In This Article
- What Microsoft published on October 8 and October 13
- Why external email is the soft spot for Copilot prompt injection
- Step one: turn on the External tag
- Four layers, four different jobs
- What changes for a loan officer, and what stays the same
- Step two: test the Purview policy in simulation
- Questions to prepare for your board and examiners
- How ABT helps financial institutions
- Frequently Asked Questions
Among the first things people at a credit union, bank, or mortgage company ask Microsoft 365 Copilot to do is read their mail: summarize the inbox, catch up on a thread, draft the reply. A lot of that mail comes from outside the institution, from borrowers, brokers, title companies, vendors, and examiners. In one week this month, Microsoft published two pieces about that mail as a route for Copilot prompt injection, where text planted in a message tries to change what Copilot does. Each one points at a setting your administrators control.
On October 13, a Microsoft Copilot Blog post described an isolation layer Microsoft is introducing in Microsoft 365 Copilot. In that layer, untrusted content, such as email from outside the organization, goes through a separate, restricted path, and Copilot's main model works from a transformed version of it. Where the layer is available, the switch is Outlook's external sender tagging, the step Microsoft names in its guidance for the Outlook Copilot vulnerability CVE-2026-55145. On October 8, Microsoft published a walkthrough of a Microsoft Purview Data Loss Prevention (DLP) condition, still in preview, that keeps outside mail out of what Copilot reads altogether.
The External tag keeps outside mail usable in Copilot, and one PowerShell line turns it on. The DLP condition is quick to set up and blunt in its effect, so Microsoft's instructions start with simulation mode, a test run that shows the impact before you enforce it. Copilot is mainstream now: Microsoft reported more than 30 million paid Microsoft 365 Copilot seats in its July 2026 results. For a regulated institution, the question has moved from whether to turn it on to what it's allowed to read.
ABT, a Tier-1 Microsoft Cloud Solution Provider serving more than 750 financial institutions, puts Microsoft Purview data loss prevention, sensitivity labels, and access controls in place before Copilot is switched on, as part of Microsoft 365 Guardian. The DLP condition below joins that set when your institution chooses it, and the External tag is your first step.
A processor receives what looks like a routine note from a vendor. Hidden in the message is text that tells any AI assistant to ignore its instructions and surface the recipient's recent internal updates. That afternoon she asks Copilot to summarize her inbox. The note is a Copilot prompt injection attempt, and Microsoft's October 8 post uses a version of this example.
With neither setting in place, the message is part of what Copilot can draw on to answer (its grounding data), and its planted instructions can shape the summary. With the External tag on, and where Microsoft's isolation layer is available, the layer is built to pass Copilot a transformed version that seeks to drop the malicious content. With the DLP condition enforced, the message is excluded from Copilot's grounding, summarization, and citation. Either way, the message stays in her inbox for her to read and answer.
What Microsoft published on October 8 and October 13
The October 8 post on the Microsoft Security Community Blog is a setup guide for a Purview control that first appeared in preview in Microsoft's June 2026 Purview release notes. The matching Microsoft Learn page, updated October 5, calls it "Block external email from being processed (preview)" and says it applies to Microsoft 365 Copilot and Copilot Chat, including the email summarization and reasoning experiences.
The condition is "Email is received from > External users," in the "Microsoft 365 Copilot and Copilot Chat" policy location. Microsoft's stated purpose is to keep external email out of what Copilot grounds its answers on, "reducing the risk of cross-prompt injection, while keeping everyday work uninterrupted." When the condition matches:
- External mail leaves the grounding set. A message from a sender outside your accepted domains is excluded from grounding, summarization, and citation, while internal email, files, and permitted web results keep working.
- The user is told. Copilot shows a notice that some content was excluded by an organizational policy, and its "Learn about access restrictions" link can open a page you choose.
- Only sender metadata is read. The sender's domain is compared with the tenant's accepted domains. In Microsoft's words, "the body of the email is not inspected."
- Mail and mailboxes stay as they were. "The policy does not affect mail flow, delivery, or retention," and users "can still read, reply to, forward, and manage all their external emails as they always have."
The October 13 post, on the Microsoft Copilot Blog, starts from a Copilot prompt injection problem that permissions leave open: "These attacks can occur entirely within existing permissions," while authentication, access governance, and data loss prevention "may still function as designed." Microsoft's answer is "a deterministic enforcement layer in M365 Copilot between retrieved content (tool outputs) and the primary large language model." Outside email can be classified as untrusted, "routed through a quarantined, capability-constrained processing path," and turned into a transformed version for the main model. Trusted content passes through unchanged.
Microsoft is direct about the limits. The post says "no single mitigation prevents every indirect prompt injection attempt," describes a layer that "Microsoft 365 Copilot is introducing," and says the initial work focuses on "high-risk content, including external communications." To turn it on, the post points tenants to the Outlook sender setting and the CVE-2026-55145 guidance.
