--- title: "Stop Copilot Summarizing Confidential Files with Purview DLP" description: "Build a Purview DLP policy that stops Microsoft 365 Copilot processing labeled files, then probe the citations and prompt uploads that still leak." canonical: "https://adamtheautomator.com/exclude-confidential-files-copilot-dlp/" --- # Stop Copilot Summarizing Confidential Files with Purview DLP > Build a Purview DLP policy that stops Microsoft 365 Copilot processing labeled files, then probe the citations and prompt uploads that still leak. Source: https://adamtheautomator.com/exclude-confidential-files-copilot-dlp/ --- ATA Learning Tap to hide [ ATA Learning ](/) * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Search for: * [](https://twitter.com/adbertram) * [](https://github.com/Adam-the-Automator) * [](https://www.linkedin.com/company/adam-the-automator-llc) * [](/feed/) ![Stop Copilot Summarizing Confidential Files with Purview DLP](https://adamtheautomator.com/wp-content/uploads/publisher/3f35d9c85b2b8179a90ac78068758b8e/a73d28e0d4b237b4d869f4d1e51a24f3720c1bc819ff3ef01894ea81641429d2.jpg) # Stop Copilot Summarizing Confidential Files with Purview DLP [![](https://secure.gravatar.com/avatar/d0b9d42e21e5622713f8b693aa5c0f9244d5f7dd200ed29b8398f52dee5de337?s=192&d=mm&r=g)Adam Bertram](https://adamtheautomator.com/author/adam-bertram/)19 October 202611 min. read Categories: [Information Security](/category/infosec/) Tags:[Microsoft 365 Copilot](/tag/microsoft-365-copilot/)[Microsoft 365](/tag/microsoft-365/)[Security](/tag/security/)[SharePoint](/tag/sharepoint/) Table of Contents * [What Exclusion Actually Covers](#what-exclusion-actually-covers) * [Pick the Control Before You Pick the Policy](#pick-the-control-before-you-pick-the-policy) * [The Two Encryption Options](#the-two-encryption-options) * [The Label Setting That Stops It in Office Apps](#the-label-setting-that-stops-it-in-office-apps) * [Prerequisites: Labels, Licenses, and One Working Role](#prerequisites-labels-licenses-and-one-working-role) * [Build the DLP Policy on the Copilot Location](#build-the-dlp-policy-on-the-copilot-location) * [What the Portal Does to Your Other Policies](#what-the-portal-does-to-your-other-policies) * [Deny-List or Allow-List: Pick One and Write the Catch-All](#deny-list-or-allow-list-pick-one-and-write-the-catch-all) * [Why the Unlabeled Catch-All Cannot Be a Rule](#why-the-unlabeled-catch-all-cannot-be-a-rule) * [Run the Lab: Baseline, Simulate, Enforce](#run-the-lab-baseline-simulate-enforce) * [Test Matrix: Where the Block Fires and Where It Does Not](#test-matrix-where-the-block-fires-and-where-it-does-not) * [What Still Leaks: Citations, Titles, and Prompt Uploads](#what-still-leaks-citations-titles-and-prompt-uploads) * [The Upload Bypass](#the-upload-bypass) * [Verify Enforcement with PowerShell, Simulation, and Audit](#verify-enforcement-with-powershell-simulation-and-audit) * [Propagation, Admin Units, and Other Boundaries](#propagation-admin-units-and-other-boundaries) * [Roll Out Without a Helpdesk Flood](#roll-out-without-a-helpdesk-flood) * [What to Prove Before You Call It Done](#what-to-prove-before-you-call-it-done) Before you tell Legal that Copilot cannot read your Highly Confidential library, open one of those files and check two things: the usage rights the label grants, and whether a DLP rule targets the Copilot location. Neither appears in the label’s name, and that gap is where a rollout fails: the label reads Highly Confidential while no rule on the Copilot location reads the label. This tutorial builds that control and then tries to break it. You will create a DLP policy on the Microsoft 365 Copilot and Copilot Chat location, capture a baseline answer before the policy exists, and compare the same prompt after enforcement. Then you will probe three places the block does not reach: citations, files dragged into a prompt, and surfaces where enforcement differs. ## What Exclusion Actually Covers Copilot grounds answers in Microsoft Graph and the semantic index as the person who typed the prompt. Microsoft’s [Copilot data protection and auditing guidance](https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-architecture-data-protection-auditing) puts access first and policy second. A [Purview DLP rule](https://learn.microsoft.com/en-us/purview/dlp-learn-about-dlp) grants no permission