23.1 Implement Purview Controls for AI Services

23.1 Implement Purview Controls for AI Services

Quick Answer: Microsoft 365 Copilot and Copilot Chat honor existing Microsoft 365 permissions. Sensitivity labels add markings plus Azure Rights Management checks: the user needs VIEW and EXTRACT (Copy and extract content) before Copilot can return item text. Use a Custom Data Loss Prevention (DLP) policy with the Microsoft 365 Copilot and Copilot Chat location to stop Copilot from processing labeled files and emails, from answering prompts that contain sensitive information types (SITs), or from sending those prompts to external web search. Endpoint DLP still covers paste into third-party AI sites in a browser. Data Security Posture Management (DSPM) for AI is the next chapter—do not treat this skill as DSPM policy authoring.

Microsoft 365 Copilot, Microsoft 365 Copilot Chat, Security Copilot, Copilot Studio, Copilot in Fabric, and other generative AI apps do not invent a new information-protection product. They consume mailboxes, SharePoint and OneDrive files, Teams content, and data in use (a file already open in Word, Excel, PowerPoint, or Outlook), including files stored outside the tenant on a local disk, network share, USB drive, or another cloud. The SC-401 bullet is to implement Microsoft Purview controls so that AI grounding and summarization cannot extract what the user should not copy—even when Graph already granted read access.

That last point is the exam's mental model. Copilot is fast oversharing, not a backdoor. A user who can open a loosely permissioned HR library can now ask Copilot to summarize every resume in seconds. Labels, encryption usage rights, DLP, and classification are how you stop extract, after access is already true.

Access first, then protection

AI apps that Microsoft Purview supports use existing controls so tenant data is never returned to the user or used by a large language model if the user does not have access to that data. When your organization's sensitivity labels are on the content, Microsoft documents an extra layer:

• With a file open in Word, Excel, or PowerPoint—or an email or calendar event open in Outlook—the app shows the label name and any header, footer, or watermark markings. Loop components and pages use the same sensitivity labels.
• When the label applies encryption, the user must have EXTRACT as well as VIEW for Copilot or agents to return the data.
• The same encryption check applies to data in use outside Microsoft 365 when the file is open in an Office app.

Enable sensitivity labels for Office files in SharePoint and OneDrive before a Copilot rollout. If you skip that, encrypted files that Copilot and agents can access are limited to data in use from Office apps on Windows. At-rest labeled files in SharePoint and OneDrive will not participate the same way.

Copilot and agents recognize your tenant's labels, not another organization's labels on incoming files. Container labels on Teams, Microsoft 365 Groups, SharePoint sites, Loop workspaces, and Viva Engage are not inherited by items in those containers. A Teams channel summary therefore will not display the team's Confidential container label unless the messages or files themselves are labeled as items.

EXTRACT, encryption without labels, and hard stops

The usage right that maps to copying text is EXTRACT, shown in the Purview portal as Copy and extract content (EXTRACT). If content grants VIEW but not EXTRACT, Copilot will not summarize it; it may still emit a link so the user can open the item outside Copilot. Full control (OWNER) includes EXTRACT. The person who applied encryption is the Rights Management owner and always has EXTRACT for their own files, so Copilot can still return content that user encrypted themselves.

When you configure a label to assign permissions now, preset levels such as Editor include EXTRACT; custom Reviewer-style bundles often omit Copy. If you let users assign permissions, Outlook Encrypt-Only includes EXTRACT; Do Not Forward does not include FORWARD and typically blocks copy. In Word, Excel, and PowerPoint, user-defined Read without copy omits EXTRACT. User-defined permissions can block Copilot from extracting unopened SharePoint or OneDrive documents unless the label is used as a default that extends SharePoint permissions to downloaded documents, or the user directly references the file with / and still has EXTRACT. Copilot can always use those documents when they are already open in the app. Microsoft also documents that Copilot agents cannot read files that have user-defined sensitivity label permissions in the typical at-rest path.

Encryption from the Azure Rights Management service can exist without a sensitivity label (Microsoft Purview Message Encryption, Office Information Rights Management, the Rights Management connector, or the RMS SDK). Copilot still checks VIEW and EXTRACT, but new items do not inherit a label. Microsoft's guidance is to protect with labels that apply encryption so inheritance works.

Other encryption methods:

An advanced PowerShell setting on sensitivity labels can prevent Office apps from sending content to connected experiences, which includes Microsoft 365 Copilot and agents. Treat that as a blunt per-label brake, not a substitute for EXTRACT design.

