Microsoft 365 Copilot DLP – Inconsistent Enforcement Between PII, Financial and Technical SITs

krobinson2022​ 

Copilot has its own built-in safeguards that recognise common sensitive patterns (think of card numbers, banking details, etc) and it's decline to respond after recognising the pattern is similar to when it refuses a request for an 'explosive' recipe (you know what I mean). 

That means the behaviour you're seeing with PII and financial SITs may well be Copilot's native guardrails rather than Purview enforcement.

Here's a few things I'd check to test your DLP enforcement in Purview:

1. Check Activity Explorer in the Purview portal for a DLP rule match at the Microsoft 365 Copilot location. If there's no match event for your PII and financial tests, those refusals came from Copilot itself, not your policy.

2. If it's a custom SIT, check the confidence level, instance count and primary element weighting, and test it directly with the SIT test tool in the Purview portal using your exact test strings. A SIT can validate in isolation but still never fire in a policy if the rule's confidence band or occurrence threshold doesn't line up.

As next steps, I'd retest with synthetic data pasted directly into the chat rather than uploaded files, record the exact SIT names, confidence levels, prompts, timestamps and responses, and cross-reference everything against Activity Explorer. If technical SITs still produce no DLP match events while PII and financial tests do, raise a support ticket with that evidence.