Using Sensitivity Labels to Restrict Microsoft 365 Copilot Access

SC-401 By islever Editorial Last updated

Implement and manage sensitivity labels in Microsoft Purview

Short answer

D Use sensitivity labels to classify and encrypt files in Channel1, blocking Copilot from processing their content and preventing inclusion in AI-generated answers.

Question

You have a Microsoft 365 E5 subscription that contains a Microsoft Teams channel named Channel1. Channel1 contains research and development documents.
You plan to implement Microsoft 365 Copilot for the subscription.
You need to prevent the contents of files stored in Channel1 from being included in answers generated by Copilot and shown to unauthorized users.
What should you use?
  1. data loss prevention (DLP)
  2. Microsoft Purview insider risk management
  3. Microsoft Purview Information Barriers (IBs)
  4. sensitivity labels Correct Answer

Key Takeaways

Sensitivity labels are the primary control for managing Copilot's data access, whereas DLP only manages data movement and transmission risks.

Learn how to use Microsoft Purview sensitivity labels to prevent Copilot from accessing and summarizing sensitive R&D documents in Teams channels.

Common mistake: Choosing DLP (A) because it handles sensitive data protection, but failing to recognize that DLP does not directly control Copilot's content indexing and response generation capabilities.

Expert Analysis

The correct answer is D. sensitivity labels. To prevent Microsoft 365 Copilot from including specific content in its generated answers, you must explicitly restrict Copilot's access to that data. Microsoft Purview Sensitivity Labels provide the mechanism to classify and protect information by applying encryption and access controls. When a sensitivity label is applied to files in Channel1, it can be configured to block 'connected experiences,' which includes Copilot. This ensures that even if a user has general access to the channel, Copilot will not process or summarize content protected by labels that enforce such restrictions.

Option A, Data Loss Prevention (DLP), is incorrect because DLP policies are primarily designed to detect and prevent unauthorized transmission of sensitive data (e.g., via email or chat). While DLP can include conditions based on sensitivity labels, it does not inherently control Copilot’s internal processing logic for generating responses; the restriction must originate from the data classification itself. Option B, Insider Risk Management, focuses on detecting risky behavior by users rather than controlling AI model access to data. Option C, Information Barriers, enforces communication silos between groups but does not directly manage how an AI service like Copilot indexes or retrieves content for summarization based on file-level permissions.

Comments highlight this distinction, noting that DLP prevents leakage during transmission but does not stop Copilot from accessing data for generation. The consensus emphasizes that sensitivity labels integrate with Copilot’s data access layer, allowing administrators to define exactly which content is excluded from AI processing, thereby satisfying the requirement to protect R&D documents from unauthorized exposure in Copilot outputs.

Official Reference

https://learn.microsoft.com/en-us/microsoft-365/copilot/compliance/security-data-protection

This link opens the official vendor documentation in a new tab.

Exam Strategy

When asked about controlling AI services like Copilot, look for mechanisms that manage data classification and access rights at the source. If the question involves preventing AI from reading or using specific content, sensitivity labels are the standard tool because they enforce encryption and usage restrictions that AI services respect. Do not confuse this with DLP, which focuses on preventing data exfiltration across networks and applications.

Frequently Asked Questions

Can DLP policies alone prevent Copilot from using sensitive data?

No. DLP policies monitor and block data transmission but do not inherently restrict Copilot's ability to index and process data for summarization. Sensitivity labels are required to enforce access controls that Copilot respects.

How do sensitivity labels interact with Microsoft 365 Copilot?

Copilot respects the permissions and restrictions defined in sensitivity labels. If a label blocks connected experiences or encrypts content, Copilot will not process or include that content in its responses unless the user has explicit permission to override those settings.

