Forum Discussion
Microsoft 365 Copilot DLP – Inconsistent Enforcement Between PII, Financial and Technical SITs
Hi everyone,
I'm looking to understand whether anyone else has experienced inconsistent DLP enforcement when using Sensitive Information Types (SITs) to prevent Microsoft 365 Copilot from processing sensitive information entered directly into Copilot Chat prompts.
We've configured a Microsoft Purview DLP policy targeting the Microsoft 365 Copilot location, with the action Prevent Copilot from processing content – Processing prompts.
The policy is configured to detect built-in Microsoft Sensitive Information Types and prevent Copilot from processing prompts containing matching information.
However, during testing, we're observing inconsistent behaviour depending on the category of SIT being tested.
All test data has been independently validated against the corresponding Microsoft Purview Sensitive Information Types, confirming successful detection at the configured confidence levels.
Observed Behaviour:
- PII SITs: Copilot appears to process the information before responding that it cannot assist with the request.
- Financial SITs: Similar behaviour is observed, with Copilot appearing to recognise the sensitive information before declining to respond.
- Technical SITs: Copilot processes the information and provides a response without any apparent restriction, despite the information matching the technical SITs configured within the DLP policy.
This raises concerns about whether the responses we're seeing for PII and financial information are actually the result of DLP enforcement or Copilot's own built-in safeguards.
More importantly, technical SITs appear to be handled differently, with no apparent enforcement taking place.
Questions:
- Has anyone successfully validated SIT-based prompt blocking in Microsoft 365 Copilot Chat, particularly using technical SITs?
- Are there any known differences in enforcement behaviour between PII, financial and technical SITs?
- Does Copilot apply additional built-in safeguards to PII and financial information independently of Microsoft Purview DLP policies?
- Are there any known limitations affecting technical SIT detection or enforcement within Copilot Chat?
According to Microsoft 365 Roadmap ID 515945, the functionality for safeguarding Copilot prompts using SIT-based DLP policies is marked as launched and generally available.
However, Microsoft's documentation continues to reference preview availability and rollout considerations.
Any insight into whether this is expected behaviour, a known limitation or if I am just being silly at this point would be appreciated.
Thanks in advance.
2 Replies
krobinson2022
Copilot has its own built-in safeguards that recognise common sensitive patterns (think of card numbers, banking details, etc) and it's decline to respond after recognising the pattern is similar to when it refuses a request for an 'explosive' recipe (you know what I mean).That means the behaviour you're seeing with PII and financial SITs may well be Copilot's native guardrails rather than Purview enforcement.
Here's a few things I'd check to test your DLP enforcement in Purview:- Check Activity Explorer in the Purview portal for a DLP rule match at the Microsoft 365 Copilot location. If there's no match event for your PII and financial tests, those refusals came from Copilot itself, not your policy.
-
If it's a custom SIT, check the confidence level, instance count and primary element weighting, and test it directly with the SIT test tool in the Purview portal using your exact test strings. A SIT can validate in isolation but still never fire in a policy if the rule's confidence band or occurrence threshold doesn't line up.
As next steps, I'd retest with synthetic data pasted directly into the chat rather than uploaded files, record the exact SIT names, confidence levels, prompts, timestamps and responses, and cross-reference everything against Activity Explorer. If technical SITs still produce no DLP match events while PII and financial tests do, raise a support ticket with that evidence.
Your test data matches the configured SITs, but a refusal from Copilot alone cannot establish that Purview enforced the prompt-blocking rule. Microsoft documents separate actions for blocking prompt processing and blocking external web searches; the latter can still allow an internally grounded response. Check the enabled policy, user scope, rule conditions, confidence and occurrence thresholds, and the Processing prompts action. Retest with synthetic data pasted directly into the prompt, not uploaded in a file. Current documentation still describes prompt blocking as preview with tenant rollout, despite the announcement you referenced, so confirm availability with Microsoft support. The documentation does not describe a general PII-versus-financial-versus-technical enforcement distinction. Record the exact SIT names, prompts, policy configuration, timestamps, and observed responses for escalation. Do not submit real secrets during testing or treat an ordinary safety refusal as evidence that sensitive information was never processed.
