Considerations for Microsoft Purview AI Hub and data security and compliance protections for Microsoft Copilot

Microsoft 365 licensing guidance for security & compliance

When you understand how you can use Microsoft Purview AI Hub and other capabilities to manage data security and compliance protections for Copilot for Microsoft 365, use the following detailed information for any prerequisites, considerations, and exemptions that might apply to your organization. For Microsoft Copilot, be sure to read these in conjunction with Microsoft Copilot for Microsoft 365 requirements.

For licensing information to use these capabilities for Copilot, see the licensing and service description links at the top of the page. For licensing information for Copilot, see the service description for Microsoft Copilot for Microsoft 365.

AI Hub prerequisites and considerations

For the most part, the AI hub is easy-to-easy to use and self-explanatory, guiding you through prerequisites and preconfigured reports and policies. Use this section to complement that information and provide additional details that you might need.

Prerequisites for the AI hub

To use the AI hub from the Microsoft Purview portal or the Microsoft Purview compliance portal, you must have the following prerequisites:

• You have the right permissions.

• Required for monitoring interactions with Copilot for Microsoft 365:

  • Users are assigned a license for Microsoft Copilot for Microsoft 365.

  • Microsoft Purview auditing is enabled for your organization. Although this is the default, you might want to check the instructions for Turn auditing on or off.

• Required for monitoring interactions with third-party generative AI sites:

  • Devices are onboarded to Microsoft Purview, required for:

    • Gaining visibility into sensitive information that's shared with third-party generative AI sites. For example, a user pastes credit card numbers into ChatGPT.
    • Applying endpoint DLP policies to warn or block users from sharing sensitive information with third-party generative AI sites. For example, a user identified as elevated risk in adaptive protection is blocked with the option to override when they paste credit card numbers into ChatGPT.

  • The Microsoft Purview browser extension is deployed to users and required to discover site visits to third-party generative AI sites.

You'll find more information about the prerequisites for auditing, device onboarding, and the browser extension in the AI hub itself: Navigate to Analytics > Get started section.

For a list of currently supported third-party AI apps, see Supported AI sites by Microsoft Purview for data security and compliance protections.

Permissions for the AI hub

Members of your security and compliance teams who are responsible for managing AI apps need permissions to the AI hub when they sign in to the Microsoft Purview portal or sign in to Microsoft Purview compliance portal.

To help you assign the right permissions to users, use the following guidance, depending on the portal you're using:

• Permissions in the Microsoft Purview portal
• Permissions in the Microsoft Purview compliance portal
• Assign Microsoft Entra roles to users

One-click policies from the AI hub

After the default policies are created, you can view and edit them at any time from their respective solution areas in the portal. For example, you want to scope the policies to specific users during testing, or for business requirements. Use the Policies page to quickly navigate to the right place in the portal.

Default policies for data discovery for AI

• DLP policy: Microsoft AI hub - Discover sensitive prompts in AI assistants

  This policy discovers sensitive content being pasted or upload into Edge, Chrome, and Firefox to other AI assistants. This policy covers all users and groups in your org in audit mode only.

• Insider risk management policy: Microsoft AI hub - Browsing in AI assistants

  This policy creates an insider risk management policy to detect when users use the browser to visit other AI assistants.

Default policies from data security to help you protect sensitive data used in generative AI

• DLP policy Microsoft AI hub - Adaptive Protection in AI assistants

  This policy uses Adaptive Protection to give a warn-with-override to elevated risk users attempting to paste or upload sensitive information to other AI assistants in Edge, Chrome, and Firefox. This policy covers all users and groups in your org in test mode.

  Adaptive Protection is turned on if it's not already on, using default risk levels for all users and groups to dynamically enforce protection actions. For more information, see Quick setup.

• Information Protection

  This option creates default sensitivity labels and sensitivity label policies.

  If you've already configured sensitivity labels and their policies, this configuration is skipped.

Activity explorer events

Use the following information to help you understand the events you might see in the AI hub activity explorer. References to a generative AI site can include Microsoft Copilot and third-party AI sites.

Known issues for the preview:

• The Classification stamped event doesn't display the user risk level
• The DLP rule match and AI visit events don't display the workload
• The DLP rule match events for paste to browser display in the Analytics page but not in activity explorer.
• The AI visit event doesn't scope to just generative AI sites but displays all sites.

Information protection considerations for Copilot

Microsoft Copilot for Microsoft 365 has the capability to access data stored within your Microsoft 365 tenant, including mailboxes in Exchange Online and documents in SharePoint or OneDrive.

