CIS.M365.3.2.3 - (L1) Ensure DLP policies are published for Copilot users
Overview
A data loss prevention policy for the Microsoft 365 Copilot location is turned on, includes all users, and has an enforcing rule for sensitive data.
Microsoft 365 Copilot can read and summarise everything that a user can open. Without a DLP policy for the Copilot location, a prompt can bring sensitive content into an answer, or send it to a web search, and nothing in the policy limits that. A policy lets you keep content with certain sensitivity labels or sensitive information types out of Copilot responses and processing. Copilot reads SharePoint sites and OneDrive files, so a policy on that location limits what an attacker who gets a session can collect through Copilot from them (T1213.002 and T1530).
The test requires an enabled, non-simulation Copilot policy with an active Enforce rule that detects sensitive information or sensitivity labels and uses a restrictive action. If the only otherwise qualifying policy has location exclusions, the result is marked for investigation so an administrator can confirm that each exception is permitted by the organization. Maester cannot determine that approval from the policy configuration alone.
Copilot DLP needs Microsoft 365 Copilot licences and the Microsoft Purview licences for DLP.
Remediation action
- Sign in to the Microsoft Purview portal.
- Go to Solutions > Data loss prevention > Policies and select Create policy.
- Choose the Custom category and the Custom policy template, and under Locations turn on Microsoft 365 Copilot and Copilot Chat for all users.
- Add a rule that blocks Copilot from processing content that has the sensitivity labels or the sensitive information types that you want to protect.
- Set the policy mode to Turn it on right away and save the policy.
Related links
- Microsoft Purview portal - Data loss prevention policies
- Learn about the Microsoft 365 Copilot data loss prevention policy location
- Create and deploy data loss prevention policies
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 3.2.3
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.3.2.3 |
| Severity | Medium |
| Suite | CIS |
| Product | Purview |
| Feature | Data loss prevention |
| Area | Data protection |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1213.002 Sharepoint, T1530 Data from Cloud Storage |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 3.2.3 |
| Benchmark level | L1 |
| Benchmark profiles | E5 Level 1 |
| Supports controls | cis-m365:3.2.3, nist-800-53-r5:AC-4 |
| PowerShell test | Test-MtCisDlpPoliciesCopilot |
| Services | SecurityCompliance |
| Compatible licenses | EXCHANGE_DLP |
Source
- Test:
tests/cis/Test.CIS.M365.3.2.3.ps1 - Documentation:
tests/cis/Test.CIS.M365.3.2.3.md