Copilot sensitivity labels: verify each output

Verify Copilot sensitivity-label protection through three separate questions: what classification is displayed, which usage rights apply and what the configured DLP policy permits. Then check the generated output in its destination application. Label display, source access and output inheritance have different scopes and exceptions.

A label named Confidential can carry different settings in different organisations. Microsoft documents labels as metadata that may apply encryption, markings or other controls. The name alone leaves those configuration choices unresolved.

This guide interprets Microsoft documentation and proposes a synthetic-content review. It makes no claim of independent tenant testing or equivalent behaviour in another AI product.

Establish what the source label configures

Read the published label configuration with the information-protection owner. Record the label identifier, priority, encryption settings, assigned usage rights and supported applications. Keep those details beside the business handling rule.

Microsoft's sensitivity-label overview explains that label priority follows administrator-defined ordering. Copilot can display the highest-priority label represented in a response. That display communicates classification; assess access and processing controls separately.

Also establish whether the label belongs to the document or its container. A labelled SharePoint site or Team does not automatically apply the container label to each document. The item that Copilot reads needs its own inspection in the review.

Check usage rights on the exact path

For Purview-encrypted labelled content, Microsoft's Copilot protection documentation describes VIEW and EXTRACT rights governing readable content returned by AI. EXTRACT concerns copying or extracting content. An employee's ability to open a file and Copilot's ability to reproduce its contents need separate checks.

Microsoft's considerations page documents exceptions and path-specific behaviour, including independently applied encryption and active-tab content in Edge. It also distinguishes stored content from a file already open in an application.

Treat those differences as acceptance questions. Record the encryption method, client, file state and user rights for each case. Keep a result tied to that combination. A successful check in one Office experience leaves other clients and ingestion routes unverified.

Verify output inheritance where it is supported

Microsoft names Word, PowerPoint and Outlook in its supported new-content inheritance description. Where multiple labelled sources contribute, the documented selection uses the highest-priority source label. Check the label on the resulting file or email, alongside the visible response label.

The considerations page describes circumstances where inheritance cannot apply. These include a read-only destination, insufficient rights to change a label or a label that has not been published to the user. It says generated text is not inserted when the required inheritance fails.

There are also unsupported encryption configurations, including user-defined permissions and encryption applied independently of the label. Keep those cases outside a general inheritance claim. Users may subsequently change a label where policy permits it, so review the saved output and its actual handling settings.

Add the DLP decision explicitly

Microsoft's Copilot DLP documentation describes separately configured rules that can exclude selected labelled files and emails from processing. A restricted item can still appear as a citation. Record content use and citation visibility as different observations.

The documentation also gives timing and scope limits. In supported Word, Excel and PowerPoint experiences, the labelled-file restriction is evaluated when the file opens; a label applied during a session requires reopening for that change to take effect. Policy updates can take up to four hours.

Directly uploaded prompt files are outside content scanning by this DLP location. Review that path under its applicable controls. Confirm current licensing, client support and tenant availability with the administrator before treating a documented feature as available.

Build a small output-focused test record

Use fictional documents and dedicated test identities. Compare a classification-only label with an encrypted configuration, then compare the relevant usage rights. Exercise each supported output application separately, including a destination where inheritance should fail.

For each case, retain the source label, rights, configured DLP rule, client version, time, generated-content result, citation result and saved output label. Include a mid-session label change and a repeat after reopening where the documented behaviour applies. Keep pending propagation distinct from a settled outcome.

Use bounded identifiers and outcomes in the evidence record. Confirm that the intended legitimate task still works when its inputs satisfy the organisation's policy. Escalate documentation conflicts or unexpected results before expanding the protection claim.

Our workplace AI data-leakage guide covers the wider employee decision. This review supplies the item-level evidence behind a label-based workflow.

Map your AI data-handling requirements with Promptective.