Quick answer. For Copilot web search queries, Microsoft says its Data Protection Addendum, HIPAA compliance and the EU Data Boundary do not apply, so keeping web search on is a decision for privacy, compliance and counsel. Purview DLP can also stop Copilot using the content of labeled files and emails.
Labeled items can still appear in citations, and a DLP rule can block web search for a prompt that carries sensitive information types. DLP does not scan files uploaded directly into a prompt. If no admin configures the Allow web search in Copilot policy, Microsoft says web search is available to users unless an admin has disabled optional connected experiences by policy, and for GCC and DoD Microsoft says it is off by default. The question for your organization is which of these guardrails it runs, for which users, and who signs the choice.
Prompts and Responses Are Not the Same as a Web Search Query
Microsoft Copilot (formerly Microsoft 365 Copilot) treats two kinds of data differently when web search is on, and the two are easy to conflate. Microsoft’s page Data, privacy, and security for web search in Microsoft Copilot and Microsoft Copilot Chat, read on 2026-09-22, records the rename: “Microsoft 365 Copilot is now named Microsoft Copilot, and Microsoft 365 Copilot Chat is now named Microsoft Copilot Chat.”
For what users type and what Copilot answers, the same page says: “Enterprise data protection, the Data Protection Addendum (DPA), and the Product Terms apply to prompts and responses, with Microsoft acting as a data processor.” The search query Copilot sends to Bing is a separate item under separate terms, set out below.
What a Generated Search Query Contains
When web search is on, Copilot builds a short query for the Bing search service from terms in the prompt. Microsoft’s web search page says the query “consists of a few words informed by the user’s prompt.” Microsoft lists four things the query leaves out:
- “The user’s entire prompt, unless the prompt is very short”
- “Entire Microsoft 365 files (for example, emails or documents) or files uploaded into Copilot”
- “Entire web pages or PDFs summarized by Copilot in Microsoft Edge (only for Microsoft Copilot Chat)”
- “Any identifying information based on the user’s Microsoft Entra ID (for example, username, domain, or tenant ID)”
Document content can still shape a query. Microsoft says a query “may also be informed by data within a Microsoft 365 document” in two conditions: when a user prompts Copilot inside a Microsoft 365 app with a relevant document open, and when the user explicitly references a specific document in the prompt.
Which Terms Cover the Query, and Which Do Not
If your counsel asks which terms govern a web query, start with Microsoft’s web search page, read on 2026-09-22: “Generated search queries are sent to the Bing search service with user and tenant identifiers removed.” The Product Terms commitments Microsoft lists for those queries include “They aren’t used to improve Bing.” and “They aren’t used to train generative AI foundation models.” and that “They’re treated as customer confidential information”.
On the governing terms, the page says: “The web search queries generated by Copilot and sent to Bing are subject to the Microsoft Services Agreement between each user and Microsoft, together with the Microsoft Privacy Statement.” It adds: “Microsoft acts as a data controller, responsible for complying with all applicable laws and controller obligations.”
Then the two sentences that decide most of this question: “The Microsoft Products and Services Data Protection Addendum (DPA) doesn’t apply to the use of generated web search queries in Microsoft Copilot, Microsoft Copilot Chat, or the Bing search service. Also, HIPAA compliance and the EU Data Boundary don’t apply to generated search queries.”
Microsoft’s page Data, Privacy, and Security for Microsoft Copilot, read on 2026-09-22, also says: “Microsoft Copilot provides broad compliance offerings and certifications, including GDPR, ISO 27001, HIPAA, and the ISO 42001 standard for AI management systems.” Read together, one sentence describes Copilot’s compliance offerings and the other says HIPAA compliance does not apply to generated search queries. What that means for your HIPAA, GDPR or contractual position is a question for your counsel, and this page draws no conclusion on it.
The Web Search Control: Allow Web Search in Copilot
If you want web search off for some users and on for others, the control is a policy. Microsoft’s web search page says: “The primary way that IT admins can control access to web search is by using the Allow web search in Copilot policy, which is available only in Cloud Policy service for Microsoft 365.” Microsoft says the policy can turn web search on or off “for users or user groups across the tenant they manage”, with three options:
- “Enabled in Microsoft Copilot and Microsoft Copilot Chat”
- “Disabled in Microsoft Copilot and Microsoft Copilot Chat”
- “Disabled in Microsoft Copilot Work mode; Enabled in Microsoft Copilot Web mode and Microsoft Copilot Chat”
On the third option, Microsoft notes that “web search in Researcher and Cowork in Microsoft Copilot will be disabled.”
When nobody sets the policy, Microsoft says: “If the IT admin doesn’t configure the Allow web search in Copilot policy, web search will be available to users in both Microsoft Copilot and Microsoft Copilot Chat, unless the IT admin has set the Allow the use of additional optional connected experiences in Office policy to Disabled.” It adds: “But turning off optional connected experiences restricts Microsoft Copilot Chat, Microsoft Copilot, and multiple experiences across Microsoft 365.” Using that broader policy as a web search switch restricts more than web search.
