Forum Discussion

StephanGee's avatar
StephanGee
Steel Contributor
Nov 27, 2025

Sensitivity Labels and CoPilot - "No AI"

As a Purview Administrator, I recently received a request that might resonate with many of you: add a “No AI” designation to every sublabel we have. Why? Because our contracts and EULAs explicitly state that certain documents must not be used with AI tools.

This raises an important question: What’s the best way to implement this without creating unnecessary complexity?

The Challenge

If we simply append “NoAI” to every existing label and sublabel, we end up duplicating our entire labeling structure. For example, if you follow Microsoft’s guidance on default sensitivity labels and policies, doing this “times two” for every label and sublabel is clearly not scalable.

 

How do you deploy it?

 

Best regards

Stephan

2 Replies

  • Nadia-Fortini's avatar
    Nadia-Fortini
    Icon for Microsoft rankMicrosoft
    Apr 20, 2026

    HI StephanGee​ There are a few ways to handle this scenario:

    1. Grounding DLP based on labels: You can publish a policy that will exclude all knowledge sources (documents and emails) that are labeled with a specific label e.g. highly confidential. In this case Copilot processing will exclude these documents if the label matches the policy.
    2. Use SharePoint SAM capabilities:
      • RDC - Restricted Content discovery to hide SPO sites from Copilot grounding
      • RAC: Restrict access control to only allow users in approved security groups to access the site so only the owners/members will ever have access. Since Copilot only ground the data based on the user's permissions, it's a way to automatically protect sensitive info.

    Thank you,

    Nadia

  • David_C06's avatar
    David_C06
    Tin Contributor
    Dec 01, 2025

    Hello  .....I agree  on the fact that Sensitivity labels in Purview are designed for data protection and compliance enforcement, not as operational tags. Adding “No AI” to every label would create unnecessary complexity and dilute their core purpose.

    A better approach is to:

    • Use custom metadata or document properties (e.g., AIUsage = "No AI") in Office files.
    • Implement SharePoint/OneDrive columns or content types for AI-related flags.
    • Don t know if the approach to link metadata to DLP or governance policies is possible ?

    This keeps sensitivity labels focused on security while providing flexibility for contractual or operational needs.