Microsoft 365 Copilot DLP – Inconsistent Enforcement Between PII, Financial and Technical SITs

Your test data matches the configured SITs, but a refusal from Copilot alone cannot establish that Purview enforced the prompt-blocking rule. Microsoft documents separate actions for blocking prompt processing and blocking external web searches; the latter can still allow an internally grounded response. Check the enabled policy, user scope, rule conditions, confidence and occurrence thresholds, and the Processing prompts action. Retest with synthetic data pasted directly into the prompt, not uploaded in a file. Current documentation still describes prompt blocking as preview with tenant rollout, despite the announcement you referenced, so confirm availability with Microsoft support. The documentation does not describe a general PII-versus-financial-versus-technical enforcement distinction. Record the exact SIT names, prompts, policy configuration, timestamps, and observed responses for escalation. Do not submit real secrets during testing or treat an ordinary safety refusal as evidence that sensitive information was never processed.