During a security review of Copilot for Microsoft 365, an engineer discovers that users are using Copilot to summarize emails from external parties that contain potential phishing content. The engineer needs to ensure Copilot does not process emails flagged as phishing. What should be configured?

The correct configuration is Microsoft Defender for Office 365 to quarantine phishing emails before Copilot can access them. Quarantine policies remove phishing emails from user mailboxes, preventing Copilot for Microsoft 365 from being able to access and summarize them, since Copilot can only surface content the user has access to. Safe Links policies with Copilot exclusion are incorrect because Safe Links protects URL clicks but does not prevent Copilot from summarizing quarantined or phishing email content. Purview sensitivity labels applied to quarantined phishing emails are incorrect because sensitivity labels on quarantined messages do not prevent Copilot access if emails remain in the mailbox. Exchange transport rules to add warning headers to phishing emails are incorrect because transport rule warning headers do not remove access to email content from Copilot.