retention systems have distinct purposes. Keep existing retention and incident-handling rules in force rather than promising that a block erases history or evidence.
Investigate Unexpected Matches Before Changing Detection
For a missed block, first check whether the tested activity matches the rule’s action and supported scope. Then inspect the selected label or detector, user scope, policy mode, rollout availability and the source actually used. Do not broaden access or disable another security control to repair a DLP test.
For a false positive, examine the matching pattern and supporting evidence. Microsoft’s sensitive-information-type guidance explains that lower confidence generally includes more matches and can increase false positives. The earlier recommendation to lower confidence to reduce false positives was incorrect.
Any adjustment should be reviewed against both false-positive and missed-detection test cases. Keep a record of the approved change and residual gaps; one successful block does not prove universal protection of all Copilot output.