💡 Our Technical Review in summary
Summary
An issue was identified in Microsoft 365 Copilot Chat where Data Loss Prevention (DLP) policies and sensitivity labels were not being correctly enforced for messages residing in Exchange Online Sent Items and Drafts folders. Due to a code error, Copilot was able to process and reference content from these specific folders even when administrative policies were configured to restrict such access based on sensitivity labels.
Impact
Users leveraging the Microsoft 365 Copilot “work tab” Chat may have seen information from their own protected Sent or Draft messages included in Copilot prompt responses. This impact was limited to:
- Messages within the user’s own Sent Items and Drafts folders.
- Messages with sensitivity labels applied and Copilot DLP policies configured.
No other folders or cross-user data access were reported as part of this incident.
Status
Service Restored. Microsoft has successfully deployed a targeted fix across all impacted environments, addressing the underlying code issue. Additionally, a comprehensive retroactive sync was performed to ensure the fix applies to previously affected messages.
- Incident Duration: January 21, 2026, to February 24, 2026.
- Resolution: The root cause has been mitigated, and DLP policies are now correctly honored for all Exchange Online folders.
Microsoft Official Issue Details
User Impact
Users’ Copilot prompts return information from Sent and Draft folder messages with Copilot DLP policies configured.
Status: serviceRestored
Service: Microsoft 365 Copilot Chat
Classification: advisory
Origin: microsoft
Updates
- 2026-02-24 06:05
Title: Some users’ Copilot prompts return information from Sent and Draft folder messages with Copilot DLP policies configuredUser impact: Users’ Copilot prompts return information from Sent and Draft folder messages with Copilot DLP policies configured.
More info: This issue was specific to Exchange Online email messages that were in the Sent Items and Drafts folders. The Microsoft 365 Copilot “work tab” Chat may have processed these email messages for the user that owned them even though these email messages had a sensitivity label applied, a Copilot DLP policy is configured.
Final status: We have successfully deployed a targeted fix across all impacted environments. The root cause has been addressed, and customers should not experience this issue with email messages going forward.
Scope of impact: Impact was specific to users leveraging Microsoft 365 Copilot Chat with email messages in their Drafts or Sent Items folder with a sensitivity label applied and a Copilot DLP policy configured.
Start time: Wednesday, January 21, 2026, at 7:25 AM UTC
End time: Tuesday, February 24, 2026, at 12:09 AM UTC
Root cause: A code issue was allowing items in the Sent items and Draft folders to be picked up by Copilot even though confidential labels are set in place.
Next steps:
– We are refining our procedures to make our service even more resilient moving forward.This is the final update for this event.
- 2026-02-20 01:03
Title: Some users’ Copilot prompts return information from Sent and Draft folder messages with Copilot DLP policies configuredUser impact: Users’ Copilot prompts return information from Sent and Draft folder messages with Copilot DLP policies configured.
More info: This issue is specific to Exchange Online email messages that are in the Sent Items and Drafts folders. The Microsoft 365 Copilot “work tab” Chat may process these email messages for the user that owns them even though these email messages have a sensitivity label applied and a Copilot DLP policy is configured.
Current status: Our targeted code fix to prevent further impact is moving forward and has saturated across the majority of affected environments. Our deployment remains in progress only for a small section of our more complex service environments. As such, we believe the root cause of this issue has been addressed for most customers, and no new email messages for customers who have received the fix will be affected moving forward.
We’re now completing a longer-term, comprehensive sync to apply this fix retroactively to previously affected messages within the Sent and Draft folders to fully remediate the impact.
Scope of impact: Impact is specific to users leveraging Microsoft 365 Copilot Chat with email messages in their Drafts or Sent Items folder with a sensitivity label applied and a Copilot DLP policy configured. This section may be updated as our investigation continues.
Start time: Wednesday, January 21, 2026, at 7:25 AM UTC
Root cause: A code issue is allowing items in the Sent items and Draft folders to be picked up by Copilot even though confidential labels are set in place.
Next update by: Tuesday, February 24, 2026, at 7:30 AM UTC
- 2026-02-19 08:33
Title: Some users’ Copilot prompts return information from Sent and Draft folder messages with Copilot DLP policies configuredUser impact: Users’ Copilot prompts return information from Sent and Draft folder messages with Copilot DLP policies configured.