Users see the result as a toggle. Microsoft says: “If the IT admin turns off web search, the Web content toggle is turned off and appears dimmed. Users can’t turn on the toggle to use web search.” And: “If the IT admin enables web search, the Web content toggle is turned on by default.”
Microsoft states the government default in two places, in different words. The web search page, for “Government Community Cloud (GCC) or DoD offerings”, says: “Web search is available, but is turned off by default.” It adds: “If you don’t configure the Allow web search in Copilot policy, web search remains turned off, regardless of how the Allow the use of additional optional connected experiences in Office policy is configured.” Microsoft’s service description Microsoft Copilot, read on 2026-09-22, footnotes its web data row in the GCC, GCCH and DoD columns: “Web grounding isn’t enabled by default for government clouds.”
Two smaller points complete the picture. For users, Microsoft says “Web search query citations are available only in Microsoft Copilot Chat.” and that “the web search queries are only available in the chat thread for 24 hours.” For admins, the web search page says: “Web search query logging is available so that admins can perform search, audit, and eDiscovery on the exact web search queries Copilot derived from the user’s prompt.” How long those records are kept is a retention decision with its own owners.
The Purview DLP Location for Copilot
If regulated content sits in labeled files or in prompts, the Copilot control is a DLP policy location. Microsoft’s page Learn about using Microsoft Purview Data Loss Prevention to protect interactions with Microsoft 365 Copilot and Copilot Chat, read on 2026-09-22, describes a DLP policy location still labeled “Microsoft 365 Copilot and Copilot Chat” there, under the older product name.
For labeled content, Microsoft says: “You can create a DLP policy to prevent Microsoft 365 Copilot and Copilot Chat from using files and emails that have sensitivity labels when generating responses.” The caveat, in Microsoft’s words: “Identified items still appear in the citations of the response, but the content of the item isn’t used in the response or accessed by Copilot.” A user can still see a labeled item cited, even though Copilot does not use what is in it.
On web search, the same page lists: “Restrict Microsoft 365 Copilot from using external web search when prompts contain sensitive data.” When a prompt carries the sensitive information types a rule names, Microsoft says: “Copilot automatically blocks the use of external web search as a grounding source for that prompt. Instead, Copilot continues to generate responses using permitted internal Microsoft 365 data sources.”
A further control stops the answer itself: the policy prevents Copilot from “returning a response when prompts contain sensitive data”, and Microsoft marks it: “This feature is in preview and is rolling out to all tenants with access to Microsoft 365 Copilot and Copilot Chat.” A control that excludes email from external senders from grounding, summarization and citation is also marked preview on the DLP page as read on 2026-09-22.
Two limits shape rule design. Microsoft says: “You can’t use both content contains sensitive info types and content contains sensitivity labels conditions in the same rule. You can create a rule for each condition in the same policy, but not in the same rule.” And on uploads: “DLP can’t scan the contents of files that you upload directly into prompts, so evaluation of the uploaded file for sensitive data doesn’t occur. DLP only checks the text you type into the prompt itself.”
Microsoft’s DLP page also states operating limits: “The Microsoft 365 Copilot and Copilot Chat policy location is only available in the Custom policy template.” “When you select the Microsoft 365 Copilot and Copilot Chat policy location, all other locations for that policy are disabled.” “Updates to a DLP policy can take up to four hours to reflect in Microsoft 365 Copilot and Copilot Chat experience.” “The Microsoft 365 Copilot and Copilot Chat policy location doesn’t support Admin units.” In Word, Excel and PowerPoint the policy “is evaluated at file open.” For labeled email, the rule covers “Emails sent on or after January 1, 2025. Calendar invites aren’t supported.” On testing, Microsoft says: “DLP alerts, DLP notifications, and policy simulation mode are supported.”
This is Purview DLP for the Copilot location. It is a different mechanism from Power Platform DLP and from SharePoint-side containment settings.
On licensing for the label block, the Microsoft Purview service description, read on 2026-09-22, marks its row “Purview Data Loss Prevention (DLP) to restrict Copilot from processing files and emails” Yes under “Microsoft 365 E5/A5, Microsoft Purview Suite/EDU/FLW and Microsoft Defender + Purview Suite FLW, Microsoft 365 E5/A5/F5 Information Protection and Governance” and “Office 365 E5/A5”, and No under “Microsoft 365 Business Basic/Standard/Premium”, “Microsoft 365 E3/A3/A1/G3/F3/F1” and “Office 365 E3/E1/A3/A1/G3/G1/F3”. Plan choice as a whole is covered in Microsoft 365 Copilot Licensing: What a Governed Enterprise Deployment Actually Costs.