a user did not already have, and removes none. Picture the file that starts an incident. An analyst can read a SharePoint library because a project group was added three years ago, and it holds board packs labeled Highly Confidential. The analyst asks Copilot about the latest quarter and gets a summary, because every other control says the analyst may read those files. The Copilot DLP location answers a different question: should the model process that content? An exclusion rule limits what Copilot feeds into a response, then leaves the file in place and in the user’s hands. ## Pick the Control Before You Pick the Policy Four controls get used for this job, and they fail in different ways. The decision path below follows each option from the question that picks it to the side effect a user notices afterward. Choose per label, then write the rule. | Control | What Copilot loses | What users lose | Reach for it when | | --- | --- | --- | --- | | Label with encryption, no EXTRACT right | Content processing: the service cannot extract text | Copy rights, wherever the file goes | A few files must never be machine-read | | [Double Key Encryption](https://learn.microsoft.com/en-us/purview/double-key-encryption) | Content processing: Microsoft cannot open the file without your key | A key service you operate | Rules forbid one vendor holding the key | | DLP rule on the Copilot location | Content processing in Copilot surfaces only | Nothing outside Copilot | Labels you cannot enumerate | | BlockContentAnalysisServices label setting | Copilot in Word, Excel, PowerPoint, and Outlook, not Teams or Copilot Chat | Text prediction, recommended labeling, DLP policy tips | An app-level kill switch on one label | ![Copilot exclusion path](https://adamtheautomator.com/wp-content/uploads/publisher/97a1215a44fac0598b31f90f40b7d2c121f53d3b4e3a01dfd619503eb143821d.jpg) ### The Two Encryption Options Encrypted items need the `EXTRACT` and `VIEW` usage rights before Copilot can work with the content, including items encrypted by [Azure Rights Management](https://learn.microsoft.com/en-us/purview/rights-management-usage-rights) without a label. A label that encrypts without granting `EXTRACT` blocks summarization everywhere, including surfaces a DLP rule never touches. Double Key Encryption goes further: one key stays in a DKE service you operate and the second sits in Microsoft Azure, so Microsoft cannot decrypt the content alone. ### The Label Setting That Stops It in Office Apps `BlockContentAnalysisServices` is an advanced label property, applied with `Set-Label` and read back from the label’s `Settings` collection: ```powershell Connect-IPPSSession (Get-Label -Identity "Highly Confidential").Settings | Where-Object { $_ -match "blockcontentanalysisservices" } ``` A non-empty result confirms the setting is present in the label’s `Settings` collection. Microsoft describes it as a privacy control: content in Word, Excel, PowerPoint, and Outlook stops being sent to Microsoft for content analysis, so DLP policy tips, automatic and recommended labeling, text prediction, and Copilot stop working as designed in those apps. Microsoft states the limit on that block directly: “Although content with the configured sensitivity label will be excluded from Microsoft 365 Copilot in the named Office apps, the content remains available to Microsoft 365 Copilot for other scenarios. For example, in Teams, and in Microsoft 365 Copilot Chat.” Practical 365, testing the setting from the client side, reports the same split: Copilot Chat cited a document carrying the blocking label while it could not extract or summarize the content. * * * _**Warning: _**`BlockContentAnalysisServices`**_ is a switch for a whole label, not a policy you can scope to a group or site. Test it on a new label before you touch a production one.**_ * * * ## Prerequisites: Labels, Licenses, and One Working Role If you want to follow along hands-on, you’ll need: * **The premium licensing row.** Blocking labeled files and emails is listed for Microsoft 365 E5/A5, Office 365 E5/A5, the Purview Suite (including Microsoft Defender + Purview Suite FLW), and the E5/A5/F5 Information Protection and Governance add-on in the [Purview service description](https://learn.microsoft.com/en-us/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-purview-service-description). An E3 tenant with Copilot and no add-on cannot run this rule. * **A Copilot license that grounds on tenant content.