How to Block Copilot from Accessing Specific Documents

Microsoft has introduced new Sensitivity Label settings, marking a significant advancement in data security within the Microsoft 365 ecosystem. This guide will walk you through how to leverage these settings to prevent Copilot from accessing specific documents, ensuring the protection of sensitive information.

---

Understanding Sensitivity Labels

Sensitivity Labels are a key component of many organizations’ data security strategies. They classify and protect data through encryption and access restrictions. With the latest update, organizations can now block content analysis services, adding an extra layer of security.

How BlockContentAnalysisServices Works

The BlockContentAnalysisServices feature is implemented through Sensitivity Labels. When applied, these labels prevent applications from sending document information to content analysis services—crucial for maintaining data security. Administrators can manage these settings using PowerShell, allowing for a detailed and customizable approach to data protection.

Implementing Sensitivity Labels via Powershell

The primary method for configuring these new settings is through PowerShell. IT administrators can enable these settings to tailor security measures for sensitive documents.

Steps to Implement:

1. Create a New Sensitivity Label – Define a label or use an existing one.
2. Boot up PowerShell – and execute the following code to apply blocking to the label.

Connect-ExchangeOnline
Connect-IPPSSession

Set-Label -Identity "Block Copilot" -AdvancedSettings @{Tooltip="This label stops a file being used by Microsoft 365 Copilot";BlockContentAnalysisServices="True"}

1. Manage and Monitor – Ensure the labels are correctly applied and regularly monitor document access.

---

Impact on Copilot Features

Applying Sensitivity Labels that block content analysis has a direct impact on Copilot’s capabilities within Office applications. Key functionalities like text summarization and data analysis rely on content analysis services, meaning these features will be disabled for labeled documents.

Disabled Features:

• Summarization – Copilot will no longer generate summaries for labeled documents.
• Data Insights – Extracting data insights will be disabled to prevent unintended sharing of sensitive information.

Explicit References in Copilot

Despite these restrictions, users can still reference blocked documents explicitly within Copilot prompts. This means that if a user directly asks Copilot to access a labeled document, it will do so, ensuring flexibility while maintaining security.

---

Challenges and Limitations

While these settings provide enhanced security, they also introduce certain challenges and limitations, particularly in relation to other integrated security measures.

Data Loss Prevention (DLP) Implications:

• DLP Policy Tips Disabled – Features like DLP policy tips in Outlook and Word are disabled when these Sensitivity Labels are applied. These tips are essential for alerting users to potential data security risks.
• Impact on Workflow Efficiency – The absence of DLP policy tips may affect workflow efficiency and limit the ability to detect and manage sensitive data effectively.

Expanding Control Beyond Office Applications

Currently, the ability to block content analysis services is limited to Office apps. This highlights the need for broader enforcement across all Microsoft 365 services to ensure comprehensive data governance.

Scope of Application:

• Other Microsoft 365 Applications – Applications such as Copilot for Microsoft 365 Chat can still access labeled documents, potentially creating security gaps.
• Comprehensive Governance – Organizations must develop strategies to extend these controls beyond Office apps for a robust data protection framework.

Restricting Microsoft 365 Search

In addition to blocking content analysis, Microsoft also provides options to limit Microsoft 365 Search. This feature allows organizations to restrict access to sensitive information indexed by M365 search services, complementing Sensitivity Label settings.

Search Restrictions:

• Limited Search Access – Organizations can control which information is searchable within their environment, adding another layer of protection.
• Data Management – These restrictions help ensure that sensitive information remains secure and accessible only to authorized users, reinforcing overall data governance.

---