Microsoft 365 Copilot: sensitive data

1. 011 of 2 matches were not blocked (Credit Card Number, Project Codename (custom)). Review which rules still run in audit mode and align them with the blocking rules.
2. 02High-impact information types were involved (Credit Card Number, Project Codename (custom)). Treat this as a data incident: confirm with the user what was pasted, and check the vendor's retention terms for the accounts involved.
3. 03Copilot prompts matched DLP policies. Extend the same sensitivity labels to Copilot with 'exclude from Copilot processing' where the label warrants it, and review oversharing with DSPM for AI.

• ◆High50Microsoft 365 CopilotAudit log12 people

Identifiers come from device telemetry and proxy logs, so they may be account names rather than full directory entries.

1. dlp_activity · Sep 11, 2026
   2 DLP events for Microsoft 365 Copilot by 2 people in 30 days: 1 blocked, 0 warned, 0 overridden, 1 audit only; types: Credit Card Number, Project Codename (custom)
   Detail

   {
     "domains": [],
     "byAction": {
       "warn": 0,
       "audit": 1,
       "block": 1,
       "unknown": 0,
       "override": 0
     },
     "policies": [
       {
         "name": "DLP for Copilot - Confidential",
         "count": 1
       },
       {
         "name": "DLP for Copilot - Financial",
         "count": 1
       }
     ],
     "applications": [],
     "sensitiveTypes": [
       {
         "name": "Credit Card Number",
         "count": 1,
         "matches": 5
       },
       {
         "name": "Project Codename (custom)",
         "count": 1,
         "matches": 2
       }
     ]
   }

2. dlp_audit · Sep 11, 2026
   DlpRuleMatch by [email protected]: Credit Card Number ×5 (audit)
   Detail

   {
     "policies": [
       "DLP for Copilot - Financial"
     ],
     "recordId": "ual-0111",
     "application": null
   }

3. dlp_block · Sep 7, 2026
   DlpRuleMatch by [email protected]: Project Codename (custom) ×2 (block)
   Detail

   {
     "policies": [
       "DLP for Copilot - Confidential"
     ],
     "recordId": "ual-0110",
     "application": null
   }

4. corroboration
   Also found by another lane (ual:copilot:m365)
   Detail

   {
     "findingKey": "ual:copilot:m365"
   }