Deploy Microsoft Purview DLP For Copilot Security

A Diagram Illustrating The Four Primary Ai Data Ingestion Paths—Type, Paste, Attach, And In-Document Use—And How They Map Across Two Protection Layers: Inside Microsoft 365 (Internal Ai) And Outside Microsoft 365 (External Web Ai).

Organisations adopting Microsoft 365 Copilot and generative AI are facing a common challenge. Data is no longer static. It is constantly moving, reused, and now being surfaced and generated by AI.

This changes the risk profile.

The questions I hear most often are:

What are the real data security risks with AI?
Which controls actually make a difference?
How do we deploy them effectively in Microsoft Purview?

This guide builds on my ECS 2026 session and focuses on the controls that provide the greatest practical value. It cuts through the noise and shows how to use Microsoft Purview DLP for Copilot and generative AI, with a practical approach to reducing real-world data leakage risk across both internal and external AI tools.

What is Microsoft Purview DLP for Copilot?

Microsoft Purview Data Loss Prevention (DLP) helps organisations identify, monitor, and protect sensitive data across Microsoft 365.

In the context of Copilot and generative AI, DLP provides controls to:

Prevent sensitive data from being entered into prompts
Restrict AI access to sensitive content
Block data from being shared with external AI services

The Shift: AI Is Outpacing Security

Data security has always been a moving target, but generative AI has fundamentally altered the speed at which data can move, surface, and be leaked.

According to Microsoft’s 2026 Data Security Index report AI adoption is accelerating faster than traditional data security controls can adapt. Enterprise data is no longer static; it continuously flows across endpoints, hybrid environments, collaboration platforms, and AI prompt boxes.

In practice, this creates three distinct challenges for security teams:

No single view of where sensitive data exists.
Inconsistent controls across fragmented platforms.
Limited visibility into how AI tools interact with corporate data.

The Real Risk with AI Data Security

Generative AI primarily amplifies existing data governance risks rather than creating entirely new ones. These include:

Oversharing caused by legacy, excessive permissions
Sensitive data leakage and insider risk
Uncontrolled external sharing
AI-generated outputs containing confidential information

What changes with AI is the scale and speed. Within seconds, sensitive information can be typed into prompts, pasted into external web tools, or automatically surfaced by internal AI systems.

The Four AI Data Paths (and How to Protect Them)

One of the simplest ways to understand AI data protection is to focus on how data enters AI systems. There are four primary paths that define most of your AI data exposure surface:

Type: Entering text directly into prompt boxes
Paste: Copying corporate data from documents and pasting it into AI tools.
Attach: Uploading files, spreadsheets, or images directly into an AI session.
In-document use: Utilising native AI features embedded directly within applications (e.g., Word, Excel, PowerPoint).

If you do not protect all four paths, critical security gaps will remain.

Mapping Your Defence: The Two Protection Layers

To effectively block data leakage across these four paths, your Microsoft Purview strategy must be deployed in two distinct, overlapping layers. Most organisations focus heavily on one layer while completely neglecting the other. Effective protection requires both.

Layer 1: Inside Microsoft 365 (Internal AI)

This layer governs what internal AI tools, specifically Microsoft 365 Copilot and Copilot chat, can interact with. Your controls must regulate what these services are allowed to:

Access within your tenant
Process during a user session
Generate in response to a prompt
Retrieve from organisational knowledge bases

Layer 2: Outside Microsoft 365 (External AI)

This layer governs what data your users can send to external, web-based generative AI platforms. Your controls must monitor and restrict interactions with external services such as:

ChatGPT
Gemini
Claude
DeepSeek
Other unmanaged web-based AI tools

By aligning the four ingestion paths with these two protection layers, you ensure comprehensive visibility and control over your entire corporate AI footprint.

The Hidden Risk: Oversharing

One of the biggest misconceptions around Microsoft 365 Copilot is that Copilot itself creates exposure.

In reality, Copilot respects existing Microsoft 365 permissions.

The real problem is that many environments already contain significant oversharing.

Common examples include:

Legacy SharePoint sites with excessive access
“Everyone except external users” permissions
Unused Microsoft Teams containing sensitive content
Poorly governed SharePoint permissions inheritance
Broad access groups accumulated over years

Before Copilot, much of this content remained effectively hidden because users had to manually search for it.

Copilot changes this dynamic completely.

AI dramatically reduces the effort required to discover, summarise, and reuse information across Microsoft 365.

This means overshared data becomes far easier to expose at scale.

In most environments I assess, this is one of the main causes of Microsoft 365 data oversharing and AI-related data leakage.

Why Classification Matters for AI Security

Before deploying DLP for AI, organisations need a reliable data classification foundation.

Without classification:

DLP policies become inconsistent
Sensitive data may be missed entirely
False positives increase
User frustration grows
Security teams lose confidence in enforcement

Sensitivity labels and Sensitive Information Types (SITs) are foundational to effective AI governance.

If your organisation cannot reliably identify sensitive data, your AI controls will not operate effectively.

Classification is not optional.

The Six Microsoft Purview DLP Controls That Matter Most for Copilot and Generative AI

Rather than deploying every available control, focus first on the capabilities that address the most common real-world leakage scenarios.

The six controls below provide a strong minimum viable protection model for AI.

Control 1: Block Sensitive Prompts in Copilot

This is the most important Copilot DLP control for preventing data leakage in prompts.

Licensing: Supported across Microsoft 365 Copilot DLP-supported licensing
Prerequisites: Sensitive Information Types configured

Purpose

Prevent users from entering sensitive information into Copilot prompts.

This is one of the most common AI data leakage paths.

Microsoft Purview Dlp Policy For Copilot Prompt ProtectionDlp Location: Microsoft 365 Copilot And Copilot Chat
Dlp Scope: All Users &Amp; Groups (You Can Start With A Pilot Group)

Microsoft Purview Dlp Policy For Copilot Prompt ProtectionDlp Condition: Contains One Or More Sits
Dlp Action: Restrict Copilot From Processing Content → Processing Prompts = Blocked

Configuration

Configure a DLP policy targeting:

Microsoft 365 Copilot
Copilot Chat

Use conditions such as:

Content contains one or more SITs

Configure the action:

Processing prompts = Block

Operational Considerations

Prompt processing and web grounding are separate controls and must be configured as separate rules.

This control is particularly effective for preventing exposure of:

Personally identifiable information (PII)
Financial data
Credentials
Regulated business data

Recommended Deployment Approach

Start in audit mode
Pilot with a limited user group
Tune SIT detection carefully
Review Activity Explorer data before broad enforcement
Communicate clearly with users to reduce confusion

Quick Start

Use the built-in Microsoft Purview recommendation:

“Safeguard sensitive data in Microsoft 365 Copilot interactions”

This provides one of the fastest ways to implement initial protection.

Start With The “Safeguard Sensitive Data In Microsoft 365 Copilot Interactions” One-Click Policy In Dlp → Recommendations To Deploy Prompt Protection In Minutes.