2.4 How Data Protection Restricts Prompt Results
Key Takeaways
- Copilot performs security trimming before generation: Microsoft Graph returns only items the signed-in user already has permission to open, so Copilot can never be used to escalate privilege.
- A sensitivity label that applies encryption withholds content from Copilot unless the user holds the EXTRACT (copy) usage right on that label.
- Content Copilot generates from labelled source material inherits the most restrictive label of the sources it used.
- Microsoft Purview Data Loss Prevention policies can block Copilot from processing labelled content, which is why a user with file access can still receive an incomplete answer.
- An empty or partial Copilot answer is a permissions and policy signal, not a product defect — the correct first response is to check access and labels, not to re-prompt.
2.4 How Data Protection Restricts Prompt Results
Quick Answer: Copilot never widens access. Every retrieval runs as the signed-in user, so Microsoft Graph security-trims results before the model sees them. On top of that identity check, encrypting sensitivity labels, the EXTRACT usage right, and Microsoft Purview DLP policies can each withhold content Copilot would otherwise be allowed to use. The visible symptom is always the same: a thin, partial, or empty answer.
The Enterprise Security Boundary & Security Trimming
Microsoft 365 Copilot operates entirely within the customer's dedicated Microsoft 365 enterprise tenant boundary. It adheres to all organizational compliance commitments and respects established data isolation protocols.
+───────────────────────────────────────────────────────────────────────────+
| Security Trimming Execution Model |
| |
| [Authenticated User] ── (Signs in via Microsoft Entra ID) |
| │ |
| ▼ |
| [Prompt: "Summarize project budgets"] |
| │ |
| ▼ |
| [Microsoft Graph Security Trimming Engine] |
| │ |
| ├── File A (Public Project): [User has READ] ──> GROUNDED |
| ├── File B (Executive Comp): [User has NO ACC] ──> EXCLUDED |
| └── File C (HR Restricted): [User has NO ACC] ──> EXCLUDED |
| │ |
| ▼ |
| [Context Sent to LLM] ── Contains ONLY File A Data |
| │ |
| ▼ |
| [Copilot Output] ── Surfaces ONLY authorized information |
+───────────────────────────────────────────────────────────────────────────+
How Security Trimming Operates
Security Trimming is the foundational access control mechanism of Microsoft 365 Copilot:
- User Context Execution: Every interaction with Copilot occurs exclusively within the security context of the authenticated user. Copilot does not possess administrative privileges, superuser access, or a separate service account.
- Graph-Level Filtering: When a user submits a prompt, Microsoft Graph queries the organization's indexed data (SharePoint sites, OneDrive folders, Teams chats, Outlook mailboxes). Before any document is retrieved for grounding, the Graph engine validates the user's specific access control lists (ACLs).
- Exclusion of Unauthorized Data: If a user does not have explicit Read permissions to a file, that file is completely invisible to Copilot during prompt processing. It cannot be used for grounding, summarized, or referenced in citations.
- No Cross-Tenant or Public Model Training: Enterprise customer data processed by Copilot is never used to train, retrain, or fine-tune public foundation models (such as base OpenAI models). Data remains strictly within the tenant's compliance perimeter.
[!NOTE] Exam Concept: Copilot Cannot Bypass Permissions A core concept on Exam AB-730 is that Copilot never expands a user's permissions. If an employee cannot open a document in SharePoint, Copilot will never reveal its contents in chat or draft responses.
Encryption Labels and the EXTRACT Usage Right
Permission to open a file is not the same as permission for Copilot to reuse its contents. When a sensitivity label applies encryption, it also carries usage rights. Copilot must hold the EXTRACT right (often shown as "Copy" in label configuration) on behalf of the user before it can pull text out of that file and into a generated answer.
| User situation | Can the user open the file? | Can Copilot use it in an answer? |
|---|---|---|
| No SharePoint permission | No | No — Graph returns nothing |
| Has permission, file unlabelled | Yes | Yes |
| Has permission, label encrypts, user has VIEW only | Yes | No — EXTRACT right is missing |
| Has permission, label encrypts, user has VIEW + EXTRACT | Yes | Yes |
| Has permission, but a DLP policy targets that label for Copilot | Yes | No — policy blocks processing |
This table explains the scenario candidates find counter-intuitive: a user opens a document happily in Word, then asks Copilot to summarise it and is told the content is unavailable. Nothing is broken. The label grants reading but not extraction.
Label Inheritance on Generated Content
When Copilot draws on labelled material, the output is not laundered. The generated document, page, or summary inherits the most restrictive sensitivity label among the sources used. A draft assembled from one General memo and one Highly Confidential forecast emerges labelled Highly Confidential, carrying the encryption and sharing restrictions of that label with it.
On the Exam: Given a scenario where a user complains Copilot "ignored" a document they can clearly open, work the chain in order — Entra ID identity, SharePoint or OneDrive permission, encrypting label and EXTRACT right, then DLP policy. The first failing link is the answer.
Why This Design Matters
Security trimming is what makes broad Copilot deployment defensible. Because retrieval inherits existing access control lists, rolling Copilot out to ten thousand employees creates no new data path. It does, however, make pre-existing oversharing visible very quickly, which is the governance problem covered in section 2.3.
Diagnosing a Restricted Result in Order
When a user reports that Copilot "will not read" something, the fault is almost always in one of four layers, and they fail in a fixed order. Check them in that order rather than re-prompting.
| # | Layer | Question to ask | If this is the cause |
|---|---|---|---|
| 1 | Identity | Is the user signed in with the correct work account? | Personal-account sessions reach no organizational content at all |
| 2 | Permission | Can the user open the item directly in SharePoint or OneDrive? | Request access; Copilot cannot grant it |
| 3 | Label | Does an encrypting sensitivity label apply, and does the user hold EXTRACT? | The label owner must adjust usage rights |
| 4 | Policy | Does a Purview DLP policy target that label for Copilot? | Compliance owns the exception, not the help desk |
Re-prompting fixes none of these, and rewording a prompt to work around a restriction is the wrong instinct to build. If Copilot withheld content, the boundary did its job.
An organization notices that Copilot is surfacing sensitive internal project budgets to entry-level staff members. An investigation reveals that the SharePoint document library hosting the files was configured with permissions granted to 'Everyone except external users.' What core data governance issue does this illustrate?
An employee can open a contract in Word but Copilot reports it cannot use the document when asked to summarise it. The employee's SharePoint permissions are confirmed correct. What is the most likely explanation?
Copilot drafts a briefing note by combining a document labelled General with a forecast labelled Highly Confidential. What label does the resulting draft carry?