Introduction

As organizations embrace Microsoft 365 Copilot (Copilot), a new category of risk emerges: what happens when Copilot grounds its responses in untrusted external emails? Messages from external or unverified senders can carry content Copilot shouldn’t rely on. A new policy in Microsoft Purview Data Loss Prevention (DLP) addresses exactly this challenge.

It lets organizations ground Copilot in trusted internal email only—reducing the risk of cross-prompt injection, while keeping everyday work uninterrupted.

Why This Matters: The Risk of External Email in Copilot Grounding

Copilot is built to integrate deeply with your organizational data—emails, files, meetings, and more—to generate intelligent and context-aware responses. However, not all mailbox content is equally reliable.

External emails—messages originating from outside your organization’s trusted domains—can introduce risks such as:

• Prompt injection (or cross prompt injection) attempts disguised as legitimate communication


• Manipulated or misleading content aimed at influencing Copilot-generated outputs


• Unverified information or instructions that may lead to inaccurate responses


• Social engineering content that could be amplified through Copilot summarization

Without proper safeguards, Copilot may inadvertently reference or summarize this content, potentially impacting decision-making or exposing users to biased or manipulated information.

Consider a common scenario: an employee receives a message from an outside address that looks like a routine vendor note but contains hidden text instructing any AI assistant to ignore prior guidance and surface the recipient’s recent internal updates. Later, the employee asks Copilot to “summarize my inbox.” Without this policy, that external message is eligible for grounding, and its planted instructions could influence the summary. With this new policy enabled, the external email is excluded from grounding entirely—Copilot never reads it as a source, so the injected instructions have no effect.

How It Works: Under the Hood

The feature operates through a DLP policy configured in the Microsoft Purview portal using the “Microsoft 365 Copilot and Copilot Chat” policy location with the “Email is received from > External users” condition. Here is how Copilot enforces the policy at runtime:

• Metadata Evaluation: Copilot evaluates email metadata and it checks the sender’s domain against your tenant’s accepted domains to determine whether an email is internal or external. Importantly, the body of the email is not inspected—only sender metadata is evaluated.


• External Emails Excluded from Grounding: Emails received from an external sender are excluded from Copilot grounding (source) data. This means when a user asks Copilot to summarize their inbox or reason over recent communications, those external emails are not referenced, summarized, or cited in the response.


• Other Grounding Sources Remain Available: Results from other grounding sources, such as web search, Word documents, Excel files, PowerPoint presentations, and internal emails, continue to show up in Copilot responses as normal. The policy is surgical in scope.


• No Impact on Email Access: User access to email remains completely unchanged. Users can still read, reply to, forward, and manage all their external emails as they always have.


• No Impact on Mail Flow: The policy does not affect mail flow, delivery, or retention. It operates exclusively at the Copilot grounding layer, not at the transport or storage layer.

Things to Keep in Mind

A few points help set the right expectations before you deploy:

• Metadata-only evaluation: The policy evaluates sender metadata, not message content. It does not scan or analyze the body of any email.


• Scoped to the grounding layer: The policy affects only what Copilot can use as a grounding source. It does not change mail flow, delivery, retention, or a user’s ability to access their email.


• Other sources are unaffected: Internal emails, files, and web results remain available to Copilot, so most everyday scenarios are unchanged.


• Validate before enforcing: Assess where external email is important to business workflows, then use simulation mode to validate impact and apply the protection only where it is relevant and needed.

Key Benefits for Your Organization

Mitigates Cross-Prompt Injection Risk: By excluding untrusted external email from Copilot’s grounding data, organizations significantly reduce the attack surface for prompt injection attempts embedded in incoming email.

Applies protection where it is needed: Organizations can use the policy when external email presents a meaningful risk to Copilot grounding, while leaving external email available in scenarios where it is relevant and trusted.

Ensures Copilot Responses Are Grounded in Trusted Data: Copilot responses reflect only your organization’s internal, verified communications, building greater confidence in Copilot generated insights.

Minimal Disruption to Productivity: The feature keeps everyday work uninterrupted. Users retain full access to all their emails, and Copilot continues to function using all other permitted data sources.

Simple Policy-Based Administration: Configured through familiar Microsoft Purview DLP policy workflows, making it easy for compliance and security teams to deploy and manage.

Transparent User Experience: Users receive clear notifications when organizational policies restrict content, maintaining trust and transparency in the Copilot experience.

Prerequisites

Before you begin, make sure you have:

• Permissions: An account with the Compliance Administrator or Data Loss Prevention administrator role, or equivalent permissions to create DLP policies in the Microsoft Purview portal.


• Accepted domains: Your tenant’s accepted (internal) domains configured correctly, since these determine which senders are treated as internal versus external.

How to Set It Up

Setting up this protection is straightforward:

1. Sign in to the Microsoft Purview portal (https://purview.microsoft.com).


2. Navigate to Data Loss Prevention > Policies and select + Create policy.


3. Choose the Custom template, then Custom policy.


4. On the Locations page, enable the Microsoft 365 Copilot and Copilot Chat location.


5. Add a rule with the condition “Email is received from,” and set the value to External users.

6. Set the action to “Prevent Copilot from processing content”.

7. Deploy the policy in simulation (test) mode first, and review the impact to confirm only the intended external email is affected.


8. Once validated, save and activate (enforce) the policy.

Conclusion

As M365 Copilot becomes central to enterprise productivity, organizations must control what data feeds its responses. This new policy features adds a critical layer of defense, grounding M365 Copilot in trusted internal data while keeping the door open to seamless collaboration.

By deploying this DLP policy, you protect more than data—you protect the integrity and trustworthiness of every Copilot-generated insight your organization relies on.

Ready to get started? Create the policy in simulation mode today, validate the impact, and enforce it once you’re confident—so every Copilot response your organization relies on is grounded in data you trust.

Learn more: https://learn.microsoft.com/en-us/purview/dlp-microsoft365-copilot-location-learn-about