2.4 How Data Protection Restricts Prompt Results

Microsoft AI Business Professional AB-730

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

0.1 About the AB-730 Exam 0.2 How to Use This Study Guide

2 Chapter 1: Understand Generative AI Capabilities Across Microsoft 365

1.1 How Copilot Works: LLMs, Microsoft Graph & the Security Boundary 1.2 Context & Grounding: Work Files, Web Data and App Context 1.3 Chat Experiences vs. Agent Experiences 1.4 When to Create Your Own Agent 1.5 Copilot Capabilities Across Microsoft 365 Apps

3 Chapter 2: Responsible AI & Data Protection Practices

2.1 Generative AI Risks: Fabrications, Prompt Injection & Over-Reliance 2.2 Verification Steps: Citation Checks & Human Review 2.3 Recognizing & Mitigating Risks to Sensitive Data 2.4 How Data Protection Restricts Prompt Results

4 Chapter 3: Creating and Managing Prompts

3.1 Creating an Effective Prompt: The GCSE Framework 3.2 Selecting Resources to Reference in a Prompt 3.3 Saving and Sharing Prompts in Copilot Prompt Gallery 3.4 Scheduling Prompts

5 Chapter 4: Managing Conversations and Notebooks

4.1 Finding Previous Conversations 4.2 Renaming and Deleting Chats 4.3 Adding a Conversation to a Copilot Notebook

6 Chapter 5: Creating and Managing Microsoft 365 Copilot Agents

5.1 Agent Store vs. Creating a New Agent 5.2 Creating an Agent from a Template 5.3 Configuring an Agent That Has Knowledge 5.4 Configuring Instructions, Capabilities & Suggested Prompts 5.5 Sharing an Agent with Team Members

7 Chapter 6: Drafting and Analyzing Business Content

6.1 Creating a New Document from a Prompt 6.2 Generating a Document from an Existing Document 6.3 Generating a Management Summary 6.4 Moving Data & Insights Between Microsoft 365 Apps 6.5 Drafting Communications with Copilot in Outlook

8 Chapter 7: Meetings, Collaboration and Personalization

7.1 Using Copilot for Meetings: Setup & Live Intelligence 7.2 Meeting Recap, Transcripts & Catch-Up 7.3 Copilot Pages for Collaboration 7.4 How Copilot Uses Memory & Instructions

2.4 How Data Protection Restricts Prompt Results

Key Takeaways Explain This Topic AI

Copilot performs security trimming before generation: Microsoft Graph returns only items the signed-in user already has permission to open, so Copilot can never be used to escalate privilege.

A sensitivity label that applies encryption withholds content from Copilot unless the user holds the EXTRACT (copy) usage right on that label.

Content Copilot generates from labelled source material inherits the most restrictive label of the sources it used.

Microsoft Purview Data Loss Prevention policies can block Copilot from processing labelled content, which is why a user with file access can still receive an incomplete answer.

An empty or partial Copilot answer is a permissions and policy signal, not a product defect — the correct first response is to check access and labels, not to re-prompt.

Last updated: August 2026

2.4 How Data Protection Restricts Prompt Results

Quick Answer: Copilot never widens access. Every retrieval runs as the signed-in user, so Microsoft Graph security-trims results before the model sees them. On top of that identity check, encrypting sensitivity labels , the EXTRACT usage right, and Microsoft Purview DLP policies can each withhold content Copilot would otherwise be allowed to use. The visible symptom is always the same: a thin, partial, or empty answer.

The Enterprise Security Boundary & Security Trimming

Microsoft 365 Copilot operates entirely within the customer's dedicated Microsoft 365 enterprise tenant boundary. It adheres to all organizational compliance commitments and respects established data isolation protocols. +───────────────────────────────────────────────────────────────────────────+

| Security Trimming Execution Model |
| |
| [Authenticated User] ── (Signs in via Microsoft Entra ID) |
| │ |
| ▼ |
| [Prompt: "Summarize project budgets"] |
| │ |
| ▼ |
| [Microsoft Graph Security Trimming Engine] |
| │ |
| ├── File A (Public Project): [User has READ] ──> GROUNDED |
| ├── File B (Executive Comp): [User has NO ACC] ──> EXCLUDED |
| └── File C (HR Restricted): [User has NO ACC] ──> EXCLUDED |
| │ |
| ▼ |
| [Context Sent to LLM] ── Contains ONLY File A Data |
| │ |
| ▼ |
| [Copilot Output] ── Surfaces ONLY authorized information |
+───────────────────────────────────────────────────────────────────────────+
How Security Trimming Operates