More SC-401 FAQ →

Community Votes

D
71%
A
29%

71% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 35 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 30 of 35

  1. dmoorthy 👍 7 Answered D
    Sensitivity Labesl. Copilot respects sensitivity labels and will not surface protected content to users who are not authorized.
  2. Jo696 👍 3 Answered A
    This would be a DLP Policy, break down of answer Insider risk is more around individual users Information barriers will restrict communication between groups, not stop leakage of info Sensitivity label is relying on the information being labelled A DLP policy with a sensitive label will meet the requirements
  3. 265cb32 👍 3 Answered D
    D because you can disable the "copy and extract content" option from the label configuration, however, you can also create a DLP policy that will prevent copilot from processing content that has a specific sensitivity label applied to documents (this is a more easier and fast option to apply lately).
  4. aBCCERT 👍 3 Answered A
    While sensitivity labels (option D) can classify and protect documents, they do not directly control whether Copilot can access or reference them in responses. Microsoft Purview
  5. Jarem 👍 3 Answered A
    A for me: https://learn.microsoft.com/en-us/purview/dlp-microsoft365-copilot-location-learn-about
Show 25 more comments
  1. examtopicssc401 👍 2 Answered D
    Sensitivity labels (D): You can apply sensitivity labels to documents in Channel1 (such as "Top Secret" or "Highly Confidential"). Sensitivity labels can be configured to block connected experiences like Copilot from processing the content of labeled files, effectively preventing Copilot from including that content in its answers. This is done either through advanced settings (like BlockContentAnalysisServices) or by applying encryption with user-defined permissions
  2. examtopicssc401 👍 2 Answered D
    Sensitivity labels allow you to: Classify and protect content (e.g., "Confidential – R&D"). Restrict access to the labeled files using encryption and permissions. Copilot respects label-based access control, meaning it won’t include content from protected files in responses unless the user has access.
  3. RamyKetata 👍 2 Answered A
    ✅ Configure DLP policies with "Prevent Copilot from processing content" (Preview) Ensures Copilot does not analyze or generate responses using restricted data. Provides granular control over content visibility within Microsoft 365.
  4. Suranka 👍 2 Answered D
    The right control is Microsoft Purview Information Protection (sensitivity labels with scoped permissions
  5. kazaki 👍 2 Answered A
    Create label then DLP to take action
  6. Fiqri 👍 2 Answered D
    D is correct
  7. Comicbookman 👍 1 Answered D
    Why Sensitivity Labels? Microsoft Sensitivity Labels allow you to: - Classify and protect files based on their content. - Prevent unauthorized access by defining security settings. - Restrict Copilot's ability to use certain files for generating responses. Why Not the Other Options? - A. Data Loss Prevention (DLP) → Prevents accidental data leakage but doesn't directly control Copilot's access to files. - B. Insider Risk Management → Monitors user behavior for potential security threats but doesn't restrict Copilot's response generation. - C. Information Barriers (IBs) → Blocks communication between specific groups in Microsoft 365, not content visibility to Copilot. To prevent Copilot from revealing sensitive file content, you need to restrict access at the content level, and only Sensitivity Labels provide this type of preemptive, content-aware control — not DLP.
  8. starlord45 👍 1 Answered D
    For me solution D fits the most. A. data loss prevention is for me to prevent losing the data when they are send via mail, chat etc. It's not granular enough, the question says for unauthorized users. And with DLP you do not have control over the files directly and there permissions. B. Insider Risk Management is a different solutions with a different use case. C. Information Barriers makes it impossible that one department can not write / communicate with another one. D. Sensitivty labels fits the most, because Copilot can work with the labels and if a user is not authorized to a file with a assigned label, then even the user sees the label, copilot can not work with the label, because copilot works in the users context. If he has no access, copilot has no access, and can not give an answer.
  9. 2ff2acc 👍 1 Answered D
    Answer D Why the other options are incorrect: A. Data Loss Prevention (DLP): DLP helps prevent data exfiltration (such as emailing sensitive data), but it does not control what Copilot can access or generate in its responses. B. Insider Risk Management: This is used to detect and respond to risky user behavior (like data leaks or misuse), but it does not prevent Copilot from accessing data. C. Information Barriers (IBs): IBs prevent communication and collaboration between certain groups, but they don't apply to Copilot’s data processing directly unless configured very strictly—and still wouldn't control Copilot’s access to a specific channel’s data as precisely as sensitivity labels.
  10. Jideakin 👍 1
