Sensitivity labels are published for files used by Microsoft 365 Copilot

Contributed by Ofir GavishAll contributors →

Part of Maester · Purview · Information protection · All checks

Run this check

Invoke-Maester -TestId MT.1173

Overview

Ensure Microsoft Purview sensitivity labels are published to users and at least one published label is scoped to files, so Microsoft 365 Copilot honors and inherits labels onto AI-generated content.

Microsoft 365 Copilot only:

• Honors sensitivity labels (respecting encryption and usage rights from labelled source files).
• Inherits the most restrictive label from the source files used to generate a response onto the new generated content.

…when sensitivity labels are actually published to users in your tenant. If no label policy is published, or no published label is scoped to files (SharePoint, OneDrive, Office documents), Copilot has no labelling signal to apply, and DSPM for AI cannot report on label-based oversharing risks.

The test passes when all of the following are true:

• At least one label policy is published / enforced (Get-LabelPolicy with Mode = Enforce).
• At least one label has the File scope (Get-Label where ContentType includes File).
• That file-scoped label is included in a published label policy (a file-scoped label that exists but isn’t in any published policy does not count as compliant).

Remediation action

1. Open the Microsoft Purview portal — Information Protection — Labels.

2. Create or edit a sensitivity label and ensure Files is selected under “Define the scope for this label”.

3. Open Label policies and publish the label to the relevant users or groups.

4. Verify with PowerShell after a few minutes:

   Connect-IPPSSession
   Get-LabelPolicy | Where-Object { $_.Mode -eq 'Enforce' }
   Get-Label | Where-Object { $_.ContentType -match 'File' }

Related links

• Microsoft Learn — Sensitivity labels overview
• Microsoft Learn — Microsoft 365 Copilot data protection and sensitivity labels
• Microsoft Learn — How Copilot inherits sensitivity labels

Details

Every attribute of this check

Field	Value
Test ID	MT.1173
Severity	Low
Suite	Maester
Product	Purview
Feature	Information protection
Area	Data protection
Resource type	Tenant
User impact	Medium
Implementation cost	Medium
MITRE ATT&CK	None
Supports controls	nist-800-53-r5:AC-16
PowerShell test	Test-MtPurviewAiSensitivityLabelsForFiles
Services	SecurityCompliance

Source

• Test: tests/maester/purview/Test.MT.1173.ps1
• Documentation: tests/maester/purview/Test.MT.1173.md