Topic starter
02/06/2026 6:53 pm
TL;DR: Cyera says Microsoft Purview labeling leaves about 40% of M365 files outside label-based DLP, including CSVs, ZIPs, screenshots, source code, and image-based PDFs that Copilot can still read when permissions allow. The governance gap is content-based enforcement across file types labels cannot reach, not discovery alone.
Editorial analysis by NHI Mgmt Group, based on content published by Cyera: “Secure M365 Files that Sensitivity Labels Can't Reach with Cyera Omni DLP”.
By the numbers:
- Purview policies do not cover 40% of your files in M365.
- Cyera says Microsoft Purview labeling leaves about 40% of M365 files outside label-based DLP.
Key questions
Q: What breaks when sensitivity labels cannot be applied to common file types?
A: The label-driven control chain breaks at the point where the file cannot be classified into the policy model.
Q: Why do unlabeled M365 files create Copilot risk even when permissions are correct?
A: Copilot inherits the same permissions users already have, so access alone does not solve the governance problem.
Q: How should security teams govern sensitive data across mixed file formats?
A: Use content-based policy rather than label-only policy.
Practitioner guidance
- Map the unlabeled file estate Inventory CSV, ZIP, image, code, and image-based PDF files that hold sensitive data but cannot take sensitivity labels, then quantify where they sit in SharePoint, OneDrive, and connected stores.
- Test Copilot access against unlabeled content Validate whether Copilot can surface sensitive data from files that are permissioned but unlabeled, especially exports and screenshots that bypass label-triggered DLP.
- Move policy from labels to content Define protection rules on the data element itself, such as PII, financial records, source code, or regulated data, so the same rule applies regardless of file format.
Bottom line: Sensitivity labels leave a structural blind spot in M365 when file formats cannot be labeled, and that blind spot becomes more visible once Copilot inherits user permissions.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/06/2026 7:05 pm
Label coverage is not control coverage: This article exposes a basic governance error in M365 programmes, which is assuming that a sensitivity label model defines the full policy boundary. It does not. When file formats cannot be labeled, the downstream DLP and Copilot protections attached to labels disappear with them. Practitioners should treat label-driven security as one control layer, not the control plane.
A few things that frame the scale:
- Internal repositories are 6x more likely to contain secrets than public ones (32.2% vs 5.6%), contradicting the assumption that private repos are safe, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: What is the difference between label-based DLP and content-based DLP?
A: Label-based DLP depends on a file first receiving a sensitivity label, so it works best where the label structure is supported. Content-based DLP evaluates the data itself and can enforce policy across labeled and unlabeled files, which makes it better suited to mixed enterprise file estates.
👉 Read our full editorial: M365 label gaps leave sensitive files outside Copilot controls