Don’t level Microsoft 365 Copilot at a immediate full of a buyer’s bank card numbers and assume the reply stays inside your tenant. Microsoft 365 Copilot grounds its responses in two locations: your individual Microsoft Graph content material, and an exterior net search it reaches for when a query wants more energizing details. The second path crosses your tenant boundary, and it’s the one you may disable for a single immediate.
Microsoft Purview knowledge loss prevention (DLP) insurance policies for Copilot embrace a management that blocks simply the net search when a immediate matches a delicate info sort (SIT). The immediate nonetheless will get a solution, drawn from inner content material the consumer is already permitted to learn. That could be a narrower promise than it sounds, and the hole between “blocked the net search” and “blocked the immediate” is the place a rollout enforces the incorrect habits.
The place a Copilot Immediate Really Goes
Each Copilot immediate runs contained in the safety context of the one who typed it. If they will open a doc, Copilot can summarize it; if they will’t, Copilot can’t attain it. That containment holds till the immediate leaves for the net.
Net grounding is the place the immediate leaves your tenant. Copilot formulates a search question from the immediate and arms it to an exterior search service. Microsoft’s reference on how Copilot handles net search and generated queries follows that question as soon as it heads for Bing, which sits exterior the privateness phrases masking your tenant content material.
The 2026 SearchLeak chain exhibits how little that exit prices an attacker. Varonis Menace Labs documented a three-stage Copilot exfiltration assault that opened with a URL parameter Copilot’s engine handled as an executable instruction. Microsoft tracked the flaw as CVE-2026-42824, an information-disclosure situation it rated crucial, and the Nationwide Vulnerability Database (NVD) scores it 7.5. The attacker wanted no plugin and no administrator permission.
A purpose-built management exists for this exit, and it behaves not like the 2 controls most admins attain for first.
What the Performing Net Searches Management Adjustments
The Performing Net Searches motion inside Purview DLP is that management. You connect it to the Microsoft 365 Copilot and Copilot Chat coverage location, pair it with a content material comprises delicate info varieties situation, and Purview evaluates every immediate in actual time.
Microsoft Study names the end result exactly. The DLP for Microsoft 365 Copilot and Cowork web page states: “This prevents immediate textual content that matches the configured SITs from being despatched to exterior search suppliers for that request.”
Two penalties observe from that sentence. The block applies per immediate, so an atypical query with no delicate match retains full net grounding. And the immediate is just not discarded: Copilot pivots to inner grounding and solutions from Microsoft Graph content material the consumer can already open.
Net-Search Block or Immediate Block?
A sibling motion, Processing prompts, stops the request outright. When a immediate journeys its situation, Copilot returns a message that your group blocked the request, and the delicate textual content feeds neither an inner nor an exterior search. The online-search motion offers up solely the exterior lookup; the prompt-block motion offers up the reply too. If you wish to hold the interior reply alive, the web-search block is the one you attain for.
Three Controls That Look Alike and Are Not
Microsoft Purview ships three controls that determine how a lot Copilot might do with delicate materials, and admins routinely ship a rule to the incorrect one. The desk under maps what every one really stops.
| Management | What it stops | Immediate nonetheless answered internally? |
|---|---|---|
| Forestall processing content material, then Performing Net Searches | Sending matching immediate textual content to the exterior search supplier | Sure |
| Forestall processing content material, then Processing prompts | Your complete request | No |
| Content material comprises sensitivity labels | Copilot studying a labeled file or e mail as grounding | Sure, with out the labeled merchandise |
Key Perception: The online-search block and the immediate block use the identical situation and the identical location. Solely the motion differs, which is why a copy-pasted rule enforces the incorrect habits.
Choose the management that matches the danger you’re really carrying:
-
Use the web-search motion when delicate prompts ought to hold working internally however by no means attain an exterior supplier.
-
Use the prompt-block motion when coverage forbids delicate textual content in Copilot underneath any circumstances.
-
Use the label-based situation when the publicity is a categorized doc quite than the phrases a consumer typed.