Two new features, and what to record in your change log
Microsoft Learn says of the DLP condition, "This feature is in preview," and gives no general-availability date. The October 13 post says of the isolation layer, "Availability and behavior may vary by release status and tenant environment." Turn each setting on with a test plan, and record each feature's status on the day you enabled it, so an auditor reading the entry next year sees what you knew at the time.
Why external email is the soft spot for Copilot prompt injection
Prompt injection is the attack where text an AI model reads changes what the model does. The OWASP Top 10 for LLM Applications (2025) puts it first on the list. Its definition of the indirect form is the one that matters here: "Indirect prompt injections occur when an LLM accepts input from external sources, such as websites or files." Email is an external source your staff ask Copilot to read, and anyone on the internet can send it.
The clearest proof came from Microsoft itself: CVE-2025-32711, a Critical information-disclosure flaw in Microsoft 365 Copilot published in June 2025 and since fully mitigated by Microsoft, which the Aim Labs researchers who reported it named EchoLeak. Our April article on the Copilot prompt injection risk walks through how a single email set it off.
"Because current mitigations do not offer full protection against all attacker techniques, application designers may design systems with the assumption that prompt injection attacks are possible if a model is exposed to untrusted input sources."
Read that sentence the way a CISO would: assume the injection will arrive, and limit what the model can reach when it does. Both settings Microsoft described in October apply that idea to email, the input any stranger can put in a loan officer's inbox.
Those figures describe what criminals already do with email. Copilot is now a second reader of that same mail.
Step one: turn on the External tag
CVE-2026-55145 is an Outlook Copilot tampering vulnerability that Microsoft released with its July 14, 2026 security updates. Microsoft rates it Moderate, with a CVSS base score of 6.3, lists it as not exploited and not publicly disclosed, and marks it as requiring customer action. The action is in the entry's FAQ:
"Customers can help protect themselves by enabling Outlook's external sender tagging feature to identify untrusted content. This enables Microsoft's provided mitigations to isolate and safely process the untrusted content before it is provided to Microsoft 365 Copilot."
The setting is the native External tag, a tenant-wide Exchange Online setting our September guide to Exchange Online mail flow rules covered as a phishing control. Two PowerShell commands matter here: Get-ExternalInOutlook shows where your tenant stands, and Set-ExternalInOutlook -Enabled $true adds an External icon near the subject line of outside mail in Outlook for Windows, Mac, the web, iOS, and Android. Microsoft says users can take between 24 and 48 hours to see it. A visible tag confirms the setting, and Microsoft says the isolation layer's availability may vary by tenant. The October 13 post gives the tag a second job, and the CVE entry has listed it as the customer action since July 14.
Two details belong in the change ticket. If your tenant already runs a mail flow rule that writes [EXTERNAL] into subject lines, Microsoft's instruction is to disable those rules before you enable the native tag, to avoid duplication. And the tag's allow list exempts named senders and domains, up to 200 entries, so treat that list as part of the same decision: review it in the same change, with an owner and a reason for each entry.
Four layers, four different jobs
Microsoft describes a layered approach to securing Copilot, and for Copilot prompt injection that arrives by email, there are now four layers to know by name. Each one's own documentation states its limits.
| Layer | Where it runs | What Microsoft says it does | Limits Microsoft states |
|---|---|---|---|
| Microsoft Defender for Office 365 Plan 2, prompt injection protection (added July 2026) | The mail filter, before delivery | Detects prompt injection content in inbound email; verdict High confidence phishing, detection technology "Prompt injection protection" | It "isn't intended to block every instruction-like phrase." It focuses on data exfiltration through a URL, revealing the system prompt, or discovering the assistant's tools. |
| Microsoft 365 Copilot's own classifiers | Inside the Copilot service, at the prompt | Jailbreak and cross-prompt injection attack (XPIA) classifiers help block high-risk prompts before the model runs | "These classifiers may not be available in all Microsoft Copilot scenarios." |
| Copilot's isolation layer for untrusted content (described October 13, 2026), turned on through the External tag | Between retrieved content and Copilot's main model | Routes untrusted content, such as outside email, through a restricted path and passes the main model a transformed version | "Availability and behavior may vary by release status and tenant environment." |
| Purview DLP, "Email is received from > External users" (preview) | The grounding layer, when Copilot chooses what to read | Excludes mail from outside the accepted domains from grounding, summarization, and citation | It reads only the sender's domain. The message body, mailbox, mail flow, and retention stay as they were. |
The filter layer arrived in July, when Microsoft added prompt injection detection to Defender for Office 365 Plan 2; our July guide to that detection covers what it looks for. Microsoft keeps its scope focused, so a message that reads like an ordinary request can pass. Microsoft 365 Business Premium includes Plan 1, and Microsoft's Defender Suite for Business Premium add-on brings Plan 2, so whether your plan includes it is the first thing to check.
