Microsoft Copilot DLP
Microsoft Copilot
Copilot DLP depends on the experience.
Employee Copilot use can happen in a browser, desktop app or Microsoft 365 application. Compare controls for the specific surface and sensitive-data action.
An internal project update that should stay internal
Copilot browser prompt · synthetic project data
Turn Project Juniper / budget code JN-904 into a short update for an external audience.
Illustrated rule: block this internal-only project data on a supported submission path. A hard block has no continue action.
An illustration, not an installed-product test or a coverage guarantee.Account. Surface. Action.
- 01Account
- Identify the work, school or personal Microsoft account.
- 02Employee surface
- Separate Copilot Chat, Microsoft 365 in-app and native desktop use.
- 03Data action
- A submitted prompt and retrieval of work content need different tests.
Provider and existing-stack controls
Start with the controls you already have.
Microsoft documents Purview DLP controls for sensitive prompts, files, emails and web grounding in Microsoft 365 Copilot and Copilot Chat. Cloud-app controls in Edge for Business have separate scenarios and licensing. Identify the policy location before checking entitlement.
Provider documentation checked 20 September 2026. Availability and entitlement still need confirmation.
Make the outcome reviewable.
Get the acceptance checklist (PDF)- 01
Name the Copilot product, account and applicable Microsoft licence.
- 02
Separate sensitive prompt controls from file or email retrieval rules.
- 03
Test the additional installed-client action and the evidence you need.
The details that change the decision.
Which Copilot DLP licence do we need?
Start with the exact Microsoft product, policy location, device and app scenario. Microsoft's current documentation links the applicable licensing guidance. Copilot Studio and GitHub Copilot are not interchangeable with Microsoft 365 Copilot or Copilot Chat.
Can Purview protect sensitive prompts and work content?
Microsoft documents controls for sensitive prompts, web search grounding, files and emails in its Microsoft 365 Copilot and Copilot Chat location. Confirm conditions, supported content and licensing in that documentation before deciding whether another control is required.
Does this prove Aona blocks personal Copilot accounts?
No. Restricting account access is different from inspecting an employee's submitted content. Confirm Microsoft account and browser restrictions independently, then test Aona on the supported application and input path.
What about the native Copilot app?
Treat it as a separate endpoint path. Confirm the installed Aona release, provider route and action; neither an Edge test nor a Microsoft 365 in-app result establishes native-app feature parity.
What must be installed before an Aona evaluation?
The Aona browser plugin supports Chrome, Edge, Firefox and Safari. Confirm the intended browser, application and input path; browser support does not establish feature parity. IT teams can deploy the Aona endpoint app on Windows and macOS with their preferred software deployment tools. Intune is one option; direct installation is also available on both platforms.
Review Copilot coverage alongside your Microsoft controls.
Bring the Copilot experience, existing licences and one data-protection decision. We will focus on the additional test you need.
- Microsoft product and licence context
- Managed surface and data action
- Existing control, additional test and evidence