Humongous Insurance has deployed Microsoft 365 Copilot across their organization. The compliance team is concerned that employees may enter credit card numbers or Social Security Numbers (SSNs) directly into Copilot prompts, which would violate PCI-DSS and privacy regulations. The compliance administrator needs to prevent this from happening. What is the correct DLP configuration?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Think of DLP policies as bouncers at a club — they check IDs at the door before anyone gets in, not after. To stop sensitive data from entering Copilot prompts in real time, you need a DLP policy with the 'Microsoft 365 Copilot' location selected and a block action, so credit card numbers and SSNs get stopped before they ever reach the AI model.
Full explanation below image
Full Explanation
The correct answer is B. Microsoft Purview Data Loss Prevention (DLP) policies support 'Microsoft Copilot for Microsoft 365' as a dedicated workload location. When you select this location and configure a rule with built-in sensitive information types like 'Credit Card Number' and 'U.S. Social Security Number (SSN)', Purview will evaluate user prompts in real time and block the submission if a match is detected. This is the only option that prevents the sensitive data from reaching Copilot in the first place.
Option A is incorrect. Conditional Access policies control whether a user can authenticate and access an application — they cannot inspect the content of what a user types into that application. Blocking the entire group from Copilot would be overly broad and would not selectively prevent PII entry; it would just deny access entirely, which is not the compliance goal.
Option C is incorrect. A retention policy governs how long data is kept or when it must be deleted — it does not inspect or block content in real time. Deleting Copilot interaction history after 30 days does nothing to stop a credit card number from being processed by the AI model in the first place. The damage (policy violation, potential data exposure) would already have occurred.
Option D is incorrect. Communication Compliance is a reactive tool — it monitors content after it has already been created or transmitted and alerts reviewers. While it has value for investigating past incidents, it does not provide the real-time, preventive blocking that the scenario requires. You cannot unring the bell once the SSN has already been sent to Copilot.
Exam tip: On the AB-650 exam, questions about Copilot data protection almost always test whether you know that DLP policies now extend to 'Microsoft Copilot for Microsoft 365' as a location. Know that this is configured in the Microsoft Purview compliance portal under Data Loss Prevention > Policies, and that built-in sensitive information types (SITs) are the mechanism for detecting PCI and PII data in prompts.