Configure data loss prevention policies for copilots

Organizational data is the most important asset administrators are responsible for safeguarding. The ability to build automation to use that data is a large part of their company's success.

You can rapidly build and roll out your high-value copilots for your end users. You can connect your copilots with many data sources and services. Some of these sources and services might be external, non-Microsoft services, and might even include social networks.

It's easy to overlook the potential for exposure. This sort of exposure can result from data leakage or connections to services and audiences that shouldn't have access to the data.

Administrators can govern copilots in your organization using data loss prevention (DLP) policies with existing and Copilot Studio connectors. DLP policies are created in the Power Platform admin center. To create a DLP policy, you need to be a tenant admin or have the Environment Admin role.

Prerequisites

• Review concepts about DLP policies

Copilot Studio connectors

Copilot Studio connectors can be classified within a DLP policy under the following data groups, which are presented in the Power Platform admin center when reviewing DLP policies:

• Business
• Non-business
• Blocked

You can use the connectors in DLP policies to protect your organization's data from any malicious or unintentional data exfiltration by your copilot makers.

Several Copilot Studio connectors are available in the Power Platform admin center. These connectors can be configured for DLP as follows:

Example DLP policy configurations

To help you get started with Copilot Studio copilot governance, we created the following examples that detail different scenarios:

• Data loss prevention example - Require end-user authentication in copilots
• Data loss prevention example - Block SharePoint knowledge source in copilots
• Data loss prevention example - Block Power Platform Connectors in copilots
• Data loss prevention example - Block HTTP requests in copilots
• Data loss prevention example - Block skills in copilots
• Data loss prevention example - Block channels to disable copilot publish

Use PowerShell to enable and administer DLP enforcement for copilots in your organization

You can configure whether DLP policies should be applied to your copilots with the PowerAppDlpErrorSettings and PowerVirtualAgentsDlpEnforcement PowerShell cmdlets.

You can:

• Confirm if DLP is enabled for copilots in your tenant.
• Enable or disable DLP in an auditing mode (-Mode SoftEnabled) so copilot makers can see errors, but aren't prevented from performing actions that would be blocked if DLP enforcement was fully enabled.
• Enable or disable DLP enforcement, to show DLP enforcement errors, and prevent copilot makers from publishing DLP-affected bots or configuring DLP-related settings.
• Exempt specific copilots from DLP enforcement.
• Add and update the learn-more and contact email links that are shown to copilot makers when they encounter DLP in the Copilot Studio web and Teams apps.

Typically, you would use these cmdlets in accordance with a DLP rollout process, which might consist of the following steps, in order:

1. Add or update the learn-more and admin contact email links that are shown in DLP errors for copilot makers.

2. Determine which (if any) copilots currently have DLP policy enforcement enabled.

3. Use auditing or "soft" mode so makers can see DLP errors in the Copilot Studio web and Teams apps.

4. Mitigate risk by contacting makers and informing them about the best course of action for their app or flow.

5. Enable DLP enforcement for copilots to prevent DLP-affected tasks and features.

You might also decide to exempt one or more copilots from DLP policy enforcement, depending on the copilot's use case and requirements.

Add and update the learn-more and admin contact email links

You can configure an email and learn-more link using the Set-PowerAppDlpErrorSettings PowerShell cmdlet. Your copilot makers will see this information when they experience DLP errors.

To add the email and learn-more link for the first time, run the following PowerShell script, replacing the values for the <email>, <URL>, and <tenant ID> parameters with your own.

$ContactDetails = [pscustomobject] @{
    Enabled=$true
    Email="<email>"
}
$ErrorMessageDetails = [pscustomobject] @{
    Enabled=$true
    Url="<URL>"
}
$ErrorSettingsObj = [pscustomobject] @{
    ErrorMessageDetails=$ErrorMessageDetails
    ContactDetails=$ContactDetails
}
New-PowerAppDlpErrorSettings -TenantId "<tenant ID>" -ErrorSettings $ErrorSettingsObj

To update an existing configuration, use the same PowerShell script, and replace New-PowerAppDlpErrorSettings with Set-PowerAppDlpErrorSettings.