    The question talks about restricting ONLY research and development documents in Channel1 from being displayed to unauthorized users. If you go with A, you cannot limit the DLP policy to Channel1, plus you still have to specify a sensitivity label or Sensitivity Info Type as Condition, and that would apply to entire Tenant, not just Documents in Channel1. I believe D is the answer. Using Sensitivity Label and setting the right permission means only people who are authorized by the label would be able to have access, either through Copilot or directly.
  11. phatboi 👍 1
    o minimize the risk of General Data Protection Regulation (GDPR) data being included in Microsoft 365 Copilot summaries and also exclude private information from summaries. They plan to create a DLP policy that uses the Microsoft 365 Copilot policy location with the Content contains > Sensitivity labels condition to exclude items that have the Personal sensitivity label from being processed in the response summary and also to exclude items that have the Highly Confidential sensitivity label from being processed in the response summary.
  12. jeff1988 👍 1 Answered D
    D. Sensitivity labels Sensitivity labels can be applied to documents, emails, Teams sites, and SharePoint sites. They control access to content based on user permissions and integrate with Microsoft 365 Copilot’s data access layer. This ensures that only authorized users can view or interact with the labeled content, preventing unauthorized users from seeing sensitive information in Copilot's responses.
  13. Jideakin 👍 1
    First, how to you restrict this to channel1, there may be other channels in the Team. Second, which SIT would you use as condition in the DLP? No SIT is given here. The workable option is to simply create a Sensitivity Label that doesn't have "copy and Extract" permission and set that as the default label for the repository, so it applies to all the docs there.
  14. Skippy1969 👍 1 Answered C
    Microsoft Purview Information Barriers (IBs) allow organizations to enforce policies that prevent certain groups of users from communicating or sharing information with each other. This is particularly useful in scenarios where sensitive information needs to be protected from unauthorized access, such as in research and development contexts.
  15. mhmyz 👍 1 Answered D
    D. Sensitivity labels How Microsoft 365 Copilot works with sensitivity labels and encryption https://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-architecture-data-protection-auditing#how-microsoft-365-copilot-works-with-sensitivity-labels-and-encryption
  16. SH_Train 👍 1
    From your link "Microsoft Purview Data Loss Prevention (DLP) can help you prevent items that have specific sensitivity labels applied from being used in the response summarization to prompts in Microsoft 365 Copilot (preview)." Sensitivity Labels are required first.
  17. NeerajSap 👍 1 Answered D
    Microsoft 365 Copilot respects the existing Microsoft 365 security and permissions model. To prevent sensitive R&D documents stored in a Teams channel from being exposed through Copilot responses, the files need to be classified and protected.
  18. laykay4me 👍 1 Answered A
    I will go for A because we are protecting content of a file and not just a document. Hence, sensitivity label would have to be applied to each documents individually even when you have to use auto labelling. The best option is DLP
  19. gabbinu 👍 1 Answered D
    Answer is D. you must apply sensitivity labels that restrict access to authorized users only. if an unauthorized user tries to query Copilot, Copilot can’t read the file → it won’t use that content in its responses.
  20. jgalanj 👍 1
    Be aware no chance to manage at level of chanel in teams when you create a dlp policie, sensitivity labels manage with granularity the information and probably is the near answer to the situation.
  21. Fiqri 👍 1
    coming back after trying at my production environment, the correct answer is A. we can set up dlp for copilot specifically and the action is prevent copilot from processing content (preview)
  22. TheMCT 👍 1 Answered D
    DLP does not control what Microsoft 365 Copilot can access or generate in its responses. It’s designed to prevent data exfiltration, not to restrict internal AI access to content.
  23. 8d1e8fe 👍 1 Answered D
    The sensitivity label is the basis for the DLP setting to begin with. Copilot however DOES respect a DLP policy based on that label. Typical Microsoft question not entirely MECE.
  24. DrArjunReddy 👍 1 Answered D
    Answer should be D. Can do DLP without sensitivity labels and even with out DLP, removing encryption on the sensitivity label itself should prevent unauthorized access.
  25. 495aba7 👍 1 Answered A
    I believe this used to be D, however, with the new updates A makes more sense as there is a tickbox to prevent copilot processing this information.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Microsoft Purview Retention Policy Conflict Resolution

S-grade

Maximum Primary Elements in Microsoft Purview EDM Classifier

S-grade

Encrypting Emails with Azure Storage Keys via DLP

S-grade

Encrypting Emails with Azure Storage Keys via DLP

S-grade

← Back to SC-401 Study Guide