Code error let Copilot Chat summarise email that DLP should have blocked

A code error in Microsoft 365 Copilot Chat allowed confidential email to be summarised even though active DLP policies should have prevented it. The bug was detected in late January and is tracked under service alert CW1226324. It meant Copilot could read and process email in the Sent Items and Drafts folders even when the messages carried sensitivity labels intended to block automated access. Microsoft has begun rolling out a fix and continues to monitor the deployment.

What this means for your organisation

Many organisations adopted Copilot with DLP policies and sensitivity labels as the control that made the use defensible. When that control fails inside the platform itself, the justification for the use fails with it. Where personal data is involved, it means you cannot rest a risk assessment on the vendor's mechanisms alone.

Berigo recommends

• Verify that your Purview DLP policies are actually scoped to cover Copilot interactions, not only mail and file storage.
• Confirm that sensitivity labels are enforced across the tenant, and test with real messages in Drafts and Sent Items.
• Track service alert CW1226324 until the fix is confirmed deployed in your own tenant.
• Consider whether the incident warrants an update to your data protection impact assessment for Copilot.

Source

• office365itpros.com