MC1301714 - Microsoft Purview | Data Loss Prevention- DLP to restrict processing external emails in M365 Copilot and Copilot Chat

Introduction

We’re expanding Microsoft Purview Data Loss Prevention (DLP) controls for Microsoft 365 Copilot and Copilot Chat to help organizations reduce the risk of untrusted or externally sourced content influencing AI‑generated responses. This new capability allows admins to exclude emails from external senders from being used as grounding data during Copilot prompt processing. When enabled, Copilot continues to generate responses using trusted internal Microsoft 365 data sources, subject to existing licensing and policy controls.

This message is associated with Microsoft 365 Roadmap ID 548671.

When this will happen

Public preview: We will begin rolling out in early June 2026 and expect to complete by late June 2026.
General availability (Worldwide): We will begin rolling out in late July 2026 and expect to complete by late August 2026.

How this affects your organization

Who is affected

Organizations using Microsoft 365 Copilot (Premium) or Copilot Chat
Admins managing AI governance, security, and data protection using Microsoft Purview

What will happen

A new DLP policy control will be available for Microsoft 365 Copilot and Copilot Chat.
When enabled by an admin:
Emails sent from external or untrusted domains are excluded from being:
- Referenced
- Summarized
- Used as grounding data by Copilot
Copilot continues to generate responses using trusted internal Microsoft 365 data sources (for example, SharePoint, OneDrive, and internal Exchange content), subject to existing licensing and policy.

This change does not:

Affect email delivery, retention, eDiscovery, or user access
Change existing Copilot interaction behavior unless the policy is explicitly configured

Default state:

Off by default.
There is no change unless an admin enables this control in Microsoft Purview.

Screenshot 1. Select Microsoft 365 Copilot and Copilot Chat as the DLP policy location:

Screenshot 2. New DLP setting to restrict processing of external email content:

What you can do to prepare

No action is required if you do not plan to use this capability.

If you want to enable the feature:

Create or update a DLP policy for Microsoft 365 Copilot in the Microsoft Purview portal.
Review existing DLP configurations to understand potential Copilot impact.
Ensure your admin account has the required DLP and Purview roles.
Inform IT, security, and helpdesk teams about the new control.
Update internal documentation related to AI governance and Copilot usage.

Learn more:

Compliance considerations

Question	Answer
Does the change alter how existing customer data is processed?	Yes. External email content is excluded from Copilot grounding when the policy is enabled; underlying email storage, access, and retention are unchanged.
Does the change introduce or modify AI/ML capabilities interacting with customer data?	Yes. Copilot grounding logic is updated to respect a new DLP exclusion for external email content.
Does the change modify Purview DLP enforcement?	Yes. Adds a new DLP control scoped specifically to Copilot and Copilot Chat grounding behavior.
Does the change include an admin control?	Yes. The feature is controlled via Microsoft Purview DLP policies and is admin-configurable.