More info: This issue is specific to Exchange Online email messages that are in the Sent Items and Drafts folders. The Microsoft 365 Copilot “work tab” Chat may process these email messages for the user that owns them even though these email messages have a sensitivity label applied and a Copilot DLP policy is configured.
Current status: We’ve received feedback from some affected users that the deployment fix has resolved impact. We’re monitoring the fix as it fully saturates in the remaining affected environments, and we expect full remediation by our next scheduled update.
Scope of impact: Users leveraging Microsoft 365 Copilot Chat may notice that email messages in their Drafts or Sent Items folder may be referenced in prompt responses even though these messages may have a sensitivity label applied and a Copilot DLP policy configured. This section may be updated as our investigation continues.
Start time: Wednesday, January 21, 2026, at 7:25 AM UTC
Root cause: A code issue is allowing items in the Sent items and Draft folders to be picked up by Copilot even though confidential labels are set in place.
Next update by: Tuesday, February 24, 2026, at 7:30 AM UTC
- 2026-02-19 02:27
Title: Users may notice Copilot prompts returning information from Sent and Draft folder messages with DLP policies configuredUser impact: Users may notice Copilot prompts returning information from Sent and Draft folder messages with DLP policies configured.
More info: This issue is specific to Exchange Online email messages that are in the Sent Items and Drafts folders. The Microsoft 365 Copilot “work tab” Chat may process these email messages for the user that owns them even though these email messages have a sensitivity label applied and a DLP policy is configured.
Current status: We have completed deployment of the fix and we’re working with affected users to confirm that the issue is mitigated.
Scope of impact: Users leveraging Microsoft 365 Copilot Chat may notice that email messages in their Drafts or Sent Items folder may be referenced in prompt responses even though these messages may have a sensitivity label applied and a DLP policy configured. This section may be updated as our investigation continues.
Start time: Wednesday, January 21, 2026, at 7:25 AM UTC
Root cause: A code issue is allowing items in the Sent items and Draft folders to be picked up by Copilot even though confidential labels are set in place.
Next update by: Thursday, February 19, 2026, at 9:30 AM UTC
- 2026-02-18 17:12
Title: Users’ sent and draft folder messages with confidential labels may be incorrectly processed by Microsoft Copilot chatUser impact: Users’ sent and draft folder messages with confidential labels may be incorrectly processed by Microsoft Copilot chat.
More info: This issue is specific to Exchange Online email messages that are in the Sent Items and Drafts folders. The Microsoft 365 Copilot “work tab” Chat may process these email messages for the user that owns them even though these email messages have a sensitivity label applied and a DLP policy is configured.
Current status: We’re continuing to monitor the final stages of our fix deployment as it saturates throughout the remaining affected infrastructure. Once this saturation is complete, we’ll reach out to additional users to verify impact has been remediated as expected.
Scope of impact: Users leveraging Microsoft 365 Copilot Chat may notice that email messages in their Drafts or Sent Items folder may show up despite them having a sensitivity label applied and a DLP policy configured. This section may be updated as our investigation continues.
Start time: Wednesday, January 21, 2026, at 7:25 AM UTC
Root cause: A code issue is allowing items in the sent items and draft folders to be picked up by Copilot even though confidential labels are set in place.
Next update by: Thursday, February 19, 2026, at 9:30 AM UTC
- 2026-02-18 10:14
Title: Users’ sent and draft folder messages with confidential labels may be incorrectly processed by Microsoft Copilot chatUser impact: Users’ sent and draft folder messages with confidential labels may be incorrectly processed by Microsoft Copilot chat.
More info: This issue is specific to Exchange Online email messages that are in the Sent Items and Drafts folders. The Microsoft 365 Copilot “work tab” Chat may process these email messages for the user that owns them even though these email messages have a sensitivity label applied and a DLP policy is configured.
Current status: We’re proceeding to monitor the deployment of the fix as it progresses and are reaching out to a subset of users to test for impact remediation. We expect to have an estimated time for completion by our next scheduled update.
Scope of impact: Users leveraging Microsoft 365 Copilot Chat may notice that email messages in their Drafts or Sent Items folder may show up despite them having a sensitivity label applied and a DLP policy configured. This section may be updated as our investigation continues.
Start time: Wednesday, January 21, 2026, at 7:25 AM UTC
Root cause: A code issue is allowing items in the sent items and draft folders to be picked up by Copilot even though confidential labels are set in place.
