Stopping Copilot Access to SharePoint Online Sites and Document Libraries

[TonyRedmond]

Two methods exist to exclude a SharePoint sites from Copilot being able to use its contents – you can exclude the site (or document library) from search results or use sensitivity labels. Given the choice, sensitivity labels are more flexible and powerful, but removing sites from search indexes is easier to implement.

https://office365itpros.com/2024/02/21/exclude-sharepoint-site-from-copilot/

[#2]

Hi Tony, while I appreciate your response on an issue that many customer worry about, I feel I must add either option is not truly viable for most organizations... well, what they want to achieve that is: Exclude (really) sensitive information from Copilot while letting everything else stay the same.

If you remove sites from search indexing it does hurt the ordinary way of finding documents as well (Microsoft Search), for everyone, even those that are the right people with access. Organization want to exclude it from Copilot, but most likely not from being found at all. Unfortunately there is no way to achieve either one separately, https://learn.microsoft.com/en-us/microsoftsearch/semantic-index-for-copilot#excluding-sharepoint-on...

Also leveraging sensitivity labels does not provide a solution to prevent Copilot from using the data through graph-grounding a prompt of the user who has access to that particular piece of data.

The right solution is the hardest one: Companies need to have a proper data governance in place to ensure data is managed effectively and securely.

A lot of my Copilot customers have concerns here. So while I support your 'removing sites from search indexes is easier to implement', it does have a significant drawback.

[#3]

@Michel-Ehlert 

The problem is that Microsoft doesn't have another way to exclude data from Copilot. Microsoft Search is the cornerstone for many features and is the all-encompassing index for Microsoft 365 data. If you want to exclude data from Copilot, which by definition will go searching for information to satisfy user prompts, then by definition you must exclude the sites from search results. To be fair to Microsoft, they have improved the situation recently by making sure that data in excluded sites is not blocked for Purview solutions like eDiscovery and DLP, which also rely on Microsoft Search.

As to sensitivity labels, the problem here is that Copilot is a new element dropped into the information protection mix that was unanticipated by those who designed the label deployment for organizations. This leads to predefined usage rights being assigned in labels that can result in inadvertent disclosure. For example. many labels include the right for anyone in an organization to read protected content. If this pattern of usage right assignment persists, then Copilot has free rein to access that content on behalf of the signed in user. 

Like anything else, it will take time for the community to understand all aspects of these scenarios and for Microsoft to improve their technology to make things work smoother/better/more securely. 

[#4]

Absolutely.

Fortunately many customers are already vocal on which improvements are needed.

[#5]

Well this will help a lot

Introducing Restricted SharePoint Search
As previously disclosed, Restricted SharePoint Search will start rolling out next month for customers with Copilot for Microsoft 365 licenses. Designed for organizations particularly concerned about unintentional oversharing of content, Restricted SharePoint Search allows you to disable organization-wide search and limit Copilot to selected SharePoint sites. This feature is intended as a temporary solution to give you time to review and audit site permissions while implementing robust data security with Microsoft Purview and manage content lifecycle with SharePoint Advanced Management. If you are interested in this feature, you can follow the status of the rollout on the public roadmap. https://techcommunity.microsoft.com/t5/copilot-for-microsoft-365/what-s-new-in-copilot-for-microsoft...

[#6]

I doubt it: https://office365itpros.com/2024/03/07/restricted-sharepoint-search/

[#7]

Can you prevent someones entire OneDrive from being indexed as well so it's excluded from CoPilot?

[#8]

I don't believe so. Even with restricted SharePoint search, the intention is that users always have access to their OneDrive. I took a look at the OneDrive settings (old site settngs) and don't see the same controls that exist to disable search results showing up from individual sites or document libraries. https://office365itpros.com/2024/02/21/exclude-sharepoint-site-from-copilot/

[#9]

@TonyRedmond we are soon releasing the ability for a sensitivity label to have copilot restricted permissions as a part of the access controls.

[#10]

You mean the block access to content service advanced setting for sensitivity labels? I have a Practical365.com article on the topic coming soon to explore what a label can do and what it cannot.

[#11]

Block Copilot Access to Individual Office Documents

A new sensitivity label setting blocks access to content services for Office applications. In effect, this stops any feature that depends on the ability to send content to Microsoft for processing, including Copilot for Microsoft 365, DLP, text prediction, and so on. It's a precise item-level block that protects sensitive documents from being consumed and used by Copilot in the text that it generates.

https://practical365.com/block-access-to-content-services/

[#12]

Thank you for your article!
I agree the hard needed controls are starting to get there, I don't think privacy officers will be fully content yet, but it's improving slow but steady I guess 😉

[#13]

@TonyRedmond I'm curious, with the SharePoint restricted search feature, you can still have CoPilot consume a doc if you explicitly reference it in CoPilot chat (per the thread here); but, if you try and reference a document on a site that's excluded from search/indexing via the method mentioned in your article, it doesn't work.  I wonder why the difference?  

[#14]

Restricted SharePoint Search stops Copilot being able to search for information outside the user's OneDrive and the 100 curated sites. But if a user explicitly references a document they can access, then Copilot can use it in a prompt. But if you try and find a document in a site that you have access to but can't search, Copilot can't find or use it.

[#15]

We recently asked Copilot if it was possible to block access to sites using sensitivity labels. The response we got included DLP as part of the solution. It looks like the solutions you presented are at the SPO setting level or the content label level. Does this response provide a third option?

+++++

To configure Copilot to exclude a site based on a sensitivity label, you’ll need to use Microsoft Information Protection (MIP) and set up the appropriate policies. Here’s a step-by-step guide to help you through the process:

1. Create Sensitivity Labels:
- Go to the Microsoft 365 compliance center.
- Navigate to Information protection under Solutions.
- Click on Labels and then Create a label.
- Define the label name, description, and settings (e.g., encryption, content marking).

2. Publish Sensitivity Labels:
- After creating the labels, go to Label policies.
- Click on Publish labels and select the labels you want to publish.
- Choose the users or groups to whom the labels should be available.

3. Configure Policies to Exclude Sites:
- In the compliance center, go to Information protection.
- Under Data loss prevention, create a new policy.
- Define the policy settings, including the conditions and actions.
- In the conditions, specify the sensitivity label that should trigger the exclusion.
- In the actions, configure the policy to block access to specific sites or content.

4. Apply the Policy:
- Ensure the policy is applied to the relevant users or groups.
- Test the policy to confirm that it correctly excludes access to the specified sites based on the sensitivity label.

By following these steps, you can effectively configure Copilot to exclude sites based on sensitivity labels.

[#16]

Do you believe everything Copilot says?

Copilot depends on enterprise search. If you exclude sites or document libraries from search results, Copilot can't access that information.

The only sensitivity label setting to block Copilot is for individual documents: https://practical365.com/block-access-to-content-services/ I don't understand the directions that you cite above. They seem like a lot of generated text: garbled

[#17]

No, I do not believe everything Copilot says, however the response got me thinking about the possibility. The response basically says to create a label, then create a DLP policy that blocks access to the site based on applied label.

I was not able to find any reference to using a combination of sensitivity labels and DLP policies to block Copilot from indexing SPO sites in my research, so before digging further I simply wanted to run the response by this thread in case my research wasn't turning up something obvious.