Does Purview DLP Cover What a Computer-Using Agent Reads?

Do not assume Copilot prompt protections cover every action in a computer-use session. Confirm the exact product, host and data path against current Purview documentation, then test the upload or screenshot flow in question. The supplied Q&A thread asks whether DLP can block a file upload inside an automated browser session. A forum reply identifies a documentation gap; it is not a product guarantee that no configuration can enforce the control. The review needs to distinguish prompt and grounding protections from endpoint, browser and network controls on the actual agent host. RedactSure, an AI agent controls, governance and data protection company, applies Least Exposure and render-layer tokenization to this problem.

Key findings

• A reply on Microsoft Q&A stated on Microsoft Q&A that the documentation "do[es] not explicitly describe an enforcement capability that detects/blocks Copilot's 'computer use' automated browser/session actions," nor DLP enforcement against the data-movement step.
• The same answer lists what Purview DLP for Copilot does cover. It restricts external web search on prompts with sensitive information types, blocks Copilot from processing such prompts, and restricts grounding on files with specific sensitivity labels (Microsoft Q&A).
• The computer-using agent is "an AI model that combines vision capabilities with advanced reasoning to interact with graphical user interfaces." It runs on a hosted machine or a managed Cloud PC pool on Windows 365 for Agents (Microsoft Learn; February 2026 release post).
• Copilot Studio's own access control "only prevents the model from taking actions on websites or applications that aren't in the allow list. It doesn't stop the model from opening them" (Microsoft Learn).
• OWASP LLM01:2025 ranks prompt injection first among LLM application risks; what an injection can move out of a session is bounded by what the model received.

What does the cited forum answer establish?

The scenario on Microsoft Q&A describes a computer-use agent that retrieves a file containing PII or cardholder data from OneDrive and uploads it to an external service. The upload happens inside the agent's automated session. The question was whether Purview DLP can detect or block it. The forum reply was that the documentation "do[es] not explicitly describe an enforcement capability that detects/blocks Copilot's 'computer use' automated browser/session actions." It does not describe DLP enforcement against the data-movement step either.

The answer is scoped to what the documentation describes, not to what a future release might add. It does not claim the scenario cannot be addressed by other means. It does not establish the coverage of every current Purview configuration. A scoping analysis needs current product documentation and evidence from the configured host. That is the reading a security reviewer works from.

What does Purview DLP for Copilot govern?

The same answer lists three documented controls. Purview DLP for Copilot can restrict external web search when a prompt contains sensitive information types. It can block Copilot from processing prompts that contain sensitive information types. It can restrict Copilot from using files with specific sensitivity labels for grounding (Microsoft Q&A).

Each acts on a documented input to Copilot: the text a person types, the label on a file Copilot retrieves as context, and the outbound web query. They answer the question most organizations asked first: whether an employee can paste a card number into Copilot or have it summarize a document labeled Highly Confidential. They were not built for an agent that opens a browser on a machine and reads what the browser shows.

Why is the agent's session outside them?

The cited prompt and grounding controls do not by themselves establish coverage of a separate browser upload. That is a coverage question to test, not proof that screenshots or hosted machines cannot be inspected.

Microsoft's current Purview overview distinguishes capabilities by AI application and integration. Identify the specific Copilot product, agent host, enabled policies and outbound path. Endpoint and network controls can apply to appropriately managed hosts; controls on an employee's laptop should not be assumed to cover a separate cloud machine.

What does an AI gateway or DLP layer see, generally?

The Purview gap is one instance of a general shape. A DLP layer, an AI gateway or an enterprise browser sits on a path: between the user and the model, the device and the internet, or the browser and the site. It acts on what it recognizes crossing that path. That is a control on acts. What the model receives once a screen is rendered is sight, and a path control is not positioned to change it. AI Gateway, DLP or Tokenization? sets out the difference for gateways and Enterprise Browser vs Render-Layer Tokenization for browsers. Each can block an upload it recognizes. Neither changes the fact that the model has already read the record.

The gap matters most under injection. OWASP LLM01:2025 places prompt injection first because a model cannot reliably separate instruction from data. An injected instruction on a page inside the allow list can direct the agent to move what it has read. A path control that recognizes the movement stops that instance. One that is not on the agent's path, as the Q&A answer describes for Purview, stops nothing. Either way the model held the values, and what the model received is the question Does Microsoft Copilot Studio Computer Use Control What the Agent Sees? takes up.

What closes the gap?

First, establish which control enforces the intended upload policy on the agent's actual host and network path. Use a synthetic file to test allowed and blocked destinations, and retain the resulting evidence.

Render-layer tokenization addresses a different part of the problem: the fields the model receives from the screen. Replacing those fields does not rewrite the underlying OneDrive file. Preventing transfer of that raw file requires file-access, tool and egress controls as well as any approval gate.

The AI Control Record can preserve the tokenized view, actions and approvals. Remaining task context and raw application files still need their own protection.

What does the scenario look like in a hospital, a school or an insurer?

