Prevent Data Loss to AI Apps and Agents

Turn classification and labels into enforcement boundaries for Copilot, agents, prompts, grounding data, and the browser-based AI apps users reach on their own.

Core capabilities

DLP for Microsoft 365 Copilot and Agents Microsoft Purview Data Loss Prevention

Exclude sensitivity-labeled files and emails from Microsoft 365 Copilot and agent processing, and apply SIT-based rules to prompts and external web search
Endpoint DLP for AI App Uploads Microsoft Purview Data Loss Prevention

Warn or block users on managed devices from pasting, uploading, or copying sensitive data into third-party AI sites in a browser
Browser Data Security for AI Prompts in Edge Microsoft Purview Data Loss Prevention

Inspect and block sensitive text typed or pasted into AI prompts inline in Microsoft Edge for Business, without onboarding the device
Network Data Security for AI Traffic Microsoft Purview Data Loss Prevention

Detect and block sensitive data shared with unmanaged AI apps through non-Microsoft browsers, apps, APIs, and add-ins via a SASE or secure web gateway integration

Supporting capabilities 4

Restricted Content Discovery SharePoint Advanced Management

Temporarily exclude sensitive SharePoint sites from Copilot and agent discovery while access is remediated
Restricted Access Control SharePoint Advanced Management

Reduce the discoverable data surface by enforcing access boundaries on high-risk SharePoint sites
Adaptive Protection for AI Risk Microsoft Purview Insider Risk Management

Apply stronger controls to users whose risk signals justify tighter data-loss prevention
Copilot Response Label Inheritance Microsoft Purview Information Protection

Carry the source sensitivity label onto Copilot responses and generated files so protection follows the AI output rather than stopping at the grounding data

Core capabilities

Solutions

Further reading