Construct It, Then Check It with a Management Immediate
Licensing comes first: affirm your Microsoft 365 compliance licensing covers Purview DLP earlier than you construct. The Copilot coverage location is simply reachable by way of a Customized DLP coverage template, and choosing it disables each different location for that coverage. That constraint shapes the construct: one devoted coverage for Copilot, saved separate out of your e mail and endpoint guidelines.
Warning: A DLP coverage that fires on actual customers is a manufacturing change. Microsoft’s default Copilot coverage ships in simulation mode, logging matches with out blocking them, so affirm the rule on a pilot group earlier than you turn it to implement.
Create the Rule
Create the coverage with New-DlpCompliancePolicy and add the rule with New-DlpComplianceRule, each in Safety & Compliance PowerShell, which you attain with Join-IPPSSession from an account holding the Purview Compliance Administrator or Knowledge Safety AI Admin function. The Copilot location is a location string plus the CopilotExperiences enforcement aircraft:
Join-IPPSSession -UserPrincipalName [email protected]
$copilotLocation = '[{"Workload":"Applications","Location":"470f2276-e011-4e9d-a6ec-20768be3a4b0","Inclusions":[{Type:"Tenant", Identity:"All"}]}]'
New-DlpCompliancePolicy -Identify "Copilot net search block" -Areas $copilotLocation -EnforcementPlanes @("CopilotExperiences") -Mode TestWithNotificationsGive the ensuing rule a Content material comprises > Delicate info varieties situation and set its motion to Forestall Copilot from processing content material > Performing Net Searches. Choose the portal? Run it by hand:
-
Within the Microsoft Purview portal, open Knowledge loss prevention > Insurance policies and choose Create coverage.
-
Select the Customized template, then Customized coverage.
-
On the Areas web page, change Microsoft 365 Copilot and Copilot Chat on; each different location turns off.
-
Add a rule with a Content material comprises > Delicate info varieties situation, utilizing built-in credit-card detection or a customized delicate info sort for an inner challenge code.
-
Set the motion to Forestall Copilot from processing content material > Performing Net Searches.
Run a Matching Immediate and a Management Immediate
Run an identical immediate and a management immediate so the take a look at workouts each paths. First, an identical immediate that comprises the SIT, for instance a sentence with a real-looking challenge code you outlined as customized. Then a management immediate with the identical query and no delicate worth. If the rule works, the matching immediate returns an inner reply with no exterior search, and the management immediate nonetheless will get full net grounding.
Show It Fired, and Know What It Doesn’t Cowl
Testing confirms intent; telemetry confirms enforcement. Purview routes Copilot DLP exercise to Exercise Explorer underneath the DLP and DSPM for AI filters, and the unified audit log information a CopilotInteraction occasion for every immediate. Search for the entry whose AISystemPlugin.Id is BingWebSearch and make sure the grounding motion was blocked.
Price range time earlier than you name a take a look at failed. Microsoft Study notes in Study knowledge loss prevention: “Generally, insurance policies take impact about an hour after being turned on.”
What the Management Will Not Do
The management is slim by design, and its limits matter as a lot as its habits:
-
A delicate info sort and a sensitivity label can’t share one rule. Microsoft Study states: “You’ll be able to’t use each content material comprises delicate data varieties and content material comprises sensitivity labels circumstances in the identical rule.” Construct two guidelines or two insurance policies.
-
The placement covers Microsoft 365 Copilot, Copilot Chat, and Cowork. It doesn’t govern a browser tab pointed at a third-party AI app, so a tenant-wide Copilot rule says nothing about these instruments.
-
Immediate textual content is evaluated. A file the consumer uploads immediately into the dialog is a separate floor, so don’t deal with this rule as safety for uploaded contents.
-
The block restricts grounding solely; it leaves the consumer’s permissions untouched.
Actuality Verify: The block cuts the exterior search solely. In case your classification is incorrect, the rule has nothing to match on and the delicate worth nonetheless leaves with the immediate.
Learn the audit document earlier than you implement. Verify the blocked BingWebSearch grounding motion in Exercise Explorer and the audit log; when each title the identical immediate, you maintain a Copilot knowledge boundary you may defend.