** [Microsoft Copilot licensing](https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-licensing) separates the paid license from the web Copilot Chat in an eligible subscription, which does not read your tenant. * **Published labels on real files.** The rule matches labels, so an unlabeled library gives it nothing. [Sensitivity labels in Office apps](https://learn.microsoft.com/en-us/purview/sensitivity-labels-office-apps) covers publication. * **Purview Data Security AI Admin**, the least-privileged role for this policy, which deliberately cannot read prompts and responses. * **A test user who can open both lab files**, plus `EXTRACT` and `VIEW` if the blocked file is encrypted. * **A non-production SharePoint site**, because you will prove the control fails in places. * **Security & Compliance PowerShell.** `Connect-IPPSSession` opens the session through the [ExchangeOnlineManagement module](https://learn.microsoft.com/en-us/powershell/exchange/exchange-online-powershell-v2?view=exchange-ps); run `Install-Module -Name ExchangeOnlineManagement` before the first block. * **A documentation revision you can check.** Every Microsoft-documented behavior quoted here was read from the linked Microsoft Learn pages on October 18, 2026, and where a behavior comes from a named practitioner’s testing, the post names that source. The portal steps follow those pages, so a screen that has moved since then is the page’s update rather than a step you missed. ## Build the DLP Policy on the Copilot Location The policy is short. The gotchas sit in what the portal does to the rest of your configuration. The steps below build the deny-list shape; the next section covers when an allow-list beats it and what neither shape catches. 1. Sign in to the Microsoft Purview portal as the Data Security AI Admin. 2. Go to **Data Loss Prevention** > **Policies** > **Create policy**. 3. Choose the **Custom** template, then **Custom policy**. 4. On **Locations**, turn on **Microsoft 365 Copilot and Copilot Chat**. 5. Add a rule with **Content contains** > **Sensitivity labels**, and pick **Highly Confidential**. 6. Set the action to **Prevent Copilot from processing content**. 7. Turn on **Policy Tips** with a full `https://` URL, so **Learn about access restrictions** points at your help desk. 8. Save with simulation mode on. The portal path above is the manual build. Microsoft documents the same policy in PowerShell in Example 4 of the [New-DlpCompliancePolicy](https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/new-dlpcompliancepolicy?view=exchange-ps) reference, which is the version to reach for when a second tenant needs the identical rule: ```powershell Connect-IPPSSession $labelGuid = (Get-Label -Identity "Highly Confidential").Guid $loc = '[{"Workload":"Applications","Location":"470f2276-e011-4e9d-a6ec-20768be3a4b0","Inclusions":[{"Type":"Tenant","Identity":"All"}]}]' New-DlpCompliancePolicy -Name "Copilot - Block Highly Confidential" ` -Locations $loc -EnforcementPlanes @("CopilotExperiences") ` -Mode TestWithNotifications $advRule = @{ Version = "1.0" Condition = @{ Operator = "And" SubConditions = @( @{ ConditionName = "ContentContainsSensitiveInformation" Value = @( @{ groups = @( @{ Operator = "Or" name = "Default" labels = @(@{ name = $labelGuid; type = "Sensitivity" }) } ) } ) } ) } } | ConvertTo-Json -Depth 100 New-DlpComplianceRule -Name "Block Highly Confidential in Copilot" ` -Policy "Copilot - Block Highly Confidential" ` -AdvancedRule $advRule ` -RestrictAccess @(@{setting="ExcludeContentProcessing";value="Block"}) Get-DlpCompliancePolicy -Identity "Copilot - Block Highly Confidential" | Format-List Name, Mode, Locations ``` Three values carry the behavior: `470f2276-e011-4e9d-a6ec-20768be3a4b0` is the documented Copilot location, `CopilotExperiences` keeps the policy off the other workloads, and `ExcludeContentProcessing` is the block action. The rule matches the label by GUID, which is why the first line reads it. `Get-Label -Identity` matches on the name, and Microsoft documents that a name that does not exist returns every label, so confirm `$labelGuid` holds one GUID before the rule call runs. `Mode` lands on `TestWithNotifications` so the scripted policy starts in simulation, the same state step 