Microsoft Purview for Copilot: What to Configure Before Rollout

Microsoft 365 Copilot does not break your permissions. It amplifies them. Copilot grounds its answers in content the user already has permission to access across Outlook, Word, Excel, SharePoint, and Teams, so an overshared site nobody ever opened can suddenly become an answer in someone’s prompt. That is why our team treats Microsoft Purview configuration as a pre-rollout gate, not a post-launch cleanup task. Here is what to configure, in the order we configure it.

Configure Purview before you assign Copilot licenses, not after. Every control below is cheaper to set up on a pilot tenant than to retrofit across a tenant where Copilot has already been summarizing your data for months.

1. Start with visibility: Data Security Posture Management for AI

Microsoft Purview Data Security Posture Management (DSPM) for AI is the discovery layer for everything that follows. It shows which AI tools are in use, including Microsoft 365 Copilot and non-Microsoft AI services, surfaces data exposure risks in AI-generated content, and produces reports that help assess compliance posture. Most usefully for a pre-rollout team, it runs weekly data assessments for the top 100 SharePoint sites used by Copilot, flagging data that is frequently accessed or overshared, files containing sensitive information, and content missing labeling or governance controls. You can also create custom assessments for specific users or sites.

DSPM for AI groups its recommendations into three categories that map onto a rollout plan: data security (labeling, DLP, or access-control gaps that could let Copilot process sensitive files), communication insights (prompts or responses exposing sensitive data or inappropriate language), and AI regulations (audit, retention, or policy settings that must align with regulatory expectations). One boundary matters: DSPM for AI recommends and can initiate policies, but it does not manage them. Each policy is created and stored in its own Purview solution area. DSPM tells you what to fix; the sections below are where you fix it.

2. Fix oversharing before Copilot finds it

The most common pre-rollout finding is not a missing policy. It is a permission problem Copilot is about to make visible: users may prompt their way into sensitive information that would otherwise stay buried in older documents. Our team treats the DSPM for AI assessment findings as a remediation list, tightening sharing on flagged sites and confirming owners for flagged content before expanding the pilot. This is the step our AI Coworker Readiness Checklist treats as a launch blocker, inside the four-layer operating model we use to govern Copilot end to end.

3. Publish a sensitivity label taxonomy Copilot can actually use

Sensitivity labels are managed in Purview’s Information Protection area, and they are the switch several Copilot controls hang off. A taxonomy only helps if it is published, understood, and actually applied to content, because the DLP controls below key off labels, not intentions. Keep it small enough that people apply it correctly: a handful of levels (Public, Internal, Confidential, Highly Confidential) beats a twenty-label scheme nobody uses. Every unlabeled sensitive file is a file no label-based Copilot control can protect.

4. Scope a DLP policy to Microsoft 365 Copilot and Copilot Chat

A DLP policy using the Microsoft 365 Copilot and Copilot Chat location gives you four distinct protections:

Block sensitive files and emails from being processed. A policy with a sensitivity-label condition excludes matching files and emails from Copilot responses. The item can still appear in citations, but its content is not used or accessed by Copilot. This protection is generally available.
Block sensitive prompts from being processed. A policy with a sensitive information type condition prevents Copilot from returning a response when a prompt contains configured types such as credit card numbers, passport numbers, or Social Security numbers. This protection is in preview and extends to prebuilt agents.
Block external web search when prompts contain sensitive data. A policy can block Copilot from using external web search as a grounding source for a sensitive prompt, while still generating a response from permitted internal Microsoft 365 data.
Block external email from being processed. A policy with an external-sender condition excludes emails from outside your organization’s accepted domains from grounding, summarization, and citation, reducing prompt injection risk. This protection is in preview and evaluates sender metadata only.

Know the mechanics before you build: the Copilot location is only available in the Custom policy template, and selecting it disables all other locations for that policy. You cannot use a sensitive information type condition and a sensitivity label condition in the same rule, so create one rule per condition. Policy updates can take up to four hours to reflect in Copilot, so plan changes into change windows. And note one gap: DLP cannot scan files users upload directly into prompts; it only checks the text typed into the prompt itself.