When Copilot generates new content from labeled sources, the highest-priority sensitivity label is displayed in Copilot Chat and is inherited when supported. Unlike some auto-labeling paths, an inherited Copilot label can replace a lower-priority label that was applied manually. Inheritance does not apply when encryption used user-defined permissions or was applied independently from the label. Inheritance also fails if the destination is read-only, the user lacks EXPORT or FULL CONTROL on an already-encrypted destination, or the inherited label is not published to the user. Sensitivity labels on Teams meetings and chat are not currently recognized by Copilot (meeting invites, responses, and calendar events that are labeled still apply to the invite body, not to metadata such as time and attendees). Plugins and Microsoft Graph connectors generally do not honor sensitivity labels on external sources.

DLP for Microsoft 365 Copilot and Copilot Chat

Create the policy from the Custom template. On Locations, turn on Microsoft 365 Copilot and Copilot Chat. Selecting that location disables every other location in the same policy. Admin units are not supported. Updates can take up to four hours. DLP alerts, notifications, and simulation mode are supported.

You cannot combine Content contains > Sensitive information types and Content contains > Sensitivity labels in the same rule. Put each condition in its own rule in the same policy.

Labeled-item coverage includes stored files and files that are actively open (file types supported by sensitivity labels) and emails sent on or after January 1, 2025. Calendar invites are not supported. In Word, Excel, and PowerPoint the policy is evaluated at file open; a label applied mid-session is enforced the next time the file is opened. Skills that would reference file content are disabled; some experiences that do not use a large language model or file content may still appear.

Files uploaded into a prompt are not scanned. DLP evaluates only the text the user types. If the exam scenario is “user attaches a spreadsheet to the prompt,” this location does not inspect that file.

Accounts that can create or edit these policies include Microsoft Entra AI Admin, Purview Data Security AI Admin (edits Copilot-related DLP and can view AI content in DSPM but cannot read prompts and responses), the Purview Data Security AI Admins group, Purview Compliance Administrator, Compliance Data Administrator, Information Protection / Information Protection Admin, Security Administrator, and Global Admin. Use least privilege. Global Admin is listed because it works, not because it is the design pattern.

Windows devices onboarded to Purview can use Endpoint DLP to warn or block paste of sensitive information into third-party generative AI sites in a browser (for example ChatGPT). Microsoft 365 Copilot Chat (web version) also documents Endpoint DLP actions to block paste of sensitive content and to block files based on a specified sensitivity label. That is a device/browser control plane. The Copilot policy location is a Microsoft 365 Copilot processing control plane. You typically need both: one stops consumer AI exfiltration, the other stops Copilot from grinding Highly Confidential files into a Work chat answer.

Classification, audit, eDiscovery, and retention—without stealing DSPM

SITs and trainable classifiers can find sensitive data in prompts and responses. Those hits surface in Purview reports and in DSPM activity explorer on the AI activities tab. DSPM for AI (and DSPM) is the graphical front door with data risk assessments and one-click policies. Prerequisites, DSPM roles, configuring DSPM policies, and monitoring DSPM activities are the next chapter. This chapter's job is to know that Copilot protection still depends on the labels, DLP, audit, and retention you already operate.

Prompts and responses are stored in the user's mailbox and captured in the unified audit log, including the Microsoft 365 app (Copilot in Word, Copilot in Teams, Microsoft 365 Chat), referenced files, and labels on those files. Audit is built for security and compliance investigations, not as the official Copilot usage report—use the Microsoft 365 admin center Copilot usage report or Viva Insights for usage metrics. Auditing Copilot search is not the same as capturing the prompt and response text; use eDiscovery (mailbox source, condition Type contains Copilot activity) or DSPM AI interaction views for content. Retention policies for Copilot and AI apps retain or delete those mailbox-stored interactions using the same principles of retention as other locations. Communication compliance can detect sensitive or inappropriate generative AI interactions. Insider Risk Management's Risky AI usage template (prompt injection and accessing protected materials) still applies; you configured IRM earlier—here it is one more Purview control that fires on AI usage.

Channel Agent in Teams honors EXTRACT for the requesting user but does not check every channel member, so a summary could include content some members cannot open. Microsoft also documents that you cannot use the Copilot DLP location to prevent Channel Agent from summarizing labeled files the same way. Do not assume every Copilot-family surface shares every DLP action.

Exam traps

• Access is not extract. Everyone-except-external on a site is still summarizable until labels, DLP, or workload discovery controls intervene.
• DKE and S/MIME are hard stops; Customer Key is not.
• The Copilot DLP location cannot share a policy with Exchange or SharePoint locations.
• Citations can still list a file whose content was excluded.
• External-email DLP is metadata-only (preview).
• Do not spend this skill configuring DSPM one-click policies—that is the following chapter.