Official documentation checked October 14, 2026.
A prompt containing confidential information deserves investigation, but it is not by itself proof that an unauthorized person received the information. First establish which Copilot product and account were used, what data was submitted, and who could see or receive the result. This guide covers organizational Microsoft 365 Copilot and Copilot Chat, not a personal Microsoft Copilot account or every custom agent.
1. Define the suspected exposure
Record the user, app, work account, approximate time and time zone, conversation identifier if available, and the suspected source document. Separate four possible events: sensitive text entered in a prompt, a restricted document retrieved, an answer shared with another person, and information sent through a web search or external agent. They require different evidence and controls.
Microsoft states that organizational prompts, responses, and Microsoft Graph data are not used to train foundation models. That protection does not mean that every agent, external service, or subsequent sharing action has identical terms. Review the actual service path instead of treating all cloud processing as a confirmed leak. See Microsoft’s Copilot privacy documentation.
2. Use Audit to locate the interaction, not to extract a transcript
In Microsoft Purview Audit, an authorized investigator can search the relevant time range and users for CopilotInteraction activities. Review the application and available message/resource identifiers, then export the relevant records into an approved investigation location. Microsoft documents fields including AppHost, Messages, and AccessedResources; fields vary by interaction.
These records are not a universal store of full prompt and answer text. A script that reads an invented AuditData.Prompt property cannot recover missing content. A missing record also does not establish that no interaction occurred: check search scope, permissions, ingestion, and retention before reaching that conclusion. Follow the current Copilot audit schema.
3. Review conversation content through the appropriate investigation tools
Use an authorized Purview eDiscovery case to search the relevant user’s stored Copilot interaction data when the investigation requires the actual conversation. Copilot compliance data can be searched in the user’s Exchange mailbox; do not look for a normal Outlook folder or confuse Audit exports with eDiscovery results. Search narrowly by custodian, time, and known terms, following Microsoft’s Copilot eDiscovery guidance.
Where configured and licensed, Purview’s AI activity views can help identify sensitive interactions and display captured content to appropriately authorized reviewers. Their coverage depends on the app, collection configuration, and permissions. See Purview protections for AI apps. A sensitive-information match is an investigative lead, not proof of disclosure: validate the text, recipients, resource permissions, and any onward sharing.
4. Apply a control that covers the actual route
For supported Copilot interactions, use the dedicated Microsoft 365 Copilot and Copilot Chat location in a custom Purview DLP policy. Microsoft’s sensitive-information-type prompt controls are preview features with rollout requirements; verify availability in your tenant. Processing-prompt restrictions and web-search restrictions are different actions: blocking a web search does not necessarily block an answer using permitted internal information.
Prompt-text inspection does not mean that DLP scans the contents of every directly uploaded file. Sensitivity-label controls for supported files and emails have their own scope and limitations. Confirm policy mode: a simulation result is not an enforced block. Test with synthetic examples, never live secrets. Use the current Copilot DLP documentation to select the condition and action.
5. Preserve evidence and verify containment
Have the security owner establish the affected audience and the specific exposure path. Correct inappropriate source sharing or agent access through its owner; if a credential was disclosed, use the organization’s credential-rotation process. Restrict investigation exports to authorized reviewers and avoid pasting raw evidence into another chatbot.
Do not delete chats, purge compliance copies, or remove legal holds to make an incident disappear. Record the approved change and retest both an authorized user and a user who must be denied. Close the investigation only when the evidence supports its conclusion, distinguishing confirmed disclosure, potential exposure, and an unsubstantiated alert.