5. Watch the conversation: Communication Compliance for Copilot

DLP stops the worst cases at the door. Communication Compliance watches what gets through it. Purview Communication Compliance supports policies that evaluate user prompts and AI-generated responses in Microsoft Copilot and other AI tools, and the fastest start is the built-in Detect Microsoft 365 Copilot interactions template. Its defaults scope the policy to Microsoft 365 Copilot, cover inbound, outbound, and internal direction, and review 100 percent of matching items, with at least one condition required before the policy can be created.

When a policy match occurs, an entry appears for review, with separate entries for the prompt and the response if only one meets the policy conditions. Policies scan communications every 24 hours based on their creation time, so expect up to a day before the first scan data appears. You can also start from DSPM for AI: its one-click Detect unethical behavior in AI apps policy scans prompts and responses in supported AI apps and routes alerts to Communication Compliance for review. Before creating any of this, turn on auditing, which Communication Compliance relies on, and assign reviewers with Exchange Online mailboxes, since reviewers are notified by email when assigned.

6. Close the audit and retention gap

Copilot interactions create a compliance record whether you plan for one or not. The risk is an audit and compliance blind spot: prompt and response data, or content referenced during AI interactions, may not be captured without specific audit or retention settings. DSPM for AI integrates with auditing and eDiscovery for tracking AI activity and managing investigations, so confirm auditing is on and retention settings cover Copilot interactions before rollout, not after your first investigation request. A rollout with no audit trail is a rollout you cannot defend.

The pre-rollout Purview checklist

Run DSPM for AI and remediate the top oversharing findings before expanding the pilot.
Publish a small, usable sensitivity label taxonomy and confirm labels are applied to sensitive content.
Create a DLP policy on the Microsoft 365 Copilot and Copilot Chat location: one rule for sensitive information types in prompts, one for sensitivity labels on files and emails, and a web-search block for sensitive prompts.
Create a Communication Compliance policy from the Detect Microsoft 365 Copilot interactions template, with named reviewers.
Confirm auditing is on and retention settings cover Copilot interactions.
Re-run the DSPM for AI assessment after remediation and treat remaining high-risk findings as rollout blockers.

Done in this order, Purview stops being a compliance checkbox and becomes the reason a Copilot rollout survives its first security review. Our team runs this exact sequence with clients before licenses scale, because discovering an oversharing problem through a Copilot answer is the most expensive way to learn about it.

Frequently asked questions

Does Copilot respect our existing SharePoint and OneDrive permissions?

Yes. Copilot grounds responses in data the user already has permission to access. The pre-rollout work is making sure those permissions say what you think they say, because Copilot makes previously buried content easy to discover.

What is DSPM for AI, and is it a policy engine?

Data Security Posture Management for AI is Purview’s discovery and recommendation layer for AI risk. It identifies AI usage, sensitive data in AI interactions, and oversharing, and recommends protections. It does not manage policies directly: DLP policies, sensitivity labels, and communication compliance policies live in their own solution areas.

Can Purview stop Copilot from summarizing a labeled confidential file?

Yes. A DLP policy scoped to the Microsoft 365 Copilot and Copilot Chat location with a sensitivity label condition excludes matching files and emails from being processed in responses. The item may still appear in citations, but its content is not used.

Can Purview block a user from pasting a credit card number into a Copilot prompt?

Yes, with a DLP policy that uses a sensitive information type condition on the Copilot location. Copilot will not return a response when the prompt contains configured sensitive types. This protection is in preview, and DLP checks the text typed into the prompt, not files uploaded into prompts.

How quickly do Copilot DLP policies and communication compliance scans take effect?

DLP policy updates can take up to four hours to reflect in Copilot experiences. Communication Compliance policies scan every 24 hours based on their creation time, so allow up to a day before the first scan data appears.