Together they are defense in depth, and each one is a separate license line, setting, or line in the evidence you hand an examiner. On a tenant ABT manages, the license lines and the settings you control come through one relationship. ABT, a Tier-1 Microsoft Cloud Solution Provider, quotes Microsoft 365 Copilot at Microsoft price as its own line and configures Microsoft Purview data loss prevention and Microsoft Defender for Office 365 as part of every Microsoft 365 Guardian level.
The four layers answer four questions an IT committee asks about a Copilot prompt injection attempt.
Did the filter stop it? That's Defender for Office 365 Plan 2. Did Copilot refuse it? That's Microsoft's classifiers.
Did Copilot see only a processed version? That's the isolation layer, and the External tag is the part you switch on. Did Copilot read it at all? That's the Purview condition, and ABT adds it to Microsoft 365 Guardian's Copilot guardrails where your institution chooses it, after a simulation run shows what it will cost your lending team.
What changes for a loan officer, and what stays the same
Start with what stays the same, because it's most of the day. Every external message still arrives and can still be read, forwarded, and answered. Copilot still summarizes internal threads, reads the SharePoint and OneDrive files the user can already open, and searches the web if your tenant allows it. Turning on the External tag adds one thing staff can see: an External label on outside mail.
The DLP condition, once enforced, changes one kind of request. "Summarize my inbox" and "catch me up on the Henderson closing" will skip the title company's, the appraiser's, and the borrower's messages, because every one of them comes from outside your accepted domains. Copilot tells the user that content was excluded, and the user can open the thread and read it the way they did before Copilot.
For a member services desk whose mail is mostly internal, the loss is small. For a mortgage pipeline that runs on outside email, it's most of what staff would ask Copilot to summarize, and that's the reason to run simulation mode before anyone enforces anything.
Two more consequences follow from the mechanism. The test is the sender's domain, so a trusted partner is external in exactly the same way as a stranger. And "internal" describes where a message came from, a separate question from what it contains: a message a colleague forwards from outside arrives as internal mail, and a compromised internal mailbox sends internal mail.
The other layers in the table above, plus the Microsoft Entra ID Conditional Access and multi-factor authentication baseline that makes an internal mailbox harder to take over in the first place, still carry their share. That baseline is part of every Microsoft 365 Guardian level.
Step two: test the Purview policy in simulation
Microsoft's setup is short. You need an account with the Compliance Administrator or Data Loss Prevention administrator role, or an equivalent Purview role, and a correctly configured list of accepted domains, because that list is the whole definition of "internal."
In the Purview portal, open Data Loss Prevention, then Policies, and create a policy from the Custom template as a Custom policy.
On the Locations page, turn on the "Microsoft 365 Copilot and Copilot Chat" location. Every other location is disabled for this policy.
Add a rule with the condition "Email is received from," set to "External users," and the action "Prevent Copilot from processing content."
Deploy in simulation mode and review the impact. Allow up to four hours for any change to reach Copilot.
Once the results match what you expect, turn the policy on, and point the policy tip's link at a page that explains the rule to your staff.
Simulation mode is where the decision gets made. Microsoft's instruction is to assess "where external email is important to business workflows" and to apply the protection only where it is relevant, which makes the test a business review, with a DLP report as its evidence. On the tenants ABT manages, that review is where the institution decides whether the condition is enforced at all. Look at it the way an examiner would read it afterwards:
- Which teams would lose the most grounding, and what share of their mail is external?
- Which external domains appear most? Partner domains such as title companies and appraisal management firms are the ones your staff will ask about.
- What does the exclusion notice say, and where does its "Learn about access restrictions" link send people?
- Who receives the DLP alerts and notifications, and who reads them?
- What is the rollback? Turning the policy off is a policy update, and Microsoft says updates can take up to four hours to reach Copilot.
Plan for a policy managed at the tenant level and owned by one named person. The Learn page says the Copilot location doesn't support admin units, and Microsoft's October 9 update to Message Center notice MC1486284 withdrew an October 2 plan to add them.
The external-email condition is the fourth protection in the Copilot DLP location. Our May guide to Purview DLP for AI covers the other three (sensitive prompts, sensitive information in web search, and sensitivity labels) and which plans unlock the full set. Check that Purview entitlement separately from the Copilot license, which can sit on Business Premium, Business Standard, or Business Basic for Microsoft Copilot Business, or on E3 and E5 for the enterprise license, per Microsoft's licensing page.
