---
title: "Protect sensitive data in Microsoft Teams and Copilot environments with Trellix DLP Endpoint for Windows"
slug: "dlp-endpoint-for-windows-11-14-1-features-1"
updated: 2026-11-05T14:30:37Z
published: 2026-11-05T14:30:37Z
canonical: "docs.trellix.com/dlp-endpoint-for-windows-11-14-1-features-1"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.trellix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Protect sensitive data in Microsoft Teams and Copilot environments with Trellix DLP Endpoint for Windows

Trellix DLP capabilities are extended to Microsoft Teams and Microsoft Copilot in Microsoft Installer X/Universal Windows Platform(MSIX/UWP) style. This feature effectively monitors and blocks the exfiltration of classified data across Microsoft collaboration environments. You can configure the rules using the Application File Access Protection (AFAPR) module to block unauthorized file uploads.

### Benefits

- **File upload oversight** — Monitor files as they move in and/or out of the **Teams** and **Copilot** environment. Prevents unauthorized attachment of classified files during Teams event scheduling and within MS Calendar.
- **Copilot interaction security** — Secure data flow within AI-driven workflows for data uploads or text copying.
- **Storage integrity** — Blocks sensitive file uploads to OneDrive and SharePoint when initiated through the Teams interface.
- **External risk mitigation** — Restricts the sharing of classified data with guest and external accounts to prevent outside leakage.
- **Channel protection** — Monitors and stops prohibited file uploads via drag-and-drop or standard attachments.
- **Inbound Data Control** — Prevents the pasting of classified files into Teams from unmanaged or external applications.
- **System boundary security** — Stops unauthorized drag-and-drop file transfers between the Teams ecosystem and the local file system.
- **Exfiltration prevention** — Disables print actions on classified content to ensure sensitive data remains within the digital environment.

### Limitations

- Text input blocking and monitoring
- Several specific use cases involving integrated third-party apps, content redaction in AI summaries, and certain calendar content blocking.

## Setting up Application File Access Protection rules for Microsoft Teams and Copilot

This section helps you create an **Application File Access Protection (AFAP)** rule in Trellix ePO On-prem to control how users interact with sensitive files within these tools.

It provides the instructions to configure classifications, rules, exceptions, and incident reporting before deploying the updated policy to target Windows endpoints.

### Task

#### Step1. Create an application template for Microsoft Teams/Microsoft Copilot

You must add application definitions for legacy and current versions of Microsoft Teams/Microsoft Copilot to your AFAP rule.

1. In Trellix ePO On-prem, select **Menu** → **Data Protection** → **DLP Policy Manager** → **Definitions** → **Application Template**.
2. Select **Actions** → **New Item**, or edit an existing application template.
3. Enter a name and description for the application template.
4. Add the executable file property:
  1. Select **Executable File Name** from the properties list.
  2. Select **Equals** and enter msedgewebview2.exe in the value field.
5. Add the command line property for the application:
  1. Select **Command Line** from the properties list.
  2. Select **Contains** and enter one of the following values:
    - For Microsoft Teams (MS Teams):

`--webview-exe-name=ms-teams.exe`
    - For Microsoft Copilot (MS Copilot):

`--webview-exe-name=M365Copilot.exe`
6. Select **Save**.

#### Step 2. Update default Trellix DLP Ignored Processes to improve endpoint performance

Update the default ignored process list in Trellix ePO under **Windows Client Configuration** → **Content Tracking** → **Ignored Processes**.

