Microsoft Adds Data Controls for Copilot AI
Microsoft is expanding its data loss prevention (DLP) controls for the Copilot AI assistant, enabling organizations to block the AI from processing files in specific storage locations. This move addresses enterprise concerns over data security and is likely to become a standard feature as AI agent adoption grows.
- The expanded protection will apply to Word, Excel, and PowerPoint files regardless of their location, including local device storage and other cloud providers, not just SharePoint and OneDrive. - This enhancement is powered by an internal Office component called the "Augmentation Loop" (AugLoop), which allows the Office client to communicate a file's sensitivity label directly to the service, ensuring consistent policy enforcement everywhere. - The system uses Microsoft Purview sensitivity labels to function; administrators set Data Loss Prevention (DLP) policies to restrict Copilot from processing any content tagged with specific labels, such as "Highly Confidential." - Rollout for this expanded storage location coverage is set to begin in late March 2026 and is expected to be complete for all users by the end of April 2026. - This update requires no changes to existing DLP policies for enforcement to extend to the new locations, as the capability is being enabled automatically for tenants with relevant rules already configured. - Microsoft is also using DLP policies to prevent users from entering sensitive data directly into Copilot prompts, which can block the AI from returning a response or using the data for searches. - The move follows a previous "code issue" where Copilot Chat was found to be summarizing emails protected by DLP policies, highlighting the critical need for robust, consistent data controls in enterprise AI. - These controls are part of a broader strategy to address enterprise AI security risks, such as "Shadow IT" where employees use unauthorized AI tools, and to help organizations in regulated industries adopt AI with greater confidence.