Next update by: Wednesday, February 18, 2026, at 7:00 PM UTC
- 2026-02-10 18:22
Title: Users’ sent and draft folder messages with confidential labels may be incorrectly processed by Microsoft Copilot chatUser impact: Users’ sent and draft folder messages with confidential labels may be incorrectly processed by Microsoft Copilot chat.
More info: This issue is specific to Exchange Online email messages that are in the Sent Items and Drafts folders. The Microsoft 365 Copilot “work tab” Chat may process these email messages for the user that owns them even though these email messages have a sensitivity label applied and a DLP policy is configured.
Current status: Deployment of our fix to remediate incorrect processing of email messages with a confidential label by Microsoft 365 Copilot chat is ongoing, and we’re reaching out to a subset of affected users to test for impact remediation as our rollout saturates across affected environments. We aim to provide a timeline to remediation as one becomes available.
Scope of impact: Users leveraging Microsoft 365 Copilot Chat may notice that email messages in their Drafts or Sent Items folder may show up despite them having a sensitivity label applied and a DLP policy is configured. This section may be updated as our investigation continues.
Start time: Wednesday, January 21, 2026, at 7:25 AM UTC
Root cause: A code issue is allowing items in the sent items and draft folders to be picked up by Copilot even though confidential labels are set in place.
Next update by: Wednesday, February 18, 2026, at 11:00 AM UTC
- 2026-02-03 10:41
Title: Users’ sent and draft folder messages with confidential labels may be incorrectly processed by Microsoft Copilot chatUser impact: Users’ sent and draft folder messages with confidential labels may be incorrectly processed by Microsoft Copilot chat.
More info: This issue is specific to Exchange Online email messages that are in the Sent Items and Drafts folders. The Microsoft 365 Copilot “work tab” Chat may process these email messages for the user that owns them even though these email messages have a sensitivity label applied and a DLP policy is configured.
Current status: We’ve identified a code issue that is allowing items in the Sent Items and Drafts folders to be picked up by Copilot even though confidential labels are set in place. We’ve developed and started to deploy a fix to mitigate impact.
Scope of impact: Users leveraging Microsoft 365 Copilot Chat may notice that email messages in their Drafts or Sent Items folder may show up despite them having a sensitivity label applied and a DLP policy configured. This section may be updated as our investigation continues.
Root cause: A code issue is allowing items in the sent items and draft folders to be picked up by Copilot even though confidential labels are set in place.
Next update by: Tuesday, February 10, 2026, at 7:00 PM UTC
- 2026-02-03 08:49
Title: Users’ sent and draft folder messages with confidential labels may be incorrectly processed by Microsoft Copilot chatUser impact: Users’ sent and draft folder messages with confidential labels may be incorrectly processed by Microsoft Copilot chat.
More info: This issue is specific to Exchange Online email messages that are in the Sent Items and Drafts folders. The Microsoft 365 Copilot “work tab” Chat may process these email messages for the user that owns them even though these email messages have a sensitivity label applied and a DLP policy is configured.
Current status: We’re continuing our review email message examples and other documentation provided by some affected users to identify the root cause of impact and mitigation plan.
Scope of impact: Users leveraging Microsoft 365 Copilot Chat may notice that email messages in their Drafts or Sent Items folder may show up despite them having a sensitivity label applied and a DLP policy configured. This section may be updated as our investigation continues.
Next update by: Tuesday, February 3, 2026, at 11:00 AM UTC
- 2026-02-03 07:29
Title: Users’ sent and draft folder messages with confidential labels may be incorrectly processed by Microsoft Copilot chatUser impact: Users’ sent and draft folder messages with confidential labels may be incorrectly processed by Microsoft Copilot chat.
More info: This issue is specific to Exchange Online email messages that are in the Sent Items and Drafts folders. The Microsoft 365 Copilot “work tab” Chat may process these email messages for the user that owns them even though these email messages have a sensitivity label applied and a DLP policy is configured.
Current status: We’ve received reports of an issue with the Microsoft 365 Copilot chat improperly summarizing email messages. We’re reviewing some sample email messages to identify the underlying root cause of impact and inform our next steps.
Scope of impact: Users leveraging Microsoft 365 Copilot Chat may notice that email messages in their Drafts or Sent Items folder may show up despite them having a sensitivity label applied and a DLP policy configured. This section may be updated as our investigation continues.
Next update by: Tuesday, February 3, 2026, at 9:00 AM UTC