| **Process Name** | **Folder** | **All Files** | **Specific Extensions** | **Empty Extension** | **Web** | **App** | **File** |
| --- | --- | --- | --- | --- | --- | --- | --- |
| msedgewebview2.exe | %LOCALAPPDATA%\Packages | check |  | check | uncheck | check | check |
| ms-teams.exe | %LOCALAPPDATA%\Packages | check |  | check | uncheck | check | check |
| update.exe | %LOCALAPPDATA%\squirreltemp | uncheck | .log | uncheck | uncheck | check | check |
| m365copilot.exe | %WINDIR%\system32\ | Uncheck | .dll,.json,.mui,.nls | uncheck | Uncheck | Check | Check |
| m365copilot.exe | %ProgramFiles%\windowsapps\ | Uncheck | .dll,.mui,.pri,.js,.png | uncheck | Uncheck | Check | Check |
| m365copilot.exe | %LOCALAPPDATA%\microsoft\windows\caches\ | Uncheck | .db | uncheck | Uncheck | Check | Check |
| m365copilot.exe | %LOCALAPPDATA%\microsoft\oneauth\ | check |  | check | Uncheck | Check | Check |
| m365copilot.exe | %LOCALAPPDATA%\microsoft\identitycache\ | Uncheck | .db | uncheck | Uncheck | Check | Check |
| m365copilot.exe | %ProgramFiles(x86)%\microsoft\edgewebview\application\ | Uncheck | .dll,.dat,.exe | uncheck | Uncheck | Check | Check |
| m365copilot.exe | %ProgramData%\microsoft\windows\apprepository\packages\ | Uncheck | .dat | uncheck | Uncheck | Check | Check |
| m365copilot.exe | %LOCALAPPDATA%\microsoft\tokenbroker\cache | Uncheck | .tbres | uncheck | Uncheck | Check | Check |
| m365copilot.exe | %WINDIR%\fonts | Uncheck | .ttf | uncheck | Uncheck | Check | Check |
| m365copilot.exe | %APPDATA%\microsoft\windows\recent\customdestinations | Uncheck | .customdestinations-ms,.tmp,.temp | uncheck | Uncheck | Check | Check |
| m365copilot.exe | %userprofile%\AppData\LocalLow\microsoft\cryptneturlcache\metadata | Uncheck |  | check | Uncheck | Check | Check |
| msedgewebview2.exe | %WINDIR%\prefetch\ | Uncheck | .pf | uncheck | Uncheck | Check | Check |
| msedgewebview2.exe | %LOCALAPPDATA%\microsoft\tokenbroker\cache | Uncheck | .tbres | uncheck | Uncheck | Check | Check |
| msedgewebview2.exe | %ProgramFiles(x86)%\microsoft\edgewebview\application\ | Uncheck | .json | uncheck | Uncheck | Check | Check |
| msedgewebview2.exe | %LOCALAPPDATA%\microsoft\oneauth\accounts\ | Uncheck |  | check | Uncheck | Check | Check |
| msedgewebview2.exe | %LOCALAPPDATA%\d3dscache\ | Uncheck | .lock,.idx,.val | uncheck | Uncheck | Check | Check |
| msedgewebview2.exe | %ProgramFiles%\windowsapps\ | Uncheck | .dll,.mui,.pri,.js,.png | uncheck | Uncheck | Check | Check |
| runtimebroker.exe | %WINDIR%\system32\ | Uncheck | .dll,.exe | uncheck | Uncheck | Check | Check |
| runtimebroker.exe | %ProgramData%\microsoft\windows\apprepository\packages\ | Uncheck | .pckgdep | uncheck | Uncheck | Check | Check |
| runtimebroker.exe | %APPDATA%\microsoft\systemcertificates\ | Uncheck |  | check | Uncheck | Check | Check |
| backgroundtaskhost.exe | %WINDIR%\system32\ | Uncheck | .dll,.mui | uncheck | Uncheck | Check | Check |
| backgroundtaskhost.exe | %ProgramData%\microsoft\windows\apprepository\packages\ | Uncheck | .dat,.log,.log1 | uncheck | Uncheck | Check | Check |
| backgroundtaskhost.exe | %LOCALAPPDATA%\packages\ | check |  | check | Uncheck | Check | Check |
| backgroundtaskhost.exe | %ProgramData%\microsoft\windows\caches\ | Uncheck | .db | uncheck | Uncheck | Check | Check |

#### Step 3. Create an Application File Access Protection rule

Create an AFAPR to block or monitor data copying and uploads to Microsoft Teams/Microsoft Copilot.

1. In **DLP Policy Manager**, select **Rule Sets**.
2. Select **Actions** → **New Rule** → **Application File Access Protection** to create or edit a rule.
3. Set **State** to **Enