MS Purview DLP: Web search blocking also blocks Copilot response
Hello everyone, I am currently testing a Microsoft Purview DLP policy for Microsoft 365 Copilot that is intended to prevent personal or sensitive information contained in a Copilot prompt from being used for a web search. When a user enters a prompt containing specific Sensitive Information Types (SITs), only the web search should be blocked. Copilot should still process the prompt and, if possible, provide a response without using web search or sending the detected sensitive information to the web search service. Configuration In Microsoft Purview, I only have the following actions available: Processing of prompts → Block Performing web searches → Block I tested both options separately. Behavior with “Processing prompts → Block” This works as expected: As soon as a configured SIT is detected in the prompt, processing is blocked immediately and Copilot displays a corresponding policy notification. Behavior with “Performing web searches → Block” I observe the following behavior: I send a prompt to Copilot that contains a SIT covered by the DLP policy. Copilot initially generates a normal response. In this response, Copilot indicates that the personal information was not used for the web search. However, the actual question is still answered. This response remains visible for approximately 1–2 seconds. The entire Copilot response then disappears. Instead, the following message is displayed: “Due to your organization’s policies, none of the requested files or resources are available.” The previously generated response, which was briefly visible, can no longer be accessed afterwards. Expected behavior Since I would like to use “Performing web searches → Block” in the DLP policy, I would expect that: the web search is blocked, sensitive information is not used for the web search, Copilot can still process the prompt, and the response generated by Copilot remains visible. Question Is this behavior expected when using the DLP action “Performing web searches → Block”? In particular, I would like to understand why Copilot initially generates and displays a response without using the sensitive information for the web search, but then completely removes this response a few seconds later and replaces it with the policy notification. Is it possible to configure additional actions in the DLP policy, or to select an option other than “Block”? I only have the two actions mentioned above available. I have attached the relevant screenshots. Please note that the attached screenshots are in German. Thank you in advance!
I just want to secure AI. DLP vs Info Protection vs DSPM vs Governance vs...
I'm with an MSP, and I've avoided Purview like the plague, because it seems to be suffering from the same 'made by marketing teams' 'strategy' the 365 documentation is. However, it's my understanding Purview policies are needed for Data control of Copilot. Here's my issue: all of these different 'solutions' sound like the exact same thing, but are pitched as if they are something different. i'm going to post a couple of descriptions for these 'solutions' to illustrate this. 'discover, label, and protect sensitive and business-critical info' 'make sure your organization can identify, monitor, and protect sensitive info across the expanding Microsoft 365 landscape' 'discover and secure all your sensitive data across Microsoft 365 and non-365 data sources' 'Discover, label, and protect sensitive and business-critical info across your multicloud data estate.' I genuinely do not have time to figure out what each of these 'solutions' are, then figure out their policies, then their giant library of settings (below)... It's not even clear to me what's active NOW, considering we never licensed Purview - but somehow have been roped into it. It SEEMS like these are all variations of marketing terms, which all point to 3-4 actual technical implementations in obscure ways. Can someone advise on the ACTUAL technical policies we want to target and enable? Or just give some clarity? I've never felt so overwhelmed or disconnected from Microsoft's environment. We just want to secure our tenant's AI usage.
