Do SharePoint labels stop Copilot seeing a file?

Copilot respects user permissions and, where configured, sensitivity labels. Labels are one of the few technical controls that can limit what Copilot is allowed to extract or return. They only work if they are applied to the items that matter.

The gap that shows up in every tenant

A taxonomy exists in Purview. Almost nothing is labelled. Auto-labelling was discussed and never finished. Site-level (container) labels were applied to a few SharePoint sites, and everyone assumed the files were protected.

Container labels on a site do not automatically protect every file inside it. Apply item-level labels to personal and sensitive content if you want Copilot behaviour to change.

What to do in practice

Use a minimum taxonomy such as Public, Internal, Confidential and Highly Confidential. Define who may apply Highly Confidential, and whether encryption or restricted extraction applies.

Start with libraries that hold HR, customer, health, financial or legal content. Auto-labelling helps at scale; do not wait for 100% coverage before the pilot, but do not skip the high-risk libraries either.

Where the platform supports it, configure labels so they can restrict what Copilot returns. Then test with a labelled file and an unlabelled copy of the same content — the difference is the control.

How to check it

In Microsoft Purview, open your label taxonomy and look at published label policies. Check a sample of HR, legal and customer libraries: how many files actually carry Confidential or higher? If the answer is “almost none”, Copilot is grounding on unlabelled content regardless of the policy deck.

Ask a pilot user to open a Highly Confidential file and a Public file in Copilot. Document what was summarised. That test is more useful in a DPIA annex than a screenshot of the taxonomy.