For government clouds, Microsoft’s Copilot service description marks “Microsoft Purview controls for Microsoft Copilot & Copilot chat” Yes in its Commercial/Worldwide, GCC, GCCH and DoD columns. That row names Purview controls as a group, not the DLP location by name.
What These Two Guardrails Do Not Do
If a user can already open an overshared file, neither control changes that. Microsoft’s DLP page says: “All Microsoft 365 Copilot prompts run in the security context of the user who initiates the prompt.” Oversharing is a permissions question, not a web search or DLP setting, and whether the tenant’s permissions and labels are in order is covered in Is Your Microsoft Environment Ready for Copilot? What Must Be True First.
Retention sits outside both controls as well: how long prompts, responses or logged queries are kept is a retention decision, owned separately. How Purview retention policies, holds and eDiscovery act on Microsoft 365 Copilot Prompts and Responses is set out on its own page.
The Decisions to Take to Privacy, Compliance and Counsel
When the owners meet, IT can state how the platform behaves. The choices below belong to the people who answer for them:
- Web search on, off, or off in Work mode only, and for which user groups.
- Who signs that choice: privacy, compliance and counsel, with IT’s written account of the settings in front of them.
- Which sensitive information types trigger the web search block.
- Which sensitivity labels Copilot is not to process, and how users are told that a cited item may be withheld.
- Whether to rely on controls Microsoft marks as preview, such as the prompt block and the external email control.
- How the choice is evidenced: the policy state, DLP alerts and simulation results, and the web search query logs.
When an Outside Architect Is Worth It
If IT, privacy, compliance and counsel each hold part of this decision and nobody has written down how the platform behaves, an outside architect can set out the web search policy options and the DLP rule design in one document the owners can sign, then put the settings in place with your team. The architecture argument for pairing labels with DLP is in Secure Copilot Enablement vs Turn It On: The Enterprise AI Risk Comparison, and who runs a Copilot governance program after go-live is covered in Hire a Firm for Microsoft 365 Copilot Governance After Deployment.
Delivery is senior and US-based. An i3solutions engagement does not produce managed-service ownership, a replacement for the internal team, open-ended scope expansion, or vendor lock-in. Your own team runs the guardrails once they are set, and the wider practice is in Custom AI Consulting Services for Governed Microsoft Enterprise AI.
Key Takeaways
- Microsoft says its DPA, HIPAA compliance and the EU Data Boundary do not apply to Copilot’s generated web search queries; prompts and responses sit under enterprise data protection, the DPA and the Product Terms.
- Keeping web search on, turning it off, or turning it off in Work mode only is a choice that privacy, compliance and counsel sign, with IT stating how the platform behaves.
- With no Allow web search in Copilot policy configured, Microsoft says web search stays available unless the optional connected experiences policy is set to Disabled; for GCC and DoD, Microsoft says it is off by default.
- A Purview DLP rule for the Copilot location can stop Copilot using labeled files and emails, and those items can still appear in citations.
- A DLP rule can block web search for prompts that carry sensitive information types; blocking the response to such prompts is marked preview.
- DLP does not scan files uploaded into prompts, and neither control changes who can open a file.
Frequently Asked Questions
Does Microsoft’s Data Protection Addendum cover Copilot web search queries?
No, according to Microsoft: its web search page says the DPA does not apply to the generated web search queries Copilot sends to Bing, and it says the same of HIPAA compliance and the EU Data Boundary. Microsoft says those queries fall under the Microsoft Services Agreement and the Microsoft Privacy Statement, with added commitments in the Product Terms and Microsoft acting as a data controller. What that means for your organization is a question for privacy, compliance and counsel.
Is Copilot web search on by default?
Microsoft says that when the Allow web search in Copilot policy is left unconfigured, users of Microsoft Copilot and Microsoft Copilot Chat have web search, unless the Office policy for optional connected experiences is set to Disabled. For GCC and DoD, Microsoft says web search is available but turned off by default, and its Copilot service description says web grounding is not enabled by default for government clouds.
Can DLP stop Copilot from using files labeled Highly Confidential?
Yes, as Microsoft describes it: a Purview DLP policy on the Copilot location with a sensitivity label condition stops Copilot from using the content of files and emails that carry the chosen label, such as Highly Confidential. For email, Microsoft lists coverage of emails sent on or after January 1, 2025. The items can still appear in the citations of a response, and in Word, Excel and PowerPoint the policy is evaluated when the file is opened.
Can a DLP policy block Copilot web search when a prompt contains sensitive data?
Yes: Microsoft documents a DLP rule on the Copilot location that detects chosen sensitive information types in the text of a prompt and blocks external web search for that prompt, while Copilot still answers from permitted internal Microsoft 365 sources. A rule cannot combine that condition with a sensitivity label condition, and DLP does not scan files uploaded into the prompt.
Setting Copilot Guardrails Your Owners Can Sign
If privacy, compliance and counsel need a written account of how Copilot web search and DLP behave in your tenant before they sign a choice, the next step is a conversation about your current settings.
