MC937930 – (Updated) Microsoft Purview | Data Loss Prevention: Restrict Microsoft 365 Copilot using content with sensitivity labels

Product:

Copilot, Microsoft 365 Copilot, Purview Communication Compliance, Purview Data Loss Prevention, Purview Information Protection

Platform:

Online, Web, World tenant

Status:

In development

Change type:

Admin impact, Feature update, Updated message, User impact

Links:

423483

Details:

Microsoft Purview Data Loss Prevention (DLP) will soon extend to support Microsoft 365 Copilot. DLP policies will be able to identify sensitive documents based on sensitivity labels and exclude processing for Copilot interactions in Microsoft 365 Copilot Business Chat.
Updated February 6, 2025: We have updated the rollout timeline below. Thank you for your patience.
The preview does not support alerts, incident reports, and policy simulation. Audit records will be available at a later time after policy management is enabled for organizations. A Microsoft 365 Copilot license and a Microsoft 365 E5 license or equivalent are required to use this feature.
This message is associated with Microsoft 365 Roadmap ID 423483.
[When this will happen:]
Public Preview: We will begin rolling out mid-November 2024 and expect to complete by mid-December 2024.
General Availability: We will begin rolling out late June 2025 and expect to complete by late July 2025.

Change Category:
XXXXXXX ... free basic plan only

Scope:
XXXXXXX ... free basic plan only

Release Phase:
General Availability, Preview

Created:
2024-11-20

updated:
2025-02-07

Public Preview Start Date

XXXXXXX ... free basic plan only

Task Type

XXXXXXX ... free basic plan only

Docu to Check

XXXXXXX ... free basic plan only

MS How does it affect me

XXXXXXX ... free basic plan only

MS Preperations

XXXXXXX ... free basic plan only

MS Urgency

XXXXXXX ... free basic plan only

MS workload name

XXXXXXX ... free basic plan only

linked item details

XXXXXXX ... free basic plan only

Pictures

XXXXXXX ... free basic plan only

summary for non-techies**

XXXXXXX ... free basic plan only

Direct effects for Operations**

Data Access Restrictions
Users may experience restricted access to sensitive documents when using Microsoft 365 Copilot, potentially hindering their ability to perform tasks efficiently.
   - roles: End Users, Data Analysts
   - references: https://www.microsoft.com/microsoft-365/roadmap?filters=&searchterms=423483

User Experience Disruption
The automatic implementation of DLP policies without prior user notification may lead to confusion and frustration among users who rely on Copilot for their daily tasks.
   - roles: End Users, Project Managers
   - references: https://www.microsoft.com/microsoft-365/roadmap?filters=&searchterms=423483

Policy Management Challenges
Admins may face challenges in managing and configuring DLP policies effectively due to the lack of alerts and incident reports during the initial rollout phase.
   - roles: IT Administrators, Compliance Officers
   - references: https://aka.ms/dlp

Configutation Options**

XXXXXXX ... paid membership only

Opportunities**

Enhanced Data Security with DLP Policies
Implementing Data Loss Prevention (DLP) policies that restrict Microsoft 365 Copilot from processing sensitive documents can significantly enhance data security. This ensures that sensitive information is not inadvertently exposed during AI interactions, thus protecting the organization from potential data breaches.
   - next-steps: Review and categorize existing documents based on sensitivity labels. Create and configure DLP policies in the Microsoft Purview portal to restrict Copilot interactions with these documents.
   - roles: IT Administrators, Compliance Officers, Data Protection Officers
   - references: https://aka.ms/dlp, https://www.microsoft.com/microsoft-365/roadmap?filters=&searchterms=423483

Improved User Awareness and Training
With the introduction of DLP policies for Microsoft 365 Copilot, there is an opportunity to enhance user awareness regarding data handling and compliance. Educating users about sensitivity labels and DLP policies can lead to better data management practices.
   - next-steps: Develop training materials that explain sensitivity labels, DLP policies, and their implications for using Microsoft 365 Copilot. Schedule training sessions for users to familiarize them with the new policies.
   - roles: HR Training Coordinators, IT Support Staff, Compliance Officers
   - references: https://aka.ms/dlp, https://www.microsoft.com/microsoft-365/roadmap?filters=&searchterms=423483

Streamlined Compliance Monitoring
The integration of DLP with Microsoft 365 Copilot provides an opportunity for streamlined compliance monitoring. Organizations can more easily track and audit interactions with sensitive content, ensuring adherence to regulatory requirements.
   - next-steps: Set up auditing mechanisms within the Microsoft Purview portal to monitor DLP policy effectiveness and compliance. Regularly review audit logs and reports to identify potential compliance issues.
   - roles: Compliance Officers, IT Security Analysts, Data Governance Managers
   - references: https://aka.ms/dlp, https://www.microsoft.com/microsoft-365/roadmap?filters=&searchterms=423483

Potentional Risks**

XXXXXXX ... paid membership only

Data Protection**

XXXXXXX ... paid membership only

IT Security**

XXXXXXX ... paid membership only

Hypothetical Work Council Statement**

XXXXXXX ... paid membership only

DPIA Draft**

XXXXXXX ... paid membership only

explanation for non-techies**

XXXXXXX ... free basic plan only