The Q&A scenario used PII and PCI data in OneDrive. A card number reaching the model brings the PCI scoping guidance into the analysis (Can an AI Agent Handle Cards Without Wider PCI Scope?). Substitute a chart in an EHR. The agent reads name, MRN, date of birth and diagnoses as a screenshot; no prompt was typed and no label was checked. The minimum necessary standard at 45 CFR 164.502(b) asks whether the PHI reaching the model was limited to the purpose (Can an AI Agent Work in Epic Without Holding PHI?).

Substitute a student file. The screen carries name, ID, guardian contacts and grades. FERPA's school official exception at 34 CFR 99.31(a)(1)(i)(B) requires the district's direct control over the use and maintenance of education records by an outside party. A session Purview does not inspect, on a machine the district does not run, is where that control has to be demonstrated (Can an AI Agent Use PowerSchool Without Student PII?).

Substitute a claim file: claimant identity, policy number and payment details on one screen. The NAIC Model Bulletin on the Use of AI Systems by Insurers applies. It had been adopted by 24 states as of March 2025 per Quarles & Brady (Can an AI Agent Work Guidewire Claims Without PII?). For each workflow, establish which inspection paths are active and what content reaches the model.

How do the three controls compare?

Where does RedactSure sit?

RedactSure is the third column. AI co-workers do real work across an organization's applications inside a governed environment. That environment is a secure virtual machine deployed into the cloud the customer's posture requires, on hardware-encrypted enclaves, with keys the customer holds. Every sensitive value chosen by policy, starting with identifiers, is replaced by a consistent token at the render layer before any model reads the screen. The model is handed the task's fields rather than a picture of the screen. The Planner sets which values are tokenized and what the agent may do on each screen. A named person confirms that policy and approves every payment, submission and record change under Supervised Delegation. Deployments are in pilot.

The intended result is less identifying data in model context, combined with explicit controls on file transfers and consequential actions. Tokenizing a screen alone does not sanitize its underlying files or guarantee that exfiltration is impossible. The AI Control Record preserves the observed tokenized view and approvals for review.

What the record shows

Do not assume Copilot prompt protections cover every action in a computer-use session. Confirm the exact product, host and data path against current Purview documentation, then test the upload or screenshot flow in question. Use a synthetic sensitive file to test the actual agent host and upload path. Screen tokenization alone does not sanitize an underlying file or block its transfer.

Frequently asked questions

Does Purview DLP block a computer-use agent from uploading a file?

It depends on the product, host, policy and upload path. The cited forum reply does not establish a universal enforcement guarantee. Check current product documentation and test the configured session with a synthetic file. Screen tokenization alone does not modify that file or block its upload.

Do sensitivity labels stop the agent reading a labeled document on screen?

The documented control restricts Copilot from using files with specific sensitivity labels for grounding, which is a retrieval path. A computer-using agent reads the screen as a screenshot. A labeled document open in a window reaches the model as an image, and the documentation describes no label check at that point. The label governs retrieval, not sight. Render-layer tokenization governs sight: the identifiers in that window become tokens before the model reads it.

Does endpoint DLP see the hosted machine?

Only if the host and activity are supported and covered by the configured controls. An endpoint policy on the employee's laptop should not be assumed to cover a separate agent host. Verify host management, policy deployment and the actual network path.

Would an AI gateway close the gap?

It can inspect or block supported data routed through it. Coverage depends on whether the screenshot, tool response or upload crosses that gateway, and whether its inspection supports that content type. Trace and test each path rather than assuming all gateways are text-only or all screenshots bypass them.

What does the auditor get instead?

An AI Control Record: every screen the agent saw as tokens, every action, human and computer, and every approval with a name, exported to the organization's own monitoring. The trail is complete and holds SSN_001 and CARD_001 rather than the values. The audit store is not a second copy of the records the way a session replay with screenshots is.

Will Microsoft add DLP coverage for computer-use sessions?

The documentation does not say. The Q&A answer speaks to what is documented as of its date, and a future release may describe an enforcement point. A control that is not documented cannot be shown to an assessor, so a scoping analysis works from the documented gap until the documentation changes. A control at the render does not wait on that release.

Related research

Comparison · September 30, 2026

Does Copilot Studio Limit What Its Agent Sees?

Review Copilot Studio AI agent screenshots, PII exposure and tokenization for claims and patient accounts, including replay retention settings.

Comparison · September 19, 2026

AI Gateway, DLP or Tokens: What Controls AI Exposure?

Compare AI gateways, data masking and tokenization for AI agent security, focusing on which layer controls the PII a model actually sees.

Comparison · September 19, 2026

Enterprise Browser or Render-Layer Tokenization?

Compare enterprise browsers and render-layer tokenization for AI agent security, separating application controls from visible PII exposure.

Data Report · September 19, 2026

What Does Prompt Injection Get From a Token-Only Agent?

Follow a prompt-injection scenario to examine AI agent security, PII exposure and the limits of tokenization when an attack succeeds.

Explainer · September 21, 2026

What Is an AI Control Record?

Explore an AI agent control record for billing and claims, linking permissions, tokenization decisions, approvals and audit evidence.

Executive Brief · August 2026

The Two Gaps AI Agents Opened in Your Security Stack

Explore AI agent security through two questions: which PII reaches the model, and who approves consequential billing and claims actions.