Skip to content
MitoMito Docs

MT.1175: DLP policy is configured for the Microsoft 365 Copilot location.
ID MT.1175
Severity High
Suite Mito
Product Purview
Feature Data loss prevention
Security area Data protection
Resource type Tenant
User impact of fixing Low
Effort to fix Medium
Framework controls nist-800-53-r5:SC-7(10) Boundary Protection | Prevent Exfiltration
MITRE ATT&CK T1213.002, T1530
Reads from Exchange Online, Microsoft Graph, Security & Compliance PowerShell
Licence needed EXCHANGE_DLP

What this checks and how to fix it

Section titled “What this checks and how to fix it”

Ensure a Microsoft Purview Data Loss Prevention (DLP) policy is configured for the Microsoft 365 Copilot location, so Copilot is blocked from summarising or surfacing files containing sensitive information types or labelled content the requesting user has access to but should not have AI summarise.

Microsoft 365 Copilot acts on every file, message and meeting that the requesting user can read. Without a DLP policy targeting the Copilot location, Copilot can:

  • Summarise files containing PII, PCI, PHI, secrets or other regulated data.
  • Paraphrase content from labelled documents in chat / Word / PowerPoint generations.
  • Expose oversharing risk in OneDrive / SharePoint at AI speed.

A DLP policy on the Copilot location lets you block Copilot interactions involving files that match SITs or have specific sensitivity labels — without disabling Copilot for the user entirely.

The test passes when at least one enabled, non-simulation DLP policy targets the Microsoft 365 Copilot location. Detection inspects multiple Purview schema fields (MicrosoftCopilotLocation, Workload, Locations, and EnforcementPlanes) so policies created through the older preview surface and through the current Microsoft Purview portal / PowerShell paths are both recognised.

Remediation action

Section titled “Remediation action”
  1. Open the Microsoft Purview portal — Data Loss Prevention — Policies.
  2. Click + Create policy and choose a Custom or template-based DLP policy.
  3. Under Locations, enable Microsoft 365 Copilot (you may also enable Exchange / SharePoint / OneDrive / Devices alongside).
  4. Configure rules — for example, match sensitive information types (Credit Card, SSN, customer-specific SITs) or sensitivity labels (Confidential, Highly Confidential).
  5. Choose actions — block Copilot from processing the matched file, notify the user, or generate an alert.
  6. Set Mode = Turn the policy on immediately (avoid leaving it in test/simulation mode for production protection).
  7. Verify with: Get-DlpCompliancePolicy | Where-Object { $_.MicrosoftCopilotLocation -or $_.Workload -match 'Copilot' -or ($_.Locations | Out-String) -match 'Copilot' -or ($_.EnforcementPlanes | Out-String) -match 'Copilot' }.
Section titled “Related links”

Mito check. Author: OfirGavish. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).

© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.