8 leaves the portal version in. ### What the Portal Does to Your Other Policies Selecting the Copilot location disables every other location in that policy, so an existing Exchange or SharePoint policy cannot simply gain a Copilot rule. The rule also cannot carry a sensitive information type (SIT) condition alongside the label condition. The [DLP for Microsoft 365 Copilot page](https://learn.microsoft.com/en-us/purview/dlp-microsoft365-copilot-location-learn-about) states: “You can’t use both content contains sensitive info types and content contains sensitivity labels conditions in the same rule.” Separate rules in one policy are the supported shape. ## Deny-List or Allow-List: Pick One and Write the Catch-All A deny-list names the labels Copilot must not process. It takes ten minutes, is easy to explain to Legal, and has one large hole: anything without a matching label still gets summarized. An allow-list inverts the logic. One rule permits an approved label and a second blocks the rest of the taxonomy, a pattern Microsoft’s Q&A answer on [restricting file processing to labeled files](https://learn.microsoft.com/en-us/answers/questions/5905896/restricting-file-processing-in-microsoft-365-copil) sketches. You get a stronger default, and a different failure: a file with no label is covered by no label condition at all. ### Why the Unlabeled Catch-All Cannot Be a Rule A label condition matches labels, and unlabeled content matches nothing, so no rule here sweeps it up. The catch-all comes from the labeling side: a default label on document libraries so new files arrive labeled, plus auto-labeling to reach the backlog. Container labels do not close the gap. Microsoft states that labels on containers “can restrict access to the container, but content in the container doesn’t inherit the label,” so a labeled site does not make the unlabeled file inside it match your rule. Because a label condition and a SIT condition cannot share a rule, an allow-list ends up with at least two rules, and a tenant that also blocks prompts ends up with three. ## Run the Lab: Baseline, Simulate, Enforce You need to see the same prompt answer, then fail to answer, with nothing else changed. 1. Create `copilot-lab-allowed.docx` labeled Internal and `copilot-lab-blocked.docx` labeled Highly Confidential in the test site. Put `ORCHID-BASELINE-ALLOWED` and `ORCHID-BASELINE-BLOCKED` in the bodies. 2. As the test user, ask Copilot: “Summarize what ORCHID-BASELINE-BLOCKED says.” Record the answer and the citation. This is your only proof that the policy changed anything. 3. Confirm the test user can open both files, and that the label grants `EXTRACT` and `VIEW` if the blocked file is encrypted. 4. With the policy in [simulation mode](https://learn.microsoft.com/en-us/purview/dlp-simulation-mode-learn), ask the same question once, then open the policy’s simulation view. The match appears there, not in the DLP alerts console. 5. Switch the policy to enforce. 6. Re-run the identical prompt and record which outcome you get: a policy message, a generic answer with no blocked content, or an answer that still contains the content. Step 6 matters. “Blocked” and “answered without the file” produce different screenshots, and only the first proves the block; the second is what a policy tip with an empty answer looks like. * * * _**Reality Check: A policy update can take up to four hours to reach the Copilot experience. Testing at minute five and declaring failure is a false negative the window itself produces.**_ * * * ## Test Matrix: Where the Block Fires and Where It Does Not Documented behavior is the starting point; your capture is the evidence. The Teams, OneNote, and Edge row is deliberately blank: published testing of earlier versions varied heavily by app, and the surfaces have changed since. [Sensitivity labels as a DLP condition](https://learn.microsoft.com/en-us/purview/dlp-sensitivity-label-as-condition) lists which item and file types the condition supports. | Surface | What the documentation says | What to record | | --- | --- | --- | | Copilot app and Copilot Chat, tenant grounding | Blocked items excluded; identified items still appear in citations | Whether the summary loses the content, and whether the citation survives | | Copilot in Word, Excel, PowerPoint | Evaluated at file open; app skills disabled; a mid-session label