MT.1173 - Sensitivity labels are published for files used by Microsoft 365 Copilot

Overview

Ensure Microsoft Purview sensitivity labels are published to users and at least one published label is scoped to files, so Microsoft 365 Copilot honors and inherits labels onto AI-generated content.

Microsoft 365 Copilot only:

• Honors sensitivity labels (respecting encryption and usage rights from labelled source files).
• Inherits the most restrictive label from the source files used to generate a response onto the new generated content.

…when sensitivity labels are actually published to users in your tenant. If no label policy is published, or no published label is scoped to files (SharePoint, OneDrive, Office documents), Copilot has no labelling signal to apply, and DSPM for AI cannot report on label-based oversharing risks.

The test passes when all of the following are true:

• At least one label policy is published / enforced (Get-LabelPolicy with Mode = Enforce).
• At least one label has the File scope (Get-Label where ContentType includes File).
• That file-scoped label is included in a published label policy (a file-scoped label that exists but isn't in any published policy does not count as compliant).

Remediation action:

1. Open the Microsoft Purview portal — Information Protection — Labels.
2. Create or edit a sensitivity label and ensure Files is selected under "Define the scope for this label".
3. Open Label policies and publish the label to the relevant users or groups.
4. Verify with PowerShell after a few minutes:

   Connect-IPPSSession
   Get-LabelPolicy | Where-Object { $_.Mode -eq 'Enforce' }
   Get-Label | Where-Object { $_.ContentType -match 'File' }

Related links

• Microsoft Learn — Sensitivity labels overview
• Microsoft Learn — Microsoft 365 Copilot data protection and sensitivity labels
• Microsoft Learn — How Copilot inherits sensitivity labels

Test Metadata

Field	Value
Test ID	MT.1173
Severity	Medium
Suite	Maester
Category	Purview
PowerShell test	Test-MtPurviewAiSensitivityLabelsForFiles
Tags	Maester, MT.1173, Purview

Source

• Pester test: tests/Maester/Purview/Test-MtPurviewAi.Tests.ps1
• PowerShell source: powershell/public/maester/purview/Test-MtPurviewAiSensitivityLabelsForFiles.ps1