Can Microsoft 365 Copilot show users files they are not allowed to see?

No. Every Copilot prompt runs in the security context of the user, so Copilot only uses content that person can already open. The danger is that many people can open far more than they should, through sites shared with everyone, company-wide links or broken permissions. Copilot makes that existing oversharing easy to discover, which is why access clean-up comes first.

What is DSPM for AI in Microsoft Purview?

Data Security Posture Management for AI was Purview's dashboard for discovering, protecting and monitoring AI use, including Copilot. Microsoft now labels it DSPM for AI (classic) and offers a newer Data Security Posture Management with guided objectives, such as preventing data exposure in Copilot interactions and preventing oversharing. Both run data risk assessments that flag overshared SharePoint sites holding sensitive data.

Can I stop Copilot from using a confidential document?

Yes. Create a Purview DLP policy on the Microsoft 365 Copilot and Copilot Chat location with a condition for the sensitivity label, and the action to prevent Copilot from processing content. Copilot then will not use the content of labelled files or emails in its answers, although the item may still appear in citations. This control needs E5-level Purview licensing.

How do I stop staff typing NRIC numbers into Copilot?

Use a DLP policy on the Microsoft 365 Copilot and Copilot Chat location with the built-in Singapore NRIC number sensitive information type as the condition, and the action to prevent Copilot processing prompts. Copilot then refuses prompts containing a detected NRIC. This prompt control is in preview and rolling out, so confirm it has reached your tenant. Run it in simulation mode first with incident reports switched on, review the matches, then enforce it.

Do sensitivity labels with encryption stop Copilot working?

They can. When a label encrypts content, the user needs both the VIEW and EXTRACT usage rights for Copilot to return it. Permission levels such as Editor and Owner include EXTRACT, while restrictive ones such as Do Not Forward do not. Double Key Encryption content is never available to Copilot, so reserve it for data that genuinely must stay out of reach.

Microsoft Purview for Copilot: Getting Your Data Ready, Step by Step

Copilot can only show people content they already have permission to open, so the real risk is oversharing: sites and files that far too many people can reach. Microsoft Purview helps you find that exposure, label sensitive content, stop Copilot using labelled files or sensitive prompts through data loss prevention, and monitor AI activity. Fix access first, then roll Copilot out widely.

At a glance

The risk: Copilot respects permissions, so overshared content is the problem, not Copilot reaching past them
Find it: Data Security Posture Management (DSPM) data risk assessments and SharePoint Advanced Management, which is included with Copilot licences
Contain it: Restricted Content Discovery for sensitive sites while you fix them, and data loss prevention (DLP) for the Microsoft 365 Copilot and Copilot Chat location
Protect it: sensitivity labels; encrypted content needs the VIEW and EXTRACT usage rights before Copilot can use it
Prove it: audit, retention and eDiscovery for Copilot prompts and responses
Name check: the tool many guides call "DSPM for AI" now appears as DSPM for AI (classic), alongside a newer DSPM

Why oversharing is the real Copilot risk

Microsoft is clear that every Copilot prompt runs in the security context of the person asking. If you cannot open a file, Copilot cannot use it for you. That sounds reassuring until you look at how most Microsoft 365 tenants grew: team sites shared with "Everyone except external users", company-wide sharing links, folders with broken permission inheritance, sites whose owners left years ago.

Before Copilot, nobody stumbled on the forgotten salary spreadsheet because nobody searched for it. With Copilot, a reasonable question such as "summarise our pay review decisions" can surface it in seconds, for anyone who technically has access. Copilot did not break a rule; the permissions were already wrong.

In Singapore this is more than an IT tidy-up. Under the PDPA's Protection Obligation, organisations must make reasonable security arrangements to protect personal data in their possession against unauthorised access. Exposure of personal data may also bring the Data Breach Notification Obligation into play. This is general information, not legal advice, so involve your data protection officer early.

The tools, in plain words

Tool	What it does for Copilot readiness	Licence note
DSPM	Finds overshared sensitive data, runs data risk assessments, tracks AI activity	Advanced features in E5-level plans
SharePoint Advanced Management	Assessments, site access reviews, Restricted Content Discovery	Included with Copilot licences
Sensitivity labels	Classify and encrypt content; Copilot honours them	Manual labels in E3, auto-labelling in E5
DLP for Copilot	Blocks sensitive prompts, excludes labelled files and emails	Prompt protection for all Copilot users
Audit, retention, eDiscovery	Record, keep and search Copilot interactions	Varies by plan

Licensing changes often, so confirm against the Microsoft Purview service description before you plan. One detail worth knowing: DLP that safeguards prompts is available to all users of Copilot and Copilot Chat, while DLP that stops Copilot processing labelled files and emails needs Microsoft 365 E5 or an equivalent Purview add-on.

The newer Data Security Posture Management organises work into objectives such as "Prevent data exposure in Microsoft 365 Copilot and Microsoft Copilot interactions" and "Prevent oversharing of sensitive data", each with prioritised actions and one-click policies. By default, data risk assessments run weekly for the top 100 SharePoint sites by usage, and you can add custom assessments for specific sites, users or Fabric workspaces.

