MT.1173: Sensitivity labels are published for files used by Microsoft 365 Copilot.

ID	MT.1173
Severity	Medium
Suite	Mito
Product	Purview
Feature	Information protection
Security area	Data protection
Resource type	Tenant
User impact of fixing	Medium
Effort to fix	Medium
Framework controls	nist-800-53-r5:AC-16 Security and Privacy Attributes
Reads from	Security & Compliance PowerShell

What this checks and how to fix it

Ensure Microsoft Purview sensitivity labels are published to users and at least one published label is scoped to files, so Microsoft 365 Copilot honors and inherits labels onto AI-generated content.

Microsoft 365 Copilot only:

• Honors sensitivity labels (respecting encryption and usage rights from labelled source files).
• Inherits the most restrictive label from the source files used to generate a response onto the new generated content.

…when sensitivity labels are actually published to users in your tenant. If no label policy is published, or no published label is scoped to files (SharePoint, OneDrive, Office documents), Copilot has no labelling signal to apply, and DSPM for AI cannot report on label-based oversharing risks.

The test passes when all of the following are true:

• At least one label policy is published / enforced (Get-LabelPolicy with Mode = Enforce).
• At least one label has the File scope (Get-Label where ContentType includes File).
• That file-scoped label is included in a published label policy (a file-scoped label that exists but isn’t in any published policy does not count as compliant).

Remediation action

1. Open the Microsoft Purview portal — Information Protection — Labels.

2. Create or edit a sensitivity label and ensure Files is selected under “Define the scope for this label”.

3. Open Label policies and publish the label to the relevant users or groups.

4. Verify with PowerShell after a few minutes:

   Connect-IPPSSession
   Get-LabelPolicy | Where-Object { $_.Mode -eq 'Enforce' }
   Get-Label | Where-Object { $_.ContentType -match 'File' }

Related links

• Microsoft Learn — Sensitivity labels overview
• Microsoft Learn — Microsoft 365 Copilot data protection and sensitivity labels
• Microsoft Learn — How Copilot inherits sensitivity labels

---

Mito check. Author: OfirGavish. Open-source licences.