Microsoft Expands DLP Controls to Enhance Copilot Security

Microsoft is enhancing its Data Loss Prevention (DLP) controls to block Copilot from processing confidential documents across all storage locations. This move directly responds to a bug that allowed the AI to surface confidential emails from Outlook Draft and Sent Items folders, despite applied sensitivity labels. Configured through Microsoft Purview, the new policies enable client-side sensitivity label provision, ensuring DLP enforcement applies uniformly across cloud services and local file storage, regardless of a document's location.

Addressing Gaps in DLP Enforcement

Microsoft’s remediation extends beyond merely patching the original Outlook vulnerability. The company is expanding DLP controls to prevent Copilot from processing confidential files, including Word, Excel, and PowerPoint documents, across all storage locations.

Previously, DLP enforcement had notable gaps for locally stored files and locations outside Microsoft’s primary cloud services. This left sensitivity-labeled documents vulnerable to Copilot’s summarization and retrieval features, even when administrators intended to restrict access.

Shifting to Client-Side Sensitivity Label Provision

The new architecture shifts sensitivity label enforcement to the client endpoint. As a result, DLP policies now evaluate sensitivity at the point of access, rather than relying on the storage layer to communicate it. Policies configured in Microsoft Purview now apply consistently, whether a file resides in SharePoint, OneDrive, a local drive, or any other location accessible by Copilot.

Practically, this means enforcement is now tied to the sensitivity label a file carries rather than its storage location—a subtle but significant shift designed to close gaps in traditional DLP architectures vulnerable to AI retrieval systems.

Incident CW1226324: Highlighting Structural Gaps

The architectural shift addresses issues traced back to a specific incident reported on January 21, 2026, and tracked under incident ID CW1226324. Investigations revealed a code flaw that allowed items in users’ Outlook Draft and Sent Items folders to be indexed and processed by Copilot, even when confidential sensitivity labels were applied.

Sensitivity labels alone were insufficient to prevent Copilot from accessing these messages. A fix was rolled out in early February 2026, with a global configuration update deployed for enterprise customers.

Broader Implications for AI Governance

A Microsoft spokesperson told The Register that the CW1226324 incident highlights a structural gap specific to AI systems. Traditional DLP was designed for human access patterns, where users explicitly open files. However, Copilot’s background indexing traverses folders that users rarely access manually, such as Draft and Sent Items, surfacing their content in responses. This underscores a governance challenge focused on enforcement granularity, not just policy scope.

Following the CW1226324 incident, Microsoft addressed the immediate vulnerability while also highlighting a broader industry challenge. The need to govern AI access to sensitive data is widespread: 72 percent of S&P 500 companies now cite AI as a material risk in regulatory filings, reflecting how enterprise AI policy has become integral to compliance.

Long-Term Governance and Industry Trends

WinBuzzer has been covering Microsoft’s iterative approach to Copilot security since November 2024, when the company published an AI Copilot deployment blueprint to address enterprise security concerns. The latest DLP expansion continues this pattern of incremental governance tightening.

For enterprise teams, the implication is clear: AI systems require a distinct governance layer that accounts for background processes, not just deliberate user actions. Existing DLP frameworks were not designed with autonomous indexing in mind, and this incident demonstrates the exposure created when sensitive folders go unreviewed.

Recommendations for Enterprise IT Leaders

Enterprise IT leaders should proactively audit Copilot configurations rather than waiting for incidents to reveal gaps. Organizations that have not reviewed sensitivity label coverage across Outlook folders risk exposure through background-indexing behavior.

Melissa Ruzzi, Director of AI at AppOmni, emphasized to eSecurity Planet the importance of providing employees with clear guidance on what AI can and cannot access, along with a defined escalation path when unexpected behavior occurs. Without such a path, gaps between policy intentions and AI behavior may go unnoticed until they reach regulatory scrutiny.