In addition to accessing Microsoft 365 content, Copilot can also use content from the specific file you're working on in the context of an Office app session, regardless of where that file is stored. For example, local storage, network shares, cloud storage, or a USB stick. When files are open by a user within an app, access is often referred to as data in use.

Before you deploy Copilot for Microsoft 365, make sure you're familiar with the following details that help you strengthen your data protection solutions:

• If a user has encrypted content open in an app and the content grants the user VIEW usage rights but not EXTRACT, they won't be able to use Copilot.

• Just like your Office apps, Copilot for Microsoft 365 can access sensitivity labels from your organization, but not other organizations. For more information about labeling support across organizations, see Support for external users and labeled content.

• Until SharePoint and OneDrive support search for data at rest that's labeled and encrypted with user-defined permissions, Copilot won't be able to access these documents. Copilot can access documents that are encrypted with user-defined permissions when they're open in the app (data in use).

• Sensitivity labels that are applied to groups and sites (also known as "container labels") aren't inherited by items in those containers. As a result, the items won't display their container label in Copilot and can't support sensitivity label inheritance. For example, Teams channel chat messages that are summarized from a team that's labeled as Confidential won't display that label for sensitivity context in Microsoft Copilot Graph-grounded chat. Similarly, content from SharePoint site pages and lists won't display the sensitivity label of their container label.

• If you're using SharePoint information rights management (IRM) library settings that restrict users from copying text, be aware that usage rights are applied when files are downloaded, and not when they're created or uploaded to SharePoint. If you don't want Copilot to summarize these files when they're at rest, use sensitivity labels that apply encryption without the EXTRACT usage right.

• Unlike other automatic labeling scenarios, an inherited label when you create new content will replace a lower priority label that was manually applied.

• When an inherited sensitivity label can't be applied, the text won't be added to the destination item. For example:

  • The destination item is read-only
  • The destination item is already encrypted and the user doesn't have permissions to change the label (requires EXPORT or FULL CONTROL usage rights)
  • The inherited sensitivity label isn't published to the user

• If a user asks Copilot to create new content from labeled and encrypted items, label inheritance isn't supported when the encryption is configured for user-defined permissions or if the encryption was applied independently from the label. The user won't be able to send this data to the destination item.

• Because Double Key Encryption (DKE) is intended for your most sensitive data that is subject to the strictest protection requirements, Copilot can't access this data. As a result, items protected by DKE won't be returned by Copilot, and if a DKE item is open (data in use), you won't be able to use Copilot in the app.

• Sensitivity labels that protect Teams meetings and chat aren't currently recognized by Copilot. For example, data returned from a meeting chat or channel chat won't display an associated sensitivity label, copying chat data can't be prevented for a destination item, and the sensitivity label can't be inherited. This limitation doesn't apply to meeting invites, responses, and calendar events that are protected by sensitivity labels.

• For Microsoft Copilot Graph-grounded chat (formerly known as Microsoft 365 Chat):

  • When meeting invites have a sensitivity label applied, the label is applied to the body of the meeting invite but not to the metadata, such as date and time, or recipients. As a result, questions based just on the metadata return data without the label. For example, "What meetings do I have on Monday?" Questions that include the meeting body, such as the agenda, return the data as labeled.
  • If content is encrypted independently from its applied sensitivity label, and that encryption doesn't grant the user EXTRACT usage rights (but includes the VIEW usage right), the content can be returned by Copilot and therefore sent to a source item. An example of when this configuration can occur if a user has applied Office restrictions from Information Rights Management when a document is labeled "General" and that label doesn't apply encryption.
  • When the returned content has a sensitivity label applied, users won't see the Edit in Outlook option because this feature isn't currently supported for labeled data.
  • If you're using the extension capabilities that include plugins and the Microsoft Graph Connector, sensitivity labels and encryption that are applied to this data from external sources aren't recognized by Copilot Graph-grounded chat. Most of the time this limitation won't apply because the data is unlikely to support sensitivity labels and encryption, although one exception is Power BI data. You can always disconnect the external data sources by using the Microsoft 365 admin center to turn off those plugins for users, and disconnect connections that use a Graph API connector.

App-specific exceptions:

• Copilot in PowerPoint: Copilot can't create a presentation from an encrypted file.

• Copilot in Outlook: When emails are encrypted, users won't be able to use Copilot for those items.