takes effect at the next open | Whether the Copilot pane refuses to work | | Copilot in Outlook | Covers emails sent on or after January 1, 2025 | Whether an older message is still summarized | | Copilot in Teams, OneNote, Edge | Not separately documented on the page reviewed here | Which surface leaks, with a screenshot | | File uploaded into the prompt | Not scanned; only typed prompt text is evaluated | Whether the attachment is summarized anyway | | Calendar invite | Not supported by this control | Whether invite content reaches an answer | | Prompt with a synthetic SSN, SIT rule enforced | No response, no Graph grounding, no web search | The exact message text | ## What Still Leaks: Citations, Titles, and Prompt Uploads The citation finding changes how you brief Legal. Microsoft’s text reads: “Identified items still appear in the citations of the response, but Copilot and Cowork don’t access or use the content of the item in the response.” The body is protected. The file name is not. ![Blocked answer, live citation](https://adamtheautomator.com/wp-content/uploads/publisher/dc2040eb5bf5b320286fea36e1f7a830fc3268bc7e78cb92be75b37018f8dbdc.jpg) Ask Copilot a question that matches only the blocked document’s title. A citation to that file is a legitimate outcome, and a file called `Project_Onyx_Layoffs_Q4.docx` leaks its subject in the title alone. If titles are sensitive, label-based blocking will not help, because metadata stays indexed for search and eDiscovery. The site-level control is [Restricted Content Discovery](https://learn.microsoft.com/en-us/sharepoint/restricted-content-discovery), which limits discovery of a site’s content in organization-wide search and Copilot. It leaves permissions intact, is an interim control, and needs Copilot licensing plus [SharePoint Advanced Management](https://learn.microsoft.com/en-us/sharepoint/advanced-management). ### The Upload Bypass Microsoft states: “DLP can’t scan the contents of files that you upload directly into prompts, so evaluation of the uploaded file for sensitive data doesn’t occur. DLP only checks the text you type into the prompt itself.” Attach the blocked file to a Copilot Chat prompt and the label does nothing. The user already had read access, so nothing was escalated, but the exclusion policy never sees the attachment. * * * _**Key Insight: A citation proves the file exists, not that Copilot read it. The label stops the model from opening the body; the index still hands it the title.**_ * * * ## Verify Enforcement with PowerShell, Simulation, and Audit Start with what the policy contains, because the portal view and the exported object can disagree: ```powershell Connect-IPPSSession Get-DlpCompliancePolicy -Identity "Copilot - Block Highly Confidential" -IncludeRulesMetadata $true | Format-List Name, Mode, Locations, EnforcementPlanes, Rules ``` `Mode` shows whether the policy is still simulating. `Locations` and `EnforcementPlanes` are the two values that separate this policy from a SharePoint policy with the same name. Do not reach for [`Test-DlpPolicies`](https://learn.microsoft.com/en-us/purview/dlp-test-dlp-policies) here. Microsoft documents that cmdlet as reporting matches for policies scoped to SharePoint and OneDrive only, so a clean result proves nothing about a Copilot-location rule. Simulation results, DLP alerts, and Activity Explorer answer the question. For a record of what users did, query the unified audit log: ```powershell Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-2) -EndDate (Get-Date) ` -UserIds lab.user@contoso.com -ResultSize 200 | Select-Object CreationDate, RecordType, Operations | Sort-Object CreationDate -Descending | Select-Object -First 20 ``` Read the `Operations` values rather than assuming a name, then correlate timestamps with your prompts. Microsoft recommends the Management Activity API over `Search-UnifiedAuditLog` for automated collection, which matters once this becomes a standing report. Prompt-level blocks surface as DLP alerts in Purview and Defender XDR; Activity Explorer confirms a rule fired without reading anyone’s prompt text. ## Propagation, Admin Units, and Other Boundaries Write these into the runbook before the pilot; each produces a ticket that looks like a bug. | Boundary | Documented behavior | | --- | --- | | Policy updates | Up to four hours to reach Copilot and Copilot