--- title: "Stop Copilot Web Searches from Leaking Sensitive Data" description: "Block Microsoft 365 Copilot from sending sensitive prompt text to external web search with a Purview DLP rule, then prove the block in the audit log." canonical: "https://adamtheautomator.com/stop-copilot-web-searches/" --- # Stop Copilot Web Searches from Leaking Sensitive Data > Block Microsoft 365 Copilot from sending sensitive prompt text to external web search with a Purview DLP rule, then prove the block in the audit log. Source: https://adamtheautomator.com/stop-copilot-web-searches/ --- ATA Learning Tap to hide [ ATA Learning ](/) * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Search for: * [](https://twitter.com/adbertram) * [](https://github.com/Adam-the-Automator) * [](https://www.linkedin.com/company/adam-the-automator-llc) * [](/feed/) ![Stop Copilot Web Searches from Leaking Sensitive Data](https://adamtheautomator.com/wp-content/uploads/publisher/3f35d9c85b2b81db9b78e52704dbd111/3650a0b7acbaf739069578f880254f978fe1383bc1b0453cd800afd989ff19ef.png) # Stop Copilot Web Searches from Leaking Sensitive Data [![](https://secure.gravatar.com/avatar/d0b9d42e21e5622713f8b693aa5c0f9244d5f7dd200ed29b8398f52dee5de337?s=192&d=mm&r=g)Adam Bertram](https://adamtheautomator.com/author/adam-bertram/)12 October 20265 min. read Categories: [Information Security](/category/infosec/) Tags:[Microsoft 365 Copilot](/tag/microsoft-365-copilot/)[Microsoft 365](/tag/microsoft-365/)[Security](/tag/security/) Table of Contents * [Where a Copilot Prompt Actually Goes](#where-a-copilot-prompt-actually-goes) * [What the Performing Web Searches Control Changes](#what-the-performing-web-searches-control-changes) * [Web-Search Block or Prompt Block?](#web-search-block-or-prompt-block) * [Three Controls That Look Alike and Are Not](#three-controls-that-look-alike-and-are-not) * [Build It, Then Test It with a Control Prompt](#build-it-then-test-it-with-a-control-prompt) * [Create the Rule](#create-the-rule) * [Run a Matching Prompt and a Control Prompt](#run-a-matching-prompt-and-a-control-prompt) * [Prove It Fired, and Know What It Doesn’t Cover](#prove-it-fired-and-know-what-it-doesnt-cover) * [What the Control Will Not Do](#what-the-control-will-not-do) Do not point Microsoft 365 Copilot at a prompt stuffed with a customer’s credit card numbers and assume the answer stays inside your tenant. [Microsoft 365 Copilot](https://learn.microsoft.com/en-us/purview/ai-m365-copilot) grounds its responses in two places: your own [Microsoft Graph](https://learn.microsoft.com/en-us/graph/overview) content, and an external web search it reaches for when a question needs fresher facts. The second path crosses your tenant boundary, and it is the one you can disable for a single prompt. [Microsoft Purview data loss prevention (DLP) policies](https://learn.microsoft.com/en-us/purview/dlp-overview-plan-for-dlp) for Copilot include a control that blocks just the web search when a prompt matches a [sensitive information type (SIT)](https://adamtheautomator.com/microsoft-purview-dlp-policies/). The prompt still gets an answer, drawn from internal content the user is already permitted to read. That is a narrower promise than it sounds, and the gap between “blocked the web search” and “blocked the prompt” is where a rollout enforces the wrong behavior. ## Where a Copilot Prompt Actually Goes Every Copilot prompt runs inside the security context of the person who typed it. If they can open a document, Copilot can summarize it; if they can’t, Copilot can’t reach it. That containment holds until the prompt leaves for the web. Web grounding is where the prompt leaves your tenant. Copilot formulates a search query from the prompt and hands it to an external search service. Microsoft’s reference on [how Copilot handles web search and generated queries](https://learn.microsoft.com/en-us/microsoft-365/copilot/manage-public-web-access) follows that query once it heads for Bing, which sits outside the privacy terms covering your tenant content. The 2026 SearchLeak chain shows how little that exit costs an attacker. Varonis Threat Labs documented [a three-stage Copilot exfiltration attack](https://www.varonis.com/blog/searchleak) that opened with a URL parameter Copilot’s engine treated as an executable instruction. Microsoft tracked the flaw as [CVE-2026-42824](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42824), an information-disclosure issue it rated critical, and the [National Vulnerability Database (NVD) scores it 7.5](https://nvd.nist.gov/vuln/detail/CVE-2026-42824). The attacker needed no plugin and no administrator permission. A purpose-built control exists for this exit, and it behaves unlike the two controls most admins reach for first. ## What the Performing Web Searches Control Changes The **Performing Web Searches** action inside Purview DLP is that control. You attach it to the Microsoft 365 Copilot and Copilot Chat policy location, pair it with a _content contains sensitive information types_ condition, and Purview evaluates each prompt in real time. Microsoft Learn names the outcome precisely. The [DLP for Microsoft 365 Copilot and Cowork](https://learn.microsoft.com/en-us/purview/dlp-microsoft365-copilot-location-learn-about) page states: “This prevents prompt text that matches the configured SITs from being sent to external search providers for that request.” Two consequences follow from that sentence. The block applies per prompt, so an ordinary question with no sensitive match keeps full web grounding. And the prompt is not discarded: Copilot pivots to internal grounding and answers from Microsoft Graph content the user can already open. ### Web-Search Block or Prompt Block? A sibling action, **Processing prompts**, stops the request outright. When a prompt trips its condition, Copilot returns a message that your organization blocked the request, and the sensitive text feeds neither an internal nor an external search. The web-search action gives up only the external lookup; the prompt-block action gives up the answer too. If you want to keep the internal answer alive, the web-search block is the one you reach for. ![Copilot grounding paths](https://adamtheautomator.com/wp-content/uploads/publisher/b32273fc9c9e6e7b89c8b17ef1e414595d1faade0cea3ae6547d0205168a719f.png) ## Three Controls That Look Alike and Are Not [Microsoft Purview](https://adamtheautomator.com/stop-shadow-ai-microsoft-purview/) ships three controls that decide how much Copilot may do with sensitive material, and admins routinely send a rule to the wrong one. The table below maps what each one actually stops. | Control | What it stops | Prompt still answered internally? | | --- | --- | --- | | Prevent processing content, then Performing Web Searches | Sending matching prompt text to the external search provider | Yes | | Prevent processing content, then Processing prompts | The entire request | No | | Content contains [sensitivity labels](https://learn.microsoft.com/en-us/purview/sensitivity-labels) | Copilot reading a labeled file or email as grounding | Yes, without the labeled item | * * * _**Key Insight: The web-search block and the prompt block use the same condition and the same location. Only the action differs, which is why a copy-pasted rule enforces the wrong behavior.**_ * * * Pick the control that matches the risk you are actually carrying: * Use the web-search action when sensitive prompts should keep working internally but never reach an external provider. * Use the prompt-block action when policy forbids sensitive text in Copilot under any circumstances. * Use the label-based condition when the exposure is a classified document rather than the words a user typed. ## Build It, Then Test It with a Control Prompt Licensing comes first: confirm your [Microsoft 365 compliance licensing](https://learn.microsoft.com/en-us/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-365-security-compliance-licensing-guidance) covers Purview DLP before you build. The Copilot policy location is only reachable through a Custom DLP policy template, and selecting it disables every other location for that policy. That constraint shapes the build: one dedicated policy for Copilot, kept separate from your email and endpoint rules. * * * _**Warning: A DLP policy that fires on real users is a production change. Microsoft’s _**[_**default Copilot policy**_](https://learn.microsoft.com/en-us/purview/dlp-microsoft365-copilot-location-default-policy)**_ ships in simulation mode, logging matches without blocking them, so confirm the rule on a pilot group before you switch it to enforce.**_ * * * ### Create the Rule Create the policy with [New-DlpCompliancePolicy](https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/new-dlpcompliancepolicy) and add the rule with [New-DlpComplianceRule](https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/new-dlpcompliancerule), both in [Security & Compliance PowerShell](https://learn.microsoft.com/en-us/powershell/exchange/scc-powershell), which you reach with `Connect-IPPSSession` from an account holding the Purview Compliance Administrator or Data Security AI Admin role. The Copilot location is a location string plus the `CopilotExperiences` enforcement plane: ```powershell Connect-IPPSSession -UserPrincipalName admin@contoso.onmicrosoft.com $copilotLocation = '[{"Workload":"Applications","Location":"470f2276-e011-4e9d-a6ec-20768be3a4b0","Inclusions":[{Type:"Tenant", Identity:"All"}]}]' New-DlpCompliancePolicy -Name "Copilot web search block" -Locations $copilotLocation -EnforcementPlanes @("CopilotExperiences") -Mode TestWithNotifications ``` Give the resulting rule a **Content contains** > **Sensitive information types** condition and set its action to **Prevent Copilot from processing content** > **Performing Web Searches**. Prefer the portal? Run it by hand: 1. In the [Microsoft Purview portal](https://learn.microsoft.com/en-us/purview/dlp-create-deploy-policy), open **Data loss prevention** > **Policies** and select **Create policy**. 