What the control actually does
A DLP policy scoped to the Microsoft 365 Copilot location matches on sensitivity labels and tells Copilot: content bearing THIS label may not be used to ground or summarise responses. The user can still open the file (this is not access control); Copilot just behaves as if it can't read it — the grounding stage (foundations FLOW) filters it out.
Why this is the durable control in the kit: it follows the CONTENT. Restricted Content Discovery excludes SITES; this excludes labeled items wherever they travel — copied, moved, attached. Label well once and the protection is location-independent.
The dependency chain (where deployments stall)
DLP-for-Copilot is exactly as good as your labeling:
- Label taxonomy exists and means something (not eleven labels nobody picks)
- The crown jewels actually CARRY labels — auto-labeling for patterns (credentials, financials) + default labels on sensitive libraries close the coverage gap manual labeling never will
- THEN the Copilot-location policy turns labels into grounding exclusions
Estates that skip to step 3 protect their three hand-labeled files and call it governance.
Honest limits (state these in the design doc)
| Limit | Consequence |
|---|---|
| Label-based matching for this location | Unlabeled sensitive content is untouched — steps 1-2 are the real work |
| Grounding-time control | Not access control: the browser still opens the file (permissions model owns that) |
| The user can still TYPE secrets into a prompt | That's interaction-side: communication compliance + training, not this policy |
| Encrypted content interplay | EXTRACT usage rights already gate Copilot (permissions concept) — decide which mechanism is primary per label to avoid double-explaining behaviour |
What to watch (proofs)
- The policy in force: Purview DLP > policies for the Copilot location — which labels, which mode; export with dates for the governance pack.
- The behaviour proof: labeled test doc + a prompt that would surface it — before-policy answer vs after-policy silence, screenshots paired.
- Coverage honesty: % of red-list content labeled (auto-labeling match reports) — the number that says whether this control is real or ceremonial.
- Simulation first: run the policy in simulation mode and read WHAT would have been excluded — over-broad labels excluding the whole intranet is the classic first-draft finding.