Microsoft Copilot Studio: Support for sensitive documents protected with Microsoft Purview Information Protection (MPIP)

🚨 The Signal: Copilot Studio agents can now process Purview-protected sensitive documents, enforcing label protections end-to-end. This enables secure AI agent interaction with classified data, but requires careful governance.

The Impact

All users interacting with Copilot Studio agents are affected, with a risk of unintended data exposure if Purview policies are not robust.

• End-users: Risk of over-sharing sensitive data if agent permissions are too broad.
• Security Teams: Need to validate Purview label enforcement within Copilot Studio.
• Data Owners: Must ensure existing labels adequately protect data used by agents.
• Admins: Requires configuration review of Copilot Studio agent access to sensitive data.

The Action

1. Review existing Microsoft Purview Information Protection (MPIP) sensitivity labels and policies for Copilot Studio integration.
2. Validate that Copilot Studio agents are correctly inheriting and enforcing MPIP labels based on user/agent permissions.
3. Implement or update data loss prevention (DLP) policies to monitor Copilot Studio interactions with sensitive data.
4. Conduct user training on appropriate use of Copilot Studio agents with sensitive information.
5. Regularly audit Copilot Studio agent access logs and data interactions for compliance.

Domain: Agentic-AI · Impact: high · Workload: Microsoft Purview