Is it possible to use the NOT operator to eliminate the builtin SITs that get detected but are not a part of the policy?

Question

Is it possible to use the NOT operator to eliminate the builtin SITs that get detected and are not a part of the policy? I'm using a DLP policy and location is , "Microsoft 365 Copilot and Copilot Chat". It seems that the NOT operator doesn't work for this location setting, but works for other locations like Email...

So in summary: In DLP policy selecting location - Microsoft 365 Copilot and Copilot Chat

Content Type:

SS#

Passport#

Credit Card#

NOT

Full Names

Poland Passport

Hong Kong Identity Card

etc

Answer 1

For the Microsoft 365 Copilot and Copilot Chat DLP location, the supported conditions and actions are limited and don't include using NOT to filter out specific built-in sensitive information types (SITs).

For this location, the only supported condition types are:

• Content contains > Sensitivity labels
• Content contains > Sensitive information types

And the supported action is:

• Prevent Copilot from processing content (either processing prompts, or processing files/emails with certain sensitivity labels)

The documentation for this location doesn't describe support for complex boolean logic (such as nested groups with NOT) the way general DLP policy design does. The boolean and nested-group capabilities (including using NOT to replace Exceptions) are documented for DLP policies in general, but the Copilot-specific location has its own, narrower list of supported conditions and actions.

Therefore, for Microsoft 365 Copilot and Copilot Chat:

• It isn't supported to use NOT to exclude specific SITs (such as Full Names, Poland Passport, Hong Kong Identity Card) from detection while including others in the same rule.
• To control which SITs are enforced, configure the rule to include only the SITs that should be blocked (for example, SSN, Passport, Credit Card) rather than trying to include a broad set and then exclude unwanted ones with NOT.

If more granular logic is required (for example, complex combinations of SITs and NOT conditions), that behavior is available in other locations (such as Exchange email) but not in the Copilot-specific DLP location.

---

References:

• Learn about using Microsoft Purview Data Loss Prevention to protect interactions with Microsoft 365 Copilot and Copilot Chat
• Design a data loss prevention policy
• Use named entities in your data loss prevention policies
• Outlook DLP policy tips not working for certain conditions in email body and attachments