Chat | | Email | Covered from January 1, 2025 onward | | Admin units | Not supported, so the policy cannot be scoped to a department | | Container labels | Do not flow down to files inside the site | The admin-unit gap reshapes plans: a subsidiary that assumed a delegated admin could own its policy has to run centrally, which is why Microsoft’s [governed foundation guidance](https://learn.microsoft.com/en-us/microsoft-365/copilot/configure-secure-governed-data-foundation-microsoft-365-copilot) starts with oversharing remediation. ## Roll Out Without a Helpdesk Flood The block is visible, so the message is part of the control. Use the policy tip compliance URL from step 7. It changes only the destination of the **Learn about access restrictions** link, and it decides whether a user files a ticket or reads your page. The [Purview capability list for AI apps](https://learn.microsoft.com/en-us/purview/ai-microsoft-purview) covers what each control does. Give the help desk three branches. Missing content in an answer: check whether the label is in the block rule, and whether it was applied after the file opened. A refused prompt: that is the SIT rule, and the fix is removing the identifier. A citation to a file with no readable content: explain that the citation is expected, then route the title-exposure problem to the Restricted Content Discovery owner. Send comms before enforcement: the labels going out of scope, the date, the exact message users will see, and the path for an exception. ## What to Prove Before You Call It Done Keep four artifacts: the baseline prompt and answer, the same prompt after enforcement, the upload result, and the audit query output. Together they answer the only question an auditor will ask: did the control do anything? Microsoft’s [Purview controls for AI interactions](https://learn.microsoft.com/en-us/purview/ai-m365-copilot) shows what else you can monitor. Then say the limits out loud in the same document. Copilot will still cite a blocked file by name, still summarize it when a user attaches it to a prompt, and still process anything your labeling program missed. Label-based DLP narrows the content Copilot reasons over, which is a real reduction in exposure. Treating it as a boundary around the file itself is how a working control turns into a false assurance. Share this article [Share on X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fadamtheautomator.com%2Fexclude-confidential-files-copilot-dlp%2F&text=Stop%20Copilot%20Summarizing%20Confidential%20Files%20with%20Purview%20DLP)[Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fadamtheautomator.com%2Fexclude-confidential-files-copilot-dlp%2F)[Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fadamtheautomator.com%2Fexclude-confidential-files-copilot-dlp%2F) ## Related Posts ![](https://adamtheautomator.com/wp-content/uploads/publisher/3f35d9c85b2b811abe48f654e457f7e2/690ce33be28df06aba492262db9a7509c7621c624fe455abff00c8b5b3edb0b4.webp) ### [Stop Copilot Audit Gaps: Retain Chats with Purview](/retain-copilot-chats-purview-audit/) Retain Copilot prompts and responses for an audit. Scope a Purview policy to Microsoft Copilot experiences, then prove the chats in eDiscovery. ![](https://adamtheautomator.com/wp-content/uploads/publisher/3f35d9c85b2b81db9b78e52704dbd111/3650a0b7acbaf739069578f880254f978fe1383bc1b0453cd800afd989ff19ef.png) ### [Stop Copilot Web Searches from Leaking Sensitive Data](/stop-copilot-web-searches/) Block Microsoft 365 Copilot from sending sensitive prompt text to external web search with a Purview DLP rule, then prove the block in the audit log. ![](https://adamtheautomator.com/wp-content/uploads/publisher/3f35d9c85b2b812193d4cc7a6d4be13d/1daf00385836df44b470b450d81ec18105c2ccff55f54f2fd2f72592fca6e34c.png) ### [Stop Impersonation: Verify Identity at Onboarding](/identity-verification-onboarding/) Prevent impersonation by verifying identity during onboarding. Why identity proofing must happen before provisioning access to new hires. ## Categories * [IT Ops](/category/it-ops/) * [Cloud](/category/cloud/) * [DevOps](/category/devops/) * [Home Ops](/category/home-ops/) * [Information Security](/category/infosec/) * [Software Development](/category/software-development/) ## Site * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Copyright 2026© ATA Learning | [Privacy Policy](/privacy/)