What a pasted prompt can expose
A fictional bank tests the data boundary before access widens.
Coming
See every demonstrationCLIENT DATA AND AI PILOT
Trace a client-data path before you enforce a policy on it.
Your policy says client data stays out of unapproved AI tools. Nobody has traced where it actually goes, and the first enforced block will land on a path nobody tested. In four weeks we map the labels and the data paths, design a small Microsoft Purview DLP test with you, run approved warning or block tests on synthetic content, and hand over the control runbook with an exception owner.
01 Source02 Boundary03 Human decision04 Evidence
HOW IT WORKS
The control path in practice.
- Confirm the licensed scope and the synthetic test content, then map labels and data paths; by the end of week one you hold the inventory with test cases.
- Design a small Microsoft Purview DLP test with your policy owner, scoped to the paths that matter.
- Run the approved warning or block tests on synthetic content and record what each control did.
- Review the exceptions, capture the results and hand over the control runbook and the closeout record.
THE PROBLEM
Why is a written policy not a control?
Because a policy names a rule and a control enforces it on a path, and until someone traces the path from the client record to the prompt, the rule is a promise with nobody responsible for the exception.
The pilot starts by writing the paths down: which labels exist, which workloads carry client data toward an AI tool, and which of them the licensed controls can see. Then it tests one path at a time on synthetic content, with the policy owner, so the first enforced block is one you watched work.
THE MICROSOFT INSIGHT
What stops Copilot from reading a labeled file?
A Microsoft Purview DLP policy with the Microsoft 365 Copilot and Copilot Chat location stops Copilot and Cowork from processing files and emails that carry the chosen sensitivity labels; the item can still appear as a citation, and the location needs Microsoft 365 E5 or the Purview suite.
A Microsoft Purview DLP policy with the Microsoft 365 Copilot and Copilot Chat location stops Copilot and Cowork from processing files and emails that carry chosen sensitivity labels; the item can still appear as a citation. This needs Microsoft 365 E5 or the Purview suite. (Microsoft Learn, checked Oct 31, 2026)
Test the policy on synthetic labeled files and the block is evidence. Turn it on across the tenant and the first thing you learn is which approved workflow it broke.
THE METHOD
What happens in the four weeks?
An inventory, a test design, approved tests and a handover, each reviewed by you before acceptance.
- Week 0: confirm the licensed scope and the synthetic test content.
- Week 1: map labels and data paths; by the end of the week you hold the data-path and label inventory with test cases.
- Week 2: design a small Microsoft Purview DLP test with your policy owner.
- Week 3: run the approved warning or block tests.
- Week 4: review the exceptions, capture the results and hand over the control runbook and the closeout record.
THE SIGNAL
How do you see risky prompts before a block exists?
Microsoft Purview Insider Risk Management ships a Risky AI usage policy template that scores prompts and responses containing sensitive information in Microsoft 365 Copilot and agents, and browsing to generative AI sites, which is the signal the pilot reads while the control is still a test.
Microsoft Purview Insider Risk Management ships a Risky AI usage policy template that scores prompts and responses containing sensitive information in Microsoft 365 Copilot and agents, and browsing to generative AI sites. (Microsoft Learn, checked Oct 31, 2026)
Read the signal first and the block is scoped to the paths that carry risk. Block first and the signal tells you what you broke.
WHAT IT IS NOT
Does the pilot enforce across the estate?
No. Estate-wide enforcement, legal advice and unapproved production policy changes are out of scope. Purview AI reporting and Endpoint DLP enforcement are separate capabilities, and the tests depend on licensed workloads, supported sites and devices, and the approved browser path.
Access is through named accounts in your tenant with the Purview DLP Compliance Management and Information Protection permissions for the approved policy work, and the Security Reader or Data Security AI Viewer role for reporting. Defender and Intune roles grant no Purview authority, and your administrators verify the supported site, device and browser path before any enforcement.
AFTER TWO WEEKS
What will be working after two weeks?
- You hold an agreed data and AI-use scope and a data-path and label inventory with test cases.
- You hold the synthetic test matrix and the control results, one row per path.
- You hold an exception and ownership register with a named owner per exception.
- You hold the control runbook and the closeout record, reviewed before acceptance.
The work is delivered remotely inside your own Microsoft tenant, wherever your business is, and on site only when the work needs it.
HONEST ABOUT LIMITS
What this does not do yet
It does not block a typed prompt with a generally available control today. Blocking a Copilot or Cowork response when the typed prompt contains chosen sensitive information types is in preview and rolling out to tenants. (Microsoft Learn, checked Oct 31, 2026, preview) Blocking a Copilot or Cowork response when the typed prompt contains chosen sensitive information types is in preview and rolling out; the pilot tests labeled files and emails with the released control and records the prompt path as a candidate for the next review.
It does not enforce estate-wide: production policy changes beyond the approved tests are scoped separately.
It does not give legal advice on what counts as client data; the policy owner decides.
THE ONE THING TO REMEMBER
Trace a client-data path before enforcing a policy on it.
Said another way: inventory, test, exception owner, runbook, in that order.
Said a third way: a block you watched on synthetic data is a control; a block you announced is a hope.
SHOW YOUR WORK
See the control path on a fictional bank.
DIRECT ANSWERS
Questions before you decide.
What licenses does the pilot need?
The Microsoft Purview features the test uses, approved sensitivity labels and synthetic examples. Where a workload is not licensed, the inventory records it as an untested path instead of pretending it is covered.
Will the test touch real client data?
No. Every test runs on synthetic content you approve. Production policies are not changed without your approval of the exact change, and the control runbook is what your team uses afterward.
Who owns the exceptions?
Your policy owner, named in the register in week four. Each exception carries an owner and a review date so it does not quietly become the rule.
How does this relate to the AI Use Policy Builder?
The builder writes the clause about what never goes into a prompt and names the control behind it. This pilot is the test of that control on your paths, with the owner who will keep it true.
How is it priced?
Quoted after a scoping call and fixed in a signed statement of work; Microsoft licenses and consumption are separate. The Microsoft Marketplace listing is pending; until it is live the engagement is quoted directly. No price appears on this site.
NEXT STEP
Start with a boundary you can explain.
Choose a focused check, or speak with the team about the workflow you need to improve.