Security Trimming is the foundational access control mechanism of Microsoft 365 Copilot:

User Context Execution : Every interaction with Copilot occurs exclusively within the security context of the authenticated user. Copilot does not possess administrative privileges, superuser access, or a separate service account.

Graph-Level Filtering : When a user submits a prompt, Microsoft Graph queries the organization's indexed data (SharePoint sites, OneDrive folders, Teams chats, Outlook mailboxes). Before any document is retrieved for grounding, the Graph engine validates the user's specific access control lists (ACLs).

Exclusion of Unauthorized Data : If a user does not have explicit Read permissions to a file, that file is completely invisible to Copilot during prompt processing. It cannot be used for grounding, summarized, or referenced in citations.

No Cross-Tenant or Public Model Training : Enterprise customer data processed by Copilot is never used to train, retrain, or fine-tune public foundation models (such as base OpenAI models). Data remains strictly within the tenant's compliance perimeter.

Note

Exam Concept: Copilot Cannot Bypass Permissions A core concept on Exam AB-730 is that Copilot never expands a user's permissions. If an employee cannot open a document in SharePoint, Copilot will never reveal its contents in chat or draft responses.

Encryption Labels and the EXTRACT Usage Right

Permission to open a file is not the same as permission for Copilot to reuse its contents. When a sensitivity label applies encryption, it also carries usage rights . Copilot must hold the EXTRACT right (often shown as "Copy" in label configuration) on behalf of the user before it can pull text out of that file and into a generated answer.

User situation Can the user open the file? Can Copilot use it in an answer?

No SharePoint permission No No — Graph returns nothing
Has permission, file unlabelled Yes Yes
Has permission, label encrypts, user has VIEW only Yes No — EXTRACT right is missing
Has permission, label encrypts, user has VIEW + EXTRACT Yes Yes
Has permission, but a DLP policy targets that label for Copilot Yes No — policy blocks processing

This table explains the scenario candidates find counter-intuitive: a user opens a document happily in Word, then asks Copilot to summarise it and is told the content is unavailable. Nothing is broken. The label grants reading but not extraction.

Label Inheritance on Generated Content

When Copilot draws on labelled material, the output is not laundered. The generated document, page, or summary inherits the most restrictive sensitivity label among the sources used. A draft assembled from one General memo and one Highly Confidential forecast emerges labelled Highly Confidential , carrying the encryption and sharing restrictions of that label with it.

On the Exam: Given a scenario where a user complains Copilot "ignored" a document they can clearly open, work the chain in order — Entra ID identity, SharePoint or OneDrive permission, encrypting label and EXTRACT right, then DLP policy. The first failing link is the answer.

Why This Design Matters

Security trimming is what makes broad Copilot deployment defensible. Because retrieval inherits existing access control lists, rolling Copilot out to ten thousand employees creates no new data path. It does, however, make pre-existing oversharing visible very quickly, which is the governance problem covered in section 2.3.

Diagnosing a Restricted Result in Order

When a user reports that Copilot "will not read" something, the fault is almost always in one of four layers, and they fail in a fixed order. Check them in that order rather than re-prompting.

# Layer Question to ask If this is the cause

1 Identity Is the user signed in with the correct work account? Personal-account sessions reach no organizational content at all

2 Permission Can the user open the item directly in SharePoint or OneDrive? Request access; Copilot cannot grant it

3 Label Does an encrypting sensitivity label apply, and does the user hold EXTRACT ? The label owner must adjust usage rights

4 Policy Does a Purview DLP policy target that label for Copilot? Compliance owns the exception, not the help desk

Re-prompting fixes none of these, and rewording a prompt to work around a restriction is the wrong instinct to build. If Copilot withheld content, the boundary did its job.