Protect sensitive data in Microsoft Teams and Copilot environments with Trellix DLP Endpoint for Windows

Trellix DLP capabilities are extended to Microsoft Teams and Microsoft Copilot in Microsoft Installer X/Universal Windows Platform(MSIX/UWP) style. This feature effectively monitors and blocks the exfiltration of classified data across Microsoft collaboration environments. You can configure the rules using the Application File Access Protection (AFAPR) module to block unauthorized file uploads.

Benefits

File upload oversight — Monitor files as they move in and/or out of the Teams and Copilot environment. Prevents unauthorized attachment of classified files during Teams event scheduling and within MS Calendar.
Copilot interaction security — Secure data flow within AI-driven workflows for data uploads or text copying.
Storage integrity — Blocks sensitive file uploads to OneDrive and SharePoint when initiated through the Teams interface.
External risk mitigation — Restricts the sharing of classified data with guest and external accounts to prevent outside leakage.
Channel protection — Monitors and stops prohibited file uploads via drag-and-drop or standard attachments.
Inbound Data Control — Prevents the pasting of classified files into Teams from unmanaged or external applications.
System boundary security — Stops unauthorized drag-and-drop file transfers between the Teams ecosystem and the local file system.
Exfiltration prevention — Disables print actions on classified content to ensure sensitive data remains within the digital environment.

Limitations

Text input blocking and monitoring
Several specific use cases involving integrated third-party apps, content redaction in AI summaries, and certain calendar content blocking.

Setting up Application File Access Protection rules for Microsoft Teams and Copilot

This section helps you create an Application File Access Protection (AFAP) rule in Trellix ePO On-prem to control how users interact with sensitive files within these tools.

It provides the instructions to configure classifications, rules, exceptions, and incident reporting before deploying the updated policy to target Windows endpoints.

Task

Step1. Create an application template for Microsoft Teams/Microsoft Copilot

You must add application definitions for legacy and current versions of Microsoft Teams/Microsoft Copilot to your AFAP rule.

In Trellix ePO On-prem, select Menu → Data Protection → DLP Policy Manager → Definitions → Application Template.
Select Actions → New Item, or edit an existing application template.
Enter a name and description for the application template.
Add the executable file property:
1. Select Executable File Name from the properties list.
2. Select Equals and enter msedgewebview2.exe in the value field.
Add the command line property for the application:
1. Select Command Line from the properties list.
2. Select Contains and enter one of the following values:
  - For Microsoft Teams (MS Teams):
    --webview-exe-name=ms-teams.exe
  - For Microsoft Copilot (MS Copilot):
    --webview-exe-name=M365Copilot.exe
Select Save.

Step 2. Update default Trellix DLP Ignored Processes to improve endpoint performance

Update the default ignored process list in Trellix ePO under Windows Client Configuration → Content Tracking → Ignored Processes.

