Restrict Copilot Pages Sharing With Labels and Access Controls

Official documentation checked October 14, 2026.

A sensitivity label can classify and protect a Copilot Page, but the label name alone does not make the page internal-only. Restricting sharing requires the right page permissions, supported label protection and the organization’s external-sharing controls. Check all three before putting confidential material into a shared page.

This guide covers work or school Copilot Pages. It does not treat a Copilot Notebook, a Loop workspace and an individual Page as interchangeable security boundaries.

Understand the Page, Label, and Sharing Boundary

Copilot Pages normally use a user-owned SharePoint Embedded container shared with Copilot Notebooks and Loop My workspace. Microsoft’s permissions overview distinguishes page sharing from sharing a whole notebook. A Page can be shared for viewing or editing with specific people or through an organization link, subject to policy.

A file-level sensitivity label is a separate control. A classification-only label communicates sensitivity; encryption, when configured and supported, limits what authorized people can do. Do not assume that a label called “Internal” contains the necessary access restrictions. Your information-protection administrator must check its actual configuration.

Container labels for tenant-owned Loop workspaces govern workspace access. They are not a substitute for labeling a Page. Microsoft’s Copilot Pages and Notebooks capability summary also distinguishes Page sensitivity labels from Notebooks, which do not have their own container sensitivity labels.

Prepare a Label That Copilot Pages Actually Supports

Ask the information-protection administrator to verify the relevant license, label publication and SharePoint/OneDrive labeling prerequisites. Microsoft’s Loop labeling requirements cover Copilot Pages as well as components.

• Use a published label with the appropriate file/data-asset scope. For encryption, Loop supports administrator-assigned permissions configured in advance.
• Do not select a label relying on user-defined permissions, expiring access or Double Key Encryption: those configurations are not supported for Loop pages/components.
• Default and mandatory labeling are supported. A requirement to justify lowering/removing a label is an accountability control, not an unconditional prohibition on every downgrade.
• Do not plan on automatic or recommended labeling to classify every Page; those capabilities are not supported for Loop pages/components. A supported inheritance scenario is distinct from general content-based auto-labeling.

Use a harmless pilot Page to test the proposed configuration before applying it to business material. If the required protection is unsupported, keep the material in an approved system instead of weakening the label.

Apply the Label and Share With the Intended People

1. Open the Page and inspect its label. Microsoft documents the shield icon at the top of a Page for viewing or changing the label, subject to permissions and policy. Select the organization-approved label; do not invent a substitute when the required label is missing. See Microsoft’s Page labeling and storage notes.
2. Choose the smallest appropriate audience. Open the Page’s Share options and inspect the link settings. For a defined project team, use a people-specific link if available, and view access when editing is unnecessary.
3. Check pre-existing access. Creating a narrow new link does not itself prove that older links or other grants are gone. Have the owner or administrator review existing access using the available sharing controls.
4. Test as a recipient. An owner opening their own page is not an access-control test. Verify one intended reader, one intended editor if applicable, and an approved test identity outside the intended audience.

Block Guest Sharing at the Correct Administrative Layer

Do not rely on the fact that an external guest cannot open a direct Copilot Page link. The current permissions documentation describes another supported access path through a Loop workspace when cross-tenant guest access is configured.

For an organization that prohibits guest sharing, the SharePoint Embedded administrator should review the tenant and application-level sharing configuration. Microsoft’s Pages permissions guide identifies an application external-sharing override for the shared Pages/Notebooks container type. It is an application-wide control, not a checkbox on one sensitivity label. Assess the impact on existing collaboration before changing it.

The SharePoint Embedded administration guide describes the dedicated administrator role and management surfaces. Do not grant Global Administrator merely to inspect a Page’s audience. Review linked or uploaded source documents separately; access to a Page and access to each referenced file need their own checks.

Verify Protection After Editing, Reuse, and Sharing Changes

Keep a short record of the tested label, audience, external-sharing setting and results. Recheck after a label-policy change, a Page move or a change to its audience. A successful restricted test on one Page is not proof that every Page in the organization is configured identically.

Sharing a Page link normally points collaborators to the same underlying file. Copying text into a different document, exporting content or creating a new artifact is a different operation: verify the destination’s label and permissions before sharing it. Do not promise that every copy, screenshot or export inherits the original restriction.

If an unexpected person still has access, investigate all permission paths instead of repeatedly recreating links. SharePoint Embedded distinguishes inherited container membership from additional item permissions; removing one added grant does not cancel another access path. See Microsoft’s sharing and permissions model. Report confirmed unintended access through the organization’s security process.