Microsoft Purview DLP Now Controls Copilot’s Access to Sensitive Email Data

Microsoft is set to enhance data security in Microsoft 365 by extending Purview Data Loss Prevention (DLP) controls to Copilot’s handling of sensitive email data.

Starting January 1, 2025, Microsoft 365 Copilot will be prevented from processing emails that carry sensitivity labels, marking a significant step forward in enterprise data protection.

New Protections for Sensitive Emails

Microsoft Purview DLP has long enabled organizations to monitor and protect sensitive information across Microsoft 365 services.

With this update, DLP policies can now detect sensitivity labels in emails and restrict Copilot from using these emails as grounding data in chat experiences.

This means that if an email is labeled as “Highly Confidential,” “Confidential,” or similar, Copilot will not process its content when responding to user prompts.

The feature applies only to emails sent on or after January 1, 2025, ensuring that newly labeled sensitive data receives the highest level of protection.

While the content of these emails will be excluded from Copilot’s summaries, citations referencing the emails may still appear, but without exposing the sensitive content itself.

The public preview for this new DLP capability begins in early June 2025, with general availability expected by late August 2025.

Microsoft has confirmed that no administrative action is required before the rollout; the feature will be enabled automatically according to the published schedule.

Organizations that already have DLP policies configured for Copilot will see these protections extended to cover sensitive emails without any additional setup.

For those without existing policies, the change will not impact current operations unless new policies are created.

Admins can manage these protections through the Microsoft Purview portal, where they can create or adjust DLP policies using the dedicated Copilot policy location.

The process involves specifying conditions such as “Content contains > Sensitivity labels” to exclude emails with designated labels from Copilot processing.

Additionally, the Data Security Posture Management for AI (DSPM for AI) tool offers recommendations for creating and optimizing Copilot-related DLP policies.

This ensures that organizations can tailor protections to their specific compliance and confidentiality needs.

Notably, organizations do not need a separate Microsoft 365 Copilot license to access this DLP feature.

The protections are available by default to customers with the appropriate Purview and DLP entitlements, broadening access to robust data governance tools.

While no immediate action is required, Microsoft advises organizations to review their current DLP configurations and notify relevant stakeholders about the upcoming changes.

If DLP policies for Copilot are already in place, they will automatically extend to cover sensitive emails. Organizations may also wish to update internal documentation and provide guidance to users and admins on the new protections.

This update underscores Microsoft’s commitment to enterprise data security, ensuring that AI-powered productivity tools like Copilot operate within strict compliance boundaries and protect sensitive information by design.

Find this News Interesting! Follow us on Google News, LinkedIn, and X to Get Instant Updates