Microsoft updated its Learn documentation for Microsoft Purview DLP for Microsoft 365 Copilot and Copilot Chat on 5 October 2026. For SMBs, the important point is practical: DLP can now be planned not only around files and classic data flows, but also around prompts, external web search, and external email. That creates a clear review item for organizations that use Copilot or are preparing a rollout and want to prevent sensitive prompts or untrusted external content from influencing AI responses.
What Microsoft updated
The Microsoft Learn article describes the “Microsoft 365 Copilot and Copilot Chat” policy location in Microsoft Purview Data Loss Prevention. It can prevent Copilot, Copilot Chat, and Cowork from processing certain content or from using external web search as a grounding source. The article also highlights the preview control for external email: when a DLP rule uses the condition “Email is received from > External users,” Microsoft says external email is excluded from grounding, summarization, and citation. The user can still access the email; the restriction applies to Copilot processing.
Why this matters for smaller organizations
Organizations with 10 to 250 seats often introduce Copilot in a small pilot first. That is exactly where real operating risk appears: users may type sensitive data into prompts, enable external web search, or ask Copilot to summarize recent email. Microsoft describes concrete controls for these scenarios. DLP can detect sensitive information types in prompts, block web search for sensitive prompts, exclude content with sensitivity labels from processing, and treat external email as an untrusted grounding source.
- Sensitive prompts can be blocked from processing altogether.
- External web search can be blocked when a prompt contains sensitive information types.
- Files and emails with sensitivity labels can be excluded from Copilot responses.
- External email can, in preview, be excluded from grounding, summarization, and citation.
This is not licensing advice. It is a technical control area in Data Loss Prevention and Microsoft 365 operations.
How to classify deadlines and availability
Microsoft does not name a mandatory migration deadline for the updated Learn article. This is therefore not an emergency project. However, the availability boundaries are clear. The external email control is described as a preview feature. Blocking sensitive prompts is also marked as preview and, according to Microsoft, is rolling out to tenants with Microsoft 365 Copilot and Copilot Chat. DLP for files and emails with sensitivity labels is available, as is the ability to prevent external web search when sensitive prompts are detected.
For planning, that means administrators should not simply switch on broad enforcement. Use a pilot group, simulation, and business-owner testing first. Microsoft also notes that DLP policy changes can take up to four hours to appear in the Microsoft 365 Copilot and Copilot Chat experience. That delay belongs in every test plan and helpdesk note.
Which limits administrators should know
The source names several constraints that matter before production use. The conditions “Content contains sensitive info types” and “Content contains sensitivity labels” cannot be used in the same rule. Separate rules are required. Files uploaded directly into prompts are not scanned by DLP; DLP evaluates only the text typed into the prompt. Calendar invites are not supported in the described file and email coverage. For external email, Microsoft says the policy evaluates sender metadata only, specifically the sender domain compared with the tenant’s accepted domains, not the message body.
Those limits are essential for a clean Microsoft Purview design. Without documenting them, teams may assume a broader level of protection than the policy can actually provide.
Concrete next steps
The practical next step is a technical inventory of Copilot usage and the existing Purview DLP structure. After that, a narrow pilot can be built before policies affect production users.
- Identify which users already use Microsoft 365 Copilot or Copilot Chat.
- Review which sensitive information types and sensitivity labels really match your data.
- Start Copilot DLP rules in simulation or with a limited pilot group.
- Test external web search, sensitive prompts, labeled files, and external email scenarios separately.
- Document user messages, exceptions, rollback, and the four-hour policy propagation delay.
Official Microsoft sources
- Microsoft Learn: Microsoft Purview DLP for Microsoft 365 Copilot and Cowork
- Microsoft Learn: Create and deploy a data loss prevention policy
If you want to introduce Copilot safely or review existing controls, we connect Microsoft Security Copilot, Purview DLP, and a technical Microsoft Security Assessment into a controlled pilot with a clear boundary from legal assessment.
What does this mean for your environment?
Assess the topic in the context of your Microsoft 365 environment and define a practical next step.
You speak directly with Sebastian Kerssen – working in the Microsoft ecosystem since 2014, with personal consulting and a dedicated point of contact.
