Prompt injection risk (PuzzleMask) in M365 email + Copilot — Recommendation and mitigation guidance request

The most direct documented tenant-side mitigation for PuzzleMask-style email injection is to exclude externally received email from Microsoft 365 Copilot processing with a Microsoft Purview DLP policy, while retaining Defender for Office 365 detection and Copilot audit monitoring as additional layers.

1. Exclude external email from Copilot grounding

This preview control applies to Microsoft 365 Copilot and Copilot Chat, including email summarization and reasoning. It compares the sender domain with your tenant’s accepted domains; it does not inspect the message body. Matching external email is excluded from grounding, summarization, and citations, while users can still read the message normally.^1^

Before configuring it:

• Confirm the feature has reached your tenant and that your Copilot/Purview licensing covers the DLP location.
• Use a least-privileged documented role such as Microsoft Entra AI Admin, Purview Data Security AI Admin, Purview Compliance Administrator, or Purview Compliance Data Administrator. Avoid Global Administrator solely for this task.^1^

Configure the policy:

1. Open the Microsoft Purview portal.
2. Go to Data Loss Prevention → Policies → Create policy.
3. Select Custom → Custom policy.
4. Enable the Microsoft 365 Copilot and Copilot Chat location.
5. Add a rule with:
   • Condition: Email is received from → External users
   • Action: Prevent Copilot from processing content
6. Start in test mode if that option is available in your tenant, validate expected exclusions, and then enable enforcement.

This broad control is appropriate where external email is considered untrusted. The trade-off is that Copilot can no longer summarize legitimate customer, partner, or supplier email.

2. Use email-layer detection in Defender for Office 365

Microsoft Defender for Office 365 Plan 2 detects prompt-injection content in inbound email before delivery to a mailbox or AI assistant. This complements Copilot’s runtime safeguards, which include input filtering, separation of content from system instructions, grounding boundaries, and output filtering.^2^

The documentation establishes this as a Plan 2 protection but does not identify a separate customer policy toggle or configuration path. Therefore:

• Verify that affected users are covered by Defender for Office 365 Plan 2.
• Review Defender incidents and alerts for prompt-injection detections rather than creating an undocumented mail-flow rule.
• Do not rely on this detector alone. PuzzleMask specifically targets lightweight classification by hiding intent in ordinary prose, so signature or formatting-oriented inspection may miss variants.^3^

3. Monitor Copilot interactions and investigate detections

If Microsoft Purview auditing is enabled, Microsoft Copilot interactions are logged automatically.^4^

In the Microsoft Purview portal → Audit:

1. Search the suspected time range and affected users.
2. Filter for Copilot activity; the relevant operation is CopilotInteraction.
3. Open or export matching records.
4. Inspect:
   • Messages.JailbreakDetected for a detected malicious prompt.
   • AccessedResources.XPIADetected for cross-prompt injection detected in a retrieved email, file, or other resource.
   • AccessedResources, AppHost, AgentId, and PolicyDetails to identify what content was accessed, where the interaction occurred, and whether DLP restricted it.

Also review Defender XDR incidents because Microsoft exposes classifier signals through Defender and Purview audit logging.^5^

4. Contain confirmed malicious email safely

For a confirmed campaign, use Microsoft Defender portal → Explorer, identify the messages, and initiate remediation. Prefer moving messages or soft delete initially.^6^

Before bulk remediation, validate the query against a small sample, preserve evidence required by incident-response or retention policy, and obtain the appropriate incident-owner or compliance approval. Hard delete can remove legitimate messages if campaign matching is too broad and may be effectively irreversible in normal user workflows. The documented Search and Purge permissions and approval workflow are required for relevant remediation actions.

Security Copilot scope

The external-email DLP rule above governs Microsoft 365 Copilot and Copilot Chat, not Security Copilot agents. Security Copilot has separate guardrails; its agents use managed identities or user accounts and must be constrained through agent-specific RBAC, data-source access, tool permissions, and human oversight for consequential actions.^7^

For Security Copilot agents, apply least privilege to each agent identity and minimize irreversible tool actions. Do not assume Microsoft 365 Copilot email-exclusion policies automatically govern an agent’s plugins or connected data sources.

References

1. Learn about using Microsoft Purview Data Loss Prevention to protect interactions with Microsoft 365 Copilot, Copilot Chat, and Cowork
2. Prompt injection protection in Microsoft Defender for Office 365
3. PuzzleMask: Abusing Plain Prose as a Covert AI Attack Vector
4. Audit logs for Copilot and AI applications
5. Microsoft Copilot prompt defense in depth
6. Remediate malicious email delivered in Office 365
7. Application card: Microsoft Security Copilot agents