Questions to prepare for your board and examiners
For AI specifically, the financial sector now has a framework to point to. On February 19, 2026, the U.S. Department of the Treasury released the Financial Services AI Risk Management Framework alongside a shared AI lexicon, as one of two resources to guide AI use in financial services. Treasury describes it this way:
"The FS AI RMF provides practical tools and reference materials to help institutions evaluate AI use cases, manage risks across the AI lifecycle, and embed accountability, transparency, and resilience into AI deployment decisions."
ABT reads a framework built around AI use cases and lifecycle risk as a reason to document what your AI assistant reads. ABT recommends six questions that turn this article's settings into evidence for a board packet or an examination:
- Is the External tag on, which senders are on its allow list, and who approved each entry?
- Which Purview DLP policies for the Copilot location are enforced, which are in simulation, and who owns each one?
- What may Copilot read in our tenant, and what have we excluded: external email, labeled files, sensitive prompts, web search?
- How would we know a policy fired? Where do the DLP alerts go, and who reviews the Copilot security dashboard in the Microsoft 365 admin center?
- What do staff see when content is excluded, and where does the policy tip send them?
- What did the simulation run show, who approved enforcement, and how do we roll it back?
How ABT helps financial institutions
Founded in 1999, ABT is a Tier-1 Microsoft Cloud Solution Provider primarily dedicated to financial services. It serves more than 750 of them and manages Microsoft 365 tenants for credit unions, banks, and mortgage companies.
Microsoft 365 Guardian puts a governed tenant before AI: every Guardian level starts with a hardened Microsoft 365 tenant that includes Microsoft Purview data loss prevention and Microsoft Defender for Office 365 configuration. ABT configures the Purview DLP policies for the Copilot location on tenants where Microsoft 365 Copilot is licensed and the Purview entitlement is in place. The external-email condition joins that set the way this article describes it: simulation first, a business review, then enforcement where the institution chooses it, with a named owner. Bring the External tag into that same review: where it stands today, which subject-line rules it would replace, and who owns each allow-list entry.
- Before Copilot: the AI Readiness Assessment scans your Microsoft 365 tenant for shadow AI use, audit gaps, and Copilot-readiness blockers, then gives you a 90-day plan.
- With Copilot: Microsoft Copilot Business or Microsoft 365 Copilot, quoted at Microsoft price as its own line, deployed on a tenant whose Purview and Defender settings have already been set.
- After Copilot: Guardian watches for configuration drift (settings silently weakening over time), the risk to a DLP policy that was enforced in October and still needs to be when the examiner asks in March.
ABT's free Guardian Security Assessment reviews your Microsoft 365 tenant configuration, identifies security gaps, and delivers a prioritized hardening roadmap. The AI Readiness Assessment answers the narrower question this article raises: what your Copilot is allowed to read today, and what it should be.
Decide what Copilot may read before your examiner asks
Start with the AI readiness scan to see how Guardian hardens identity, devices, and data, then governs Copilot with Purview. Then talk with ABT about Copilot Business, the Purview policies for the Copilot location, and the external-email test described in this article.
Frequently Asked Questions
The Purview DLP policy keeps email from senders outside your tenant's accepted domains out of the data Microsoft 365 Copilot and Copilot Chat read to answer a prompt. Those messages are excluded from grounding, summarization, and citation. Internal email, files, and permitted web results still work, and the user sees a notice that an organizational policy excluded some content.
No. Microsoft says the policy operates only at the Copilot grounding layer. Mail flow, delivery, and retention are unchanged, and users can still read, reply to, forward, and manage all of their external email as they always have. The change is that Copilot stops reading those messages when it summarizes or reasons over the mailbox.
CVE-2026-55145 is an Outlook Copilot tampering vulnerability Microsoft released on July 14, 2026, rated Moderate with a CVSS score of 6.3 and not exploited. Microsoft's guidance is to turn on Outlook's external sender tagging with Set-ExternalInOutlook -Enabled $true, which Microsoft says enables its mitigations, where available, to isolate untrusted content before Microsoft 365 Copilot uses it.
Microsoft Learn lists the Copilot external email DLP condition as a preview feature. The condition first appeared in preview in Microsoft's June 2026 Purview release notes, and the October 8, 2026 setup guide gives no general-availability date. Microsoft recommends deploying it in simulation mode first, and policy changes can take up to four hours to reach Copilot.
Defender for Office 365 Plan 2 has detected prompt injection in inbound email since July 2026, classing it as high confidence phishing. Microsoft says it currently focuses on attempts to exfiltrate data through a URL, reveal the system prompt, or discover tools. Business Premium includes Plan 1, and the Defender Suite for Business Premium add-on brings Plan 2.
Microsoft's page on DLP for the Copilot location points to the Microsoft 365 enterprise plan comparison and service descriptions for licensing. ABT's May 2026 guide explains which plans unlock the full set. Check your Purview entitlement separately from your Copilot license, which can sit on Business Premium, Business Standard, Business Basic, E3, or E5.