2. Choose the **Custom** template, then **Custom policy**. 3. On the **Locations** page, switch **Microsoft 365 Copilot and Copilot Chat** on; every other location turns off. 4. Add a rule with a **Content contains** > **Sensitive information types** condition, using built-in credit-card detection or a [custom sensitive information type](https://learn.microsoft.com/en-us/purview/sit-create-a-custom-sensitive-information-type) for an internal project code. 5. Set the action to **Prevent Copilot from processing content** > **Performing Web Searches**. ### Run a Matching Prompt and a Control Prompt Run a matching prompt and a control prompt so the test exercises both paths. First, a matching prompt that contains the SIT, for example a sentence with a real-looking project code you defined as custom. Then a control prompt with the same question and no sensitive value. If the rule works, the matching prompt returns an internal answer with no external search, and the control prompt still gets full web grounding. ## Prove It Fired, and Know What It Doesn’t Cover Testing confirms intent; telemetry confirms enforcement. Purview routes Copilot DLP activity to [Activity Explorer](https://learn.microsoft.com/en-us/purview/data-classification-activity-explorer) under the DLP and DSPM for AI filters, and the unified audit log records a [CopilotInteraction event](https://learn.microsoft.com/en-us/purview/audit-log-activities) for each prompt. Look for the entry whose `AISystemPlugin.Id` is `BingWebSearch` and confirm the grounding action was blocked. ![Verification path](https://adamtheautomator.com/wp-content/uploads/publisher/d2c009d6037f971a6088efc5836dd8a65d942b2df0ae65be68ec239e4987e025.png) Budget time before you call a test failed. Microsoft Learn notes in [Learn about data loss prevention](https://learn.microsoft.com/en-us/purview/dlp-learn-about-dlp): “In general, policies take effect about an hour after being turned on.” ### What the Control Will Not Do The control is narrow by design, and its limits matter as much as its behavior: * A sensitive information type and a sensitivity label can’t share one rule. Microsoft Learn states: “You can’t use both content contains sensitive info types and content contains sensitivity labels conditions in the same rule.” Build two rules or two policies. * The location covers Microsoft 365 Copilot, Copilot Chat, and Cowork. It doesn’t govern a browser tab pointed at a third-party AI app, so a tenant-wide Copilot rule says nothing about those tools. * Prompt text is evaluated. A file the user uploads directly into the conversation is a separate surface, so do not treat this rule as protection for uploaded contents. * The block restricts grounding only; it leaves the user’s permissions untouched. * * * _**Reality Check: The block cuts the external search only. If your classification is wrong, the rule has nothing to match on and the sensitive value still leaves with the prompt.**_ * * * Read the audit record before you enforce. Confirm the blocked `BingWebSearch` grounding action in Activity Explorer and the audit log; when both name the same prompt, you hold a Copilot data boundary you can defend. Share this article [Share on X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fadamtheautomator.com%2Fstop-copilot-web-searches%2F&text=Stop%20Copilot%20Web%20Searches%20from%20Leaking%20Sensitive%20Data)[Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fadamtheautomator.com%2Fstop-copilot-web-searches%2F)[Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fadamtheautomator.com%2Fstop-copilot-web-searches%2F) ## Related Posts ![](https://adamtheautomator.com/wp-content/uploads/publisher/3f35d9c85b2b8157af67cfe805737c4c/d87a8e3ffd5988406606bd14f49a16ebbed72206f31a33a1f24372061a22b0e9.webp) ### [Troubleshoot Missing AI Prompts in Purview Activity Explorer](/purview-missing-ai-prompts/) Find why Purview records AI activity without prompt text. Check audit settings, capture policies, and viewer permissions in a scoped test. ![](https://adamtheautomator.com/wp-content/uploads/2026/06/featured_image-13.png) ### [Taming AI Tool Sprawl: A PowerShell Guide to Auditing and Governing Unauthorized AI Applications](/taming-ai-tool-sprawl-powershell-guide-auditing/) Detect and govern unauthorized AI tools with PowerShell, Microsoft Graph, Entra ID, and Defender for Cloud Apps. ![](https://adamtheautomator.com/wp-content/uploads/2026/06/featured_image-11.png) ### [Unify Your SOC: Integrating Defender XDR with Sentinel](/unify-soc-integrating-defender-xdr-sentinel/) Integrate Defender XDR with Microsoft Sentinel for unified incidents, endpoint event streaming, cross-product detections, and SOAR. ## Categories * [IT Ops](/category/it-ops/) * [Cloud](/category/cloud/) * [DevOps](/category/devops/) * [Home Ops](/category/home-ops/) * [Information Security](/category/infosec/) * [Software Development](/category/software-development/) ## Site * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Copyright 2026© ATA Learning | [Privacy Policy](/privacy/)