A staged plan

Microsoft's guide to configuring a secure and governed foundation for Copilot sets out three steps. Here they are as a practical plan.

Stage 1: find and fix oversharing

Assess. Review the DSPM data risk assessment for overshared sites holding sensitive data, and run the SharePoint Advanced Management Content Management Assessment to list sites with oversized audiences, "Everyone except external users" access, broken inheritance, or no active owner.
Contain. For the riskiest sites, switch on Restricted Content Discovery so they drop out of Copilot and organisation-wide search while you work, and add a DLP for Copilot rule to exclude the most sensitive labelled content.
Fix. Start site access reviews so owners remove excess members and company-wide links, correct broken inheritance and confirm an accountable owner. Apply site sensitivity labels where they fit.
Release. Remove the interim restrictions once access is right. Restricted Content Discovery is a bridge, not the fix.

Stage 2: set guardrails so it does not happen again

Secure defaults. Restrict "Anyone" links and company-wide sharing groups at tenant level, require a sensitivity label when sites are created, and use Restricted Access Control for business-critical sites.
Labels people understand. Keep the taxonomy short, for example Public, Internal, Confidential and Highly Confidential, and set a default label so nothing stays unlabelled.
DLP for Copilot. Create policies on the Microsoft 365 Copilot and Copilot Chat location with three patterns, keeping sensitive information type conditions and label conditions in separate rules:
- block prompts that contain chosen sensitive information types (a preview feature still rolling out to tenants as of October 2026);
- stop Copilot using web search when a prompt contains them;
- exclude files and emails with your highest labels from Copilot processing.
Simulate first. Microsoft now provides a default policy, Protect sensitive M365 Copilot interactions, that starts in simulation mode and only logs matches. Turn on incident reports, review what it catches, then switch to enforcement.

Stage 3: monitor and meet your obligations

Watch activity. Use DSPM's activity explorer to review Copilot prompts, responses and the sensitive information detected in them.
Decide retention. Set how long to keep audit logs and Copilot interactions, and make sure eDiscovery can find them if you face a complaint or legal request.
Keep data clean. Apply inactive site policies, archive stale content and use retention policies to delete what you no longer need. Less clutter means safer and better answers.

How sensitivity labels and Copilot interact

Three rules from Microsoft's Copilot considerations for Purview prevent most surprises:

EXTRACT matters. When a label applies encryption, the user needs both VIEW and EXTRACT (shown as "Copy and extract content") for Copilot to return the content. Permission levels such as Editor and Owner include it; read-only "Do Not Forward" style permissions do not.
New content inherits the label. When Copilot creates content from labelled sources, the highest-priority label is applied to the new item where supported.
Some protections block Copilot entirely. Double Key Encryption content is not available to Copilot, and labels with user-defined permissions stop agents reading files. Labels that protect Teams meetings and chats are not yet recognised by Copilot, so do not rely on them alone.

A common mistake is to encrypt everything as Highly Confidential without EXTRACT. Copilot then cannot help with any of it, users lose faith in the rollout, and people are tempted to paste content into personal AI tools instead, which is worse.

Singapore specifics: NRIC and other local data

Purview ships with sensitive information types for Singapore, including the Singapore NRIC number, passport number, driver's licence number and physical addresses. The NRIC type looks for nine characters, a leading F, G, M, S or T, seven digits and a check letter, validates the checksum and raises confidence when keywords such as "NRIC", "FIN" or "身份证" appear nearby.

A good first rule for a Singapore tenant:

Condition: content contains Singapore NRIC number (high confidence), plus any custom types for staff or customer IDs.
Action: prevent Copilot from processing content, processing prompts (check that this preview control has reached your tenant).
Mode: simulation for two weeks with incident reports to your security team, then enforce.

Copilot is not the only place staff paste data. Purview Endpoint DLP can warn or block users who paste sensitive content into third-party generative AI websites in the browser on onboarded Windows devices, which closes the gap our comparison of Claude, Copilot and ChatGPT warns about. If you are also building a customer-facing bot, see our PDPA checklist for AI chatbots.

Who does this work, and what to learn

This is a joint effort. SharePoint administrators run the assessments and access reviews, site owners do the clean-up, and an information security administrator designs labels, DLP and monitoring. The SC-401 exam is built for that last role. Its skills measured from 28 October 2026 span information protection, DLP and retention, and controls for content in environments that use AI services, including DSPM for AI. For administrators new to Copilot, AB-900 covers Copilot's data access, oversharing in SharePoint and the Purview tools at fundamentals level.

How CertTulen Academy can help

CertTulen Academy is a Microsoft Training Services Partner running live, MCT-led online classes with hands-on labs. Security and compliance teams can prepare with Information Security Administrator Associate (SC-401), which covers labels, DLP and Purview for AI workloads. Microsoft 365 administrators starting with Copilot can begin with Copilot and Agent Administration Fundamentals (AB-900). Contact us or WhatsApp +60 16-241 8686 to arrange a private cohort or a batch that suits Singapore time.