Microsoft 365 Copilot

1. 01
   1 of 2 matches were not blocked (Credit Card Number, Project Codename (custom)). Review which rules still run in audit mode and align them with the blocking rules.

   Purview DLP
2. 02
   High-impact information types were involved (Credit Card Number, Project Codename (custom)). Treat this as a data incident: confirm with the user what was pasted, and check the vendor's retention terms for the accounts involved.

   Purview DLP
3. 03
   Copilot prompts matched DLP policies. Extend the same sensitivity labels to Copilot with 'exclude from Copilot processing' where the label warrants it, and review oversharing with DSPM for AI.

   Purview DLP
4. 04
   Microsoft 365 Copilot is in use by 12 people across Word, PowerPoint, Excel, BizChat, Teams, Outlook. It respects existing permissions, so oversharing in SharePoint becomes AI-discoverable content. Run a permissions review with Restricted SharePoint Search or SharePoint Advanced Management.

   Audit log
5. 05
   Copilot surfaced 4 labeled resources. Confirm your sensitivity labels carry the Copilot exclusion where they should, and review Purview DSPM for AI.

   Audit log
6. 06
   Plugins in use: BingWebSearch. Web search and third-party plugins send prompts outside the tenant boundary; disable them in the Copilot admin settings if that is not intended.

   Audit log
7. 07
   Adoption is broad enough that outright blocking will disrupt work. Prefer a sanctioned alternative plus Conditional Access.

   Audit log

Trains on data

No

Enterprise tier

Available

Org policy

None set

Sanctioned in most tenants; tracked here so "all AI use" reporting includes it.

• Purview DLP◆High60
• Audit log◆High50

Each lane scores its own evidence. The combined score takes the strongest lane and adds five points per additional lane, capped at 100.