Enable and configure DLP enforcement for copilots

You can enable, disable, configure, and audit DLP enforcement within Copilot Studio with the PowerVirtualAgentsDlpEnforcement cmdlet.

In any of the following examples, replace (or declare) <tenant ID> with your tenant's ID.

You can scope to copilots created after a certain date by replacing <date> with a date in the format MM-DD-YYYY. To remove the scope, delete the -OnlyForBotsCreatedAfter parameter and its value.

Confirm DLP enforcement for copilots

By default, DLP enforcement for copilots is disabled in all tenants.

You can run the following PowerShell cmdlet to check if DLP for Copilot Studio is enabled for a tenant.

Get-PowerVirtualAgentsDlpEnforcement -TenantId <tenant ID>

Use auditing or "soft" mode to see DLP errors in the Copilot Studio web or Teams apps

Run the following PowerShell script to enable DLP policies in auditing mode. Copilot makers will see DLP-related errors when configuring copilots in the Copilot Studio web and Teams apps, but they won't be blocked from performing DLP-related actions. Additionally, makers are unable to publish copilots while the "soft" mode is enabled.

Set-PowerVirtualAgentsDlpEnforcement -TenantId <tenant ID> -Mode SoftEnabled

To find copilots that could be impacted by your organization's existing DLP policies, you can:

1. Use the Center of Excellence (CoE) Starter Kit to get a list of copilots in your organization. Go to the Copilot Studio overview page on the CoE Dashboard to see the copilots and environment names in your organization.

   

2. Run a campaign with the copilot makers in your organization to address DLP errors or updated DLP policies. You can download all copilot DLP errors by selecting Details in the error notification banner and selecting Download from the error message details.

Enable DLP enforcement for copilots

You can run the following PowerShell command to enforce DLP policies in Copilot Studio. Copilot makers will be prevented from performing DLP-impacted actions, and end users will see errors if they trigger.

Set-PowerVirtualAgentsDlpEnforcement -TenantId <tenant ID> -Mode Enabled -OnlyForBotsCreatedAfter <date>

Exempt a bot from DLP policies

If you've enabled DLP enforcement for your tenant but you need to exempt a copilot from showing DLP errors to makers and users, you can run the following PowerShell script.

Make sure to replace <environment ID>, <bot ID>, <tenant ID>, and <policy ID> with the appropriate IDs for the copilot you want to exempt.

$environmentId = "<environment ID>" 
$botId = "<bot ID>"; 
$tenantId = "<tenant ID>" 
$policyName = "<policy ID>"

# Ensure the DLP commands are installed
if (-not (Get-Command "Get-PowerAppDlpPolicyExemptResources" -ErrorAction SilentlyContinue))
{
    Write-Host "Please ensure the Power Apps DLP commands are available: https://docs.microsoft.com/power-platform/admin/powerapps-powershell#environments-commands" -ForegroundColor Red
    return;
}
# Set up the PVA resource information
$pvaResourceId = "$environmentId+$botId"
$pvaResourceType = "Bot"
$exemptBot = [pscustomobject]@{
                id = $pvaResourceId
                type = $pvaResourceType
              }
Write-Host "Getting exempt resources"
$resources = Get-PowerAppDlpPolicyExemptResources -TenantId $tenantId -PolicyName $policyName
if (-not $resources)
{
    $resources = [pscustomobject]@{  exemptResources = @($exemptBot) }
    Write-Host "No exempt resources configured yet"
}
$resources = New-PowerAppDlpPolicyExemptResources -TenantId $tenantId -PolicyName $policyName -NewDlpPolicyExemptResources $resources
Write-Host "Added bot to exempt resources"

Disable DLP enforcement for copilots

The following command will disable DLP enforcement in copilots.

Set-PowerVirtualAgentsDlpEnforcement -TenantId <tenant ID> -Mode Disabled