MC1301714 - Microsoft Purview | Data Loss Prevention- DLP to restrict processing external emails in M365 Copilot and Copilot Chat

Updated June 24,July 17, 2026: We have updated the timeline. Thank you for your patience.

Introduction

We’re We are expanding Microsoft Purview Data Loss Prevention (DLP) controlsDLP for Microsoft 365 Copilot and Copilot Chat to help organizations reduce the risk of untrusted or externally sourced content influencing AI‑generated responses. This new capability allows admins to exclude emailssafeguard risks from external senders from being used as groundingemails. This real-time control helps organizations mitigate data during Copilot prompt processing. When enabled, Copilot continues to generate responses using trusted internalrisks by preventing Microsoft 365 data sources, subjectCopilot and Chat from processing emails from senders external to existing licensing and policy controls.your organization.

This message is associated with Microsoft 365 Roadmap ID 561552.

When this will happen

1. Public preview: We will begin rolling out in early June 2026 and expect to complete by late June 2026.
2. General availability (Worldwide): We will begin rolling out in late January 2027 (previously late July) and expect to complete by late February 2027 (previously late August).

How this affects your organization

Who is affected

1. Organizations using Microsoft 365 Copilot (Premium) or Copilot Chat
2. Admins managing AI governance, security, and data protection using Microsoft Purview

What will happen

1. A new DLP policy control will be available for Microsoft 365 Copilot and Copilot Chat.
2. When enabled by an admin:
3. Emails sent from external or untrusted domains are excluded from being:
   • Referenced
   • Summarized
   • Used as grounding data by Copilot
4. Copilot continues to generate responses using trusted internal Microsoft 365 data sources (for example, SharePoint, OneDrive, and internal Exchange content), subject to existing licensing and policy.

This change does not:

1. Affect email delivery, retention, eDiscovery, or user access
2. Change existing Copilot interaction behavior unless the policy is explicitly configured

Default state:

1. Off by default.
2. There is no change unless an admin enables this control in Microsoft Purview.

Screenshot 1. Select Microsoft 365 Copilot and Copilot Chat as the DLP policy location:

Screenshot 2. New DLP setting to restrict processing of external email content:

What you can do to prepare

No action is required if you do not plan to use this capability.

If you want to enable the feature:

1. Create or update a DLP policy for Microsoft 365 Copilot in the Microsoft Purview portal.
2. Review existing DLP configurations to understand potential Copilot impact.
3. Ensure your admin account has the required DLP and Purview roles.
4. Inform IT, security, and helpdesk teams about the new control.
5. Update internal documentation related to AI governance and Copilot usage.

Learn more:

1. Learn about data loss prevention | Microsoft Purview | Microsoft Learn
2. Learn about using Microsoft Purview Data Loss Prevention to protect interactions with Microsoft 365 Copilot and Copilot Chat | Microsoft Purview | Microsoft Learn
3. Permissions - Create and deploy data loss prevention policies | Microsoft Purview | Microsoft Learn

Compliance considerations