Purview DLP Blocks Copilot Web Search, Claude Code Hardens Fast

Purview DLP Now Blocks Copilot from Sending Sensitive Data to the Web

The signal that matters most to any M365 Copilot deployment right now: the Microsoft 365 Roadmap added DLP control over external web search in Microsoft 365 Copilot and Copilot Chat, published June 26 with a GA date of July 2026.

What changed is specific. When Copilot or a Copilot Studio agent performs a Bing-grounded web search, Purview DLP can now inspect the outbound query in real time and block it if it contains content that matches a sensitive information type — SSNs, contract terms, health data, whatever your DLP policies already classify. The agent doesn't leak the data; the search just doesn't fire.

Why this matters: every client we've helped deploy Copilot has had at least one stakeholder ask, "What happens when someone asks Copilot to summarize a confidential document and Copilot decides to search the web for more context?" Until now the answer required either disabling web search entirely or accepting the risk. This control closes that gap without killing grounding capability.

What to do: if your Copilot rollout is still in pilot, don't wait for GA. Build your sensitive information type taxonomy now — the DLP policies you've already written for Exchange and SharePoint are the same policies that will govern this. Clients who skipped that foundational Purview work are the ones who will still have an answer gap in August. If you're in a regulated vertical and running GCC-High, watch the roadmap item for GCC-High parity dates before committing to a timeline with your ISSO.

Claude Code Ships Seven Releases in Ten Days — the Governance-Critical Ones

Seven Claude Code releases dropped between June 17 and June 26. Most are quality-of-life. Three are governance-critical for any team running Claude Code in an enterprise deployment.

Credential isolation in the sandbox. v2.1.187 added sandbox.credentials — a setting that blocks sandboxed shell commands from reading credential files and secret environment variables. It also added org-configured model restrictions enforced at the CLI, the --model flag, and the ANTHROPIC_MODEL env var. If you run Claude Code in CI pipelines or in shared dev containers, this is the release that lets you stop using network-level controls as a substitute for process-level isolation.

OTel response logging with a safe-default trap. v2.1.193 introduced claude_code.assistant_response as an OpenTelemetry log event. The default is redacted — but if your deployment already sets OTEL_LOG_USER_PROMPTS=1, assistant responses will start flowing into your telemetry pipeline automatically on upgrade unless you explicitly set OTEL_LOG_ASSISTANT_RESPONSES=0. Review your OTel config before pushing this version to production. Teams with a SIEM ingesting Claude Code telemetry need to know whether response content is now in the stream.

MCP server CLI authentication. v2.1.186 added claude mcp login and claude mcp logout with --no-browser stdin redirect for SSH environments. This matters for engineering teams connecting to internal MCP servers over bastion hosts — previously the auth flow assumed a browser was available. Pair this with the hook-matcher exact-match fix in v2.1.195, which corrects a bug where hyphenated MCP server names like mcp__brave-search could substring-match unintended permission rules.

Auto-mode destructive command blocking. v2.1.183 — published June 19 — is the one that changes what an agentic Claude Code session can do without explicit instruction. git reset --hard, git clean -fd, terraform destroy, pulumi destroy, and cdk destroy are now blocked in auto mode unless the user explicitly requested the destructive action. If you've been running Claude Code agents in CI with auto mode and broad repo permissions, this is a meaningful safety boundary that was missing before.

The Fable Export Control Story Has Operational Implications

The US government export control that restricted a Claude model family generated significant industry noise. The operational takeaway for enterprise architects is narrower than the headlines.

Simon Willison's coverage of Kate Moussouris's assessment makes the underlying dynamic clear: the "jailbreak" that triggered the restriction was a multi-step manual process where researchers asked the model to "fix this code" on deliberately vulnerable code after it refused a direct security-review prompt. Moussouris, who reviewed the White House report at Anthropic's request, characterized it as the model working as intended.

What this means for a CIO considering Anthropic for a security operations use case: the model's refusal behavior on security-adjacent prompts is real, and it can create friction in legitimate vulnerability research and secure code review workflows. If your engineering team is evaluating Claude Code for a red team pipeline or a code security review workflow, test the specific prompts your team will actually use before committing to a deployment architecture. The fallback behavior introduced in the Anthropic Python SDK v0.108.0 — server-side and client-side fallbacks for refusals — is worth understanding in that context as well.

Purview Lifecycle Management Adds Copilot-Aware Retention Insights

Quieter but worth tracking: the Microsoft 365 Roadmap item 561209 entered preview in June and targets GA in August. It surfaces usage insights for Copilot and AI app interactions and generates retention policy recommendations from that usage. For compliance teams that have been asking how to bring AI interaction logs under the same retention governance as email and Teams messages, this is the native path — no custom connectors.

The companion item, roadmap ID 561208, extends retention-based file archiving to OneDrive and SharePoint with a Copilot-relevance signal: inactive content moves to low-cost storage but stays discoverable and stays in Copilot's grounding index. That's a combination that matters at scale — a 20,000-seat tenant with undisciplined OneDrive sprawl is also a tenant where Copilot search results degrade over time as the signal-to-noise ratio drops.

Watch next week for any Microsoft announcement on GCC-High parity for the Purview DLP web search control, and for whether the Commerce Department meetings Anthropic's safety team attended in D.C. produce any updated guidance on the Fable model availability status.