Admin guide
Nightschool AI: Microsoft 365 Copilot DLP and the default policy, for admins
The default Copilot DLP policy logs events. It blocks nothing until you switch it to enforce.
Microsoft Purview DLP has its own location for Copilot, Microsoft 365 Copilot and Copilot Chat. Microsoft creates a default policy, Default DLP policy - Protect sensitive M365 Copilot interactions, that starts in simulation mode: events are logged, nothing is blocked. To block, change the policy to enforce mode.
Published
Key Takeaways
- Copilot has its own DLP policy location: Microsoft 365 Copilot and Copilot Chat.
- A sensitive information type rule stops Copilot responding to prompts with sensitive data.
- A sensitivity label rule keeps labeled items out of the response content.
- The default policy starts in simulation mode and blocks nothing until set to enforce.
The full guide
Tap any section to open it.
About this guide
This page is for the security or compliance admin asked to stop sensitive data going into Microsoft 365 Copilot and keep confidential files out of its answers. It covers the Microsoft Purview DLP policy location for Copilot, what the default policy does on day one, and what encrypted content needs.
LocationCopilot has its own DLP policy location
Microsoft's Purview page says you create DLP policies that use the Microsoft 365 Copilot and Copilot Chat policy location. Policies on email or Teams locations do not cover Copilot prompts.
With the sensitive information types condition, Microsoft says the policy prevents Copilot from returning a response when prompts contain sensitive data.
With the sensitivity labels condition, matching items are excluded from processing. Microsoft says identified items still appear in the citations of the response, but Copilot doesn't use their content in the response.
Default policyThe default policy starts in simulation mode
Microsoft creates a default policy named Default DLP policy - Protect sensitive M365 Copilot interactions. It detects sensitive information types in user prompts.
Microsoft says it is initially configured to run in simulation mode, so the event is only logged. If you want to block processing of the prompt, you must change the state of the policy to enforce mode. Read the logged events first, then pick a date to switch.
EncryptionEncrypted content needs EXTRACT as well as VIEW
When a sensitivity label applies encryption, Microsoft says users must have the EXTRACT usage right, as well as VIEW, for Copilot to return the data. A user who can only view an encrypted file will not get its content back from Copilot.
Check the usage rights on your encryption labels before you rely on Copilot for those files, and tell users why Copilot may decline to summarize a file they can open.
ChecklistDLP checklist you can copy
Fill this in before you switch the default policy to enforce.
1. Pick the location
Microsoft 365 Copilot and Copilot Chat.
2. Add a SIT rule
Name the sensitive information types that should stop a response.
3. Add a label rule
Name the labels whose items stay out of response content.
4. Read simulation
Review what the default policy logged before you enforce.
5. Date the switch
Write the date you move to enforce and who signs it off.
6. Check usage rights
Encrypted content needs EXTRACT and VIEW for Copilot to return it.
SourcesWhere each fact comes from
Microsoft, "Learn about the Microsoft 365 Copilot and Copilot Chat policy location": learn.microsoft.com/en-us/purview/dlp-microsoft365-copilot-location-learn-about. Microsoft, "Default DLP policy for Microsoft 365 Copilot": learn.microsoft.com/en-us/purview/dlp-microsoft365-copilot-location-default-policy.
Microsoft, "Considerations for Microsoft 365 Copilot": learn.microsoft.com/en-us/purview/ai-m365-copilot-considerations.
Each fact on this page was read on that vendor page on 2026-11-08. Open the source and the Microsoft Purview portal before you rely on a detail here.
Train the admins, then the people they support
This page covers one admin task. The Nightschool AI admin and governance course walks the whole Microsoft 365 Copilot setup in order: licensing, data protection, oversharing, Purview DLP, audit and retention, web search, agents and model providers, with every step checked against Microsoft's own documentation.
Frequently Asked Questions
Does the default Copilot DLP policy block anything?
Not at first. Microsoft says it is initially configured to run in simulation mode, so events are only logged. To block, change the policy to enforce mode.
What is the DLP policy location for Copilot called?
Microsoft 365 Copilot and Copilot Chat, in Microsoft Purview data loss prevention.
Do labeled files disappear from Copilot answers?
Not entirely. With a sensitivity labels rule, Microsoft says identified items still appear in citations, but Copilot doesn't use their content in the response.
Why can't Copilot return content from an encrypted file I can open?
Microsoft says users need the EXTRACT usage right as well as VIEW for Copilot to return data from encrypted content.
Where do I see the default policy?
In the Microsoft Purview portal, under Data Loss Prevention, Policies.
Does a Copilot DLP policy make our use compliant?
No setting does that on its own. A policy and its logged events can be evidence for your auditor of what you set; whether your use meets your obligations is for your compliance and legal teams.
Keep going
Related Guides and Courses
Set it up once, write it down, then teach it
Write down who owns each Copilot setting before the day someone asks you to change it.
Nightschool AI is independent and not affiliated with, sponsored by or endorsed by Microsoft. Microsoft 365 Copilot, Microsoft Purview and SharePoint are Microsoft's products, named here only to describe them. Facts checked against Microsoft's public pages on 2026-11-08; confirm in your own admin console before you change a setting.