• Copilot in Edge, Copilot in Windows: Unless data loss prevention (DLP) is used in Edge, Copilot can reference encrypted content from the active browser tab in Edge when that content doesn't grant the user EXTRACT usage rights. For example, the encrypted content is from Office for the web or Outlook for the web.

Will an existing label be overridden for sensitivity label inheritance?

Summary of outcomes when Copilot automatically applies protection with sensitivity label inheritance:

Copilot honors existing protection with the EXTRACT usage right

Although you might not be very familiar with the individual usage rights for encrypted content, they've been around a long time. From Windows Server Rights Management, to Active Directory Rights Management, to the cloud version that became Azure Information Protection with the Azure Rights Management service.

If you've ever received a "Do Not Forward" email, it's using usage rights to prevent you from forwarding the email after you've been authenticated. As with other bundled usage rights that map to common business scenarios, a Do Not Forward email grants the recipient usage rights that control what they can do with the content, and it doesn't include the FORWARD usage right. In addition to not forwarding, you can't print this Do Not Forward email, or copy text from it.

The usage right that grants permission to copy text is EXTRACT, with the more user-friendly, common name of Copy. It's this usage right that determines whether Copilot for Microsoft 365 can display text to the user from encrypted content.

When you use the Microsoft Purview compliance portal to configure a sensitivity label to apply encryption, the first choice is whether to assign the permissions now, or let users assign the permissions. If you assign now, you configure the permissions by either selecting a predefined permission level with a preset group of usage rights, such as Co-Author or Reviewer. Or, you can select custom permissions where you can individually select available usage rights.

In the Microsoft Purview compliance portal, the EXTRACT usage right is displayed as Copy and extract content(EXTRACT). For example, the default permission level selected is Co-Author, where you see Copy and extract content(EXTRACT) is included. As a result, content protected with this encryption configuration can be returned by Copilot for Microsoft 365:

If you select Custom from the dropdown box, and then Full control(OWNER) from the list, this configuration will also grant the EXTRACT usage right.

Alternatively, if you select the encryption configuration to let users assign permissions, for Outlook, this configuration includes predefined permissions for Do Not Forward and Encrypt-Only. The Encrypt-Only option, unlike Do Not Forward, does include the EXTRACT usage right.

When you select custom permissions for Word, Excel, and PowerPoint, users select their own permissions in the Office app when they apply the sensitivity label. They're informed that from the two selections, Read doesn't include the permission to copy content, but Change does. These references to copy refer to the EXTRACT usage right. If the user selects More Options, they can add the EXTRACT usage right to Read by selecting Allow users with read access to copy content.

Copilot honors the EXTRACT usage right for a user, however it was applied to the content. Most times, when the content is labeled, the usage rights granted to the user match those from the sensitivity label configuration. However, there are some situations that can result in the content's usage rights being different from the applied label configuration:

• The sensitivity label is applied after usage rights are already applied
• Usage rights are applied after a sensitivity label has been applied

For more information about configuring a sensitivity label for encryption, see Restrict access to content by using sensitivity labels to apply encryption.

For technical details about the usage rights, see Configure usage rights for Azure Information Protection.

Compliance management considerations for Copilot

Compliance management for Copilot for Microsoft 365 interactions extends across Copilot in Word, Excel, PowerPoint, Outlook, Teams, Loop, Whiteboard, OneNote, and Microsoft Copilot Graph-grounded chat (formerly Microsoft 365 Chat).

Compliance tools identify the source Copilot interactions by the name of the app. For example, Copilot in Word, Copilot in Teams, and Microsoft 365 Chat (for Microsoft Copilot Graph-grounded chat).

Before you deploy Copilot for Microsoft 365, make sure you're familiar with the following details to support your compliance management solutions:

• Retention policies for Copilot interactions don't currently inform users when messages are deleted as a result of a retention policy.

• Auditing captures the Copilot activity of search, but not the actual user prompt or response. For this information, use eDiscovery.

• Admin-related changes for auditing Copilot aren't yet supported.

• Device identify information isn't currently included in the audit details.

App-specific exceptions:

• Copilot in Teams:
  • If transcripts are turned off, the capabilities for auditing, eDiscovery, and retention aren't supported
  • If transcripts are referenced, this action isn't captured for auditing
  • For Graph-grounded chat in Teams, Copilot currently can't retain as cloud attachments, referenced files that it returns to users. Files referenced by users are supported to be retained as cloud attachments.