Process Name	Folder	All Files	Specific Extensions	Empty Extension	Web	App	File
msedgewebview2.exe	%LOCALAPPDATA%\Packages	check		check	uncheck	check	check
ms-teams.exe	%LOCALAPPDATA%\Packages	check		check	uncheck	check	check
update.exe	%LOCALAPPDATA%\squirreltemp	uncheck	.log	uncheck	uncheck	check	check
m365copilot.exe	%WINDIR%\system32\	Uncheck	.dll,.json,.mui,.nls	uncheck	Uncheck	Check	Check
m365copilot.exe	%ProgramFiles%\windowsapps\	Uncheck	.dll,.mui,.pri,.js,.png	uncheck	Uncheck	Check	Check
m365copilot.exe	%LOCALAPPDATA%\microsoft\windows\caches\	Uncheck	.db	uncheck	Uncheck	Check	Check
m365copilot.exe	%LOCALAPPDATA%\microsoft\oneauth\	check		check	Uncheck	Check	Check
m365copilot.exe	%LOCALAPPDATA%\microsoft\identitycache\	Uncheck	.db	uncheck	Uncheck	Check	Check
m365copilot.exe	%ProgramFiles(x86)%\microsoft\edgewebview\application\	Uncheck	.dll,.dat,.exe	uncheck	Uncheck	Check	Check
m365copilot.exe	%ProgramData%\microsoft\windows\apprepository\packages\	Uncheck	.dat	uncheck	Uncheck	Check	Check
m365copilot.exe	%LOCALAPPDATA%\microsoft\tokenbroker\cache	Uncheck	.tbres	uncheck	Uncheck	Check	Check
m365copilot.exe	%WINDIR%\fonts	Uncheck	.ttf	uncheck	Uncheck	Check	Check
m365copilot.exe	%APPDATA%\microsoft\windows\recent\customdestinations	Uncheck	.customdestinations-ms,.tmp,.temp	uncheck	Uncheck	Check	Check
m365copilot.exe	%userprofile%\AppData\LocalLow\microsoft\cryptneturlcache\metadata	Uncheck		check	Uncheck	Check	Check
msedgewebview2.exe	%WINDIR%\prefetch\	Uncheck	.pf	uncheck	Uncheck	Check	Check
msedgewebview2.exe	%LOCALAPPDATA%\microsoft\tokenbroker\cache	Uncheck	.tbres	uncheck	Uncheck	Check	Check
msedgewebview2.exe	%ProgramFiles(x86)%\microsoft\edgewebview\application\	Uncheck	.json	uncheck	Uncheck	Check	Check
msedgewebview2.exe	%LOCALAPPDATA%\microsoft\oneauth\accounts\	Uncheck		check	Uncheck	Check	Check
msedgewebview2.exe	%LOCALAPPDATA%\d3dscache\	Uncheck	.lock,.idx,.val	uncheck	Uncheck	Check	Check
msedgewebview2.exe	%ProgramFiles%\windowsapps\	Uncheck	.dll,.mui,.pri,.js,.png	uncheck	Uncheck	Check	Check
runtimebroker.exe	%WINDIR%\system32\	Uncheck	.dll,.exe	uncheck	Uncheck	Check	Check
runtimebroker.exe	%ProgramData%\microsoft\windows\apprepository\packages\	Uncheck	.pckgdep	uncheck	Uncheck	Check	Check
runtimebroker.exe	%APPDATA%\microsoft\systemcertificates\	Uncheck		check	Uncheck	Check	Check
backgroundtaskhost.exe	%WINDIR%\system32\	Uncheck	.dll,.mui	uncheck	Uncheck	Check	Check
backgroundtaskhost.exe	%ProgramData%\microsoft\windows\apprepository\packages\	Uncheck	.dat,.log,.log1	uncheck	Uncheck	Check	Check
backgroundtaskhost.exe	%LOCALAPPDATA%\packages\	check		check	Uncheck	Check	Check
backgroundtaskhost.exe	%ProgramData%\microsoft\windows\caches\	Uncheck	.db	uncheck	Uncheck	Check	Check

Step 3. Create an Application File Access Protection rule

Create an AFAPR to block or monitor data copying and uploads to Microsoft Teams/Microsoft Copilot.

In DLP Policy Manager, select Rule Sets.
Select Actions → New Rule → Application File Access Protection to create or edit a rule.
Set State to Enabled.
Select Trellix DLP Endpoint for Windows.
Select the Classifications tab.
Configure the target application:
- To block data uploads or text copying to Microsoft Teams, select MS Teams in Applications.
- To block data uploads or text copying to Microsoft Copilot, select MS Copilot in Applications.
Select the Exceptions tab, then select Add Rule Exception to configure exceptions.
Set State to Enabled and select the classification.

Under Reactions, configure the action and select the check boxes in Report Incident.
Select Save.

Step 4. Apply policy changes

For information, see Assign and push a policy to a system.

Result: When the end user uploads a file, the file itself is not blocked, but the content inside the file appears blank.

Supported policy enforcement options

As a DLP Administrator, you can manage the sharing of sensitive content across these relevant business platforms and applications to ensure data security. The following table lists the available policy enforcement options for data protection.

Configuration Option	Vector	Enforcement Result
Meeting Attachment Protection	Microsoft Teams Events/Meetings	Blocks classified attachments and notifies the user.
Calendar Protection	Microsoft Calendar	Blocks classified attachments and notifies the user.
Cloud Storage Upload Control	OneDrive/SharePoint	Blocks classified file uploads and notifies the user.
External Sharing Control	Guest/External Accounts	Blocks unauthorized file shares and notifies the user.
Chat Attachment Control	Teams Chat/Channels	Blocks drag-and-drop or file uploads and notifies the user.
Screen Capture Restriction	Microsoft Teams Microsoft Copilot	Restricts screen capture of classified data and notifies the user.
Clipboard Protection	Microsoft Copilot External/Unmanaged Apps	Blocks paste actions into Teams and notifies the user.
File Movement Control	Microsoft Teams Microsoft Copilot to File System	Blocks drag-and-drop transfers and notifies the user.
Print Control	Microsoft Teams Microsoft Copilot	Prevents printing of classified content and notifies the user.