AI DLP and web search: review the second destination

AI data-loss prevention reviews should include the search query an assistant generates from a prompt. That query can travel to a separate service under different terms. Check its possible inputs, destination and controls alongside the original conversation.

Microsoft Copilot provides a documented example. Its web-search feature can generate a short query for Bing from the user's request. Microsoft describes protections for that query, while also distinguishing Bing's handling from the Microsoft 365 service boundary. This creates a specific review task for administrators.

Follow the generated query

Microsoft's web-search documentation explains that Copilot identifies terms where web information would improve an answer, then sends a generated query to Bing. The query generally contains a few words informed by the prompt. A very short prompt can be included in full.

For Microsoft Copilot, a query may also be informed by document data when someone uses Copilot inside an application with a relevant document open, or explicitly references a document. Microsoft says entire Microsoft 365 files are excluded from the generated query.

That distinction still leaves useful questions about individual terms. A project name, proposed acquisition target or distinctive internal phrase can carry meaning in a short query. Review the sensitivity of what may be derived from the source, including contextual information.

This article covers Microsoft Copilot and Copilot Chat used with a work account. Consumer Copilot, GitHub Copilot and the separate Copilot Search experience need their own assessment.

Read the terms for both destinations

Microsoft says generated queries are sent with user and tenant identifiers removed. Its stated commitments include treating them as customer confidential information, excluding advertising profiles and generative-model training, and granting Microsoft rights only as needed to provide the service.

The same documentation says Bing operates separately from Microsoft 365. Microsoft acts as a controller for generated web-query data. The Microsoft Products and Services Data Protection Addendum, HIPAA compliance and EU Data Boundary do not apply to those generated queries.

Removing account identifiers therefore answers one part of the review. Privacy and Legal teams still need to assess the query content, applicable contractual commitments and permitted data classes for the workflow.

A useful inventory has two entries: the conversation service and its web-search destination. Record the feature state, data that can inform a query and the policy owner responsible for approving that route.

Distinguish the available controls

Microsoft documents an administrator policy called Allow web search in Copilot. It can enable or disable web search for users or groups, with a separate option governing Work mode. User toggles operate within the administrator's policy.

Purview's Copilot DLP documentation describes another approach: when directly entered prompt text matches configured sensitive information types, the Performing Web Searches action blocks external web grounding while allowing a response using permitted internal data.

The separate Processing prompts action prevents a response and use of that prompt for internal or web searches. Sensitivity-label conditions govern supported files and emails. Each rule needs an explicit condition, action and scope.

Coverage limits matter. The Learn page says this policy location does not scan the contents of files uploaded directly into prompts. It also says policy updates can take up to four hours to appear. A test using typed text therefore supplies limited evidence about a file-upload workflow.

Resolve rollout uncertainty in your tenant

Microsoft's public sources contain a status discrepancy. Aaron Thorp's 21 April 2026 announcement describes sensitive-prompt blocking as entering general availability. The Learn page, updated 17 September and checked on 1 October, still labels that feature preview and rolling out.

Record the discrepancy and confirm availability, licensing and supported clients in the tenant being assessed. This guide summarises documentation; no tenant-level enforcement test was performed for it.

Build a small, safe verification set

Use an authorised test account and deliberately fictional content. Define a harmless custom classification marker for testing and keep real confidential information out of every case.

1. Run a permitted public-information task with web search enabled. Establish that the relevant search route is exercised.
2. Test directly entered text matching the configured classification. Record the policy action and whether external grounding is blocked.
3. Repeat with the marker present only in a test document. Check the documented control for that source and the observed outcome separately.
4. Repeat after disabling web search for the test group, allowing for policy propagation.
5. Confirm that an ordinary permitted task remains usable and that users understand any restriction.

Microsoft documents query citations in Copilot Chat, available in the thread for 24 hours, plus administrator audit and discovery options. Citations are unavailable in the Copilot pane inside applications such as Word. Use the evidence appropriate to each client.

An answer without web citations cannot by itself establish that no search request occurred. Pair visible behaviour with available query and policy records; label any remaining delivery uncertainty.

The broader workplace data-leakage guide covers account selection and data classes. Add this second-destination check whenever an assistant gains search, connector or external-action features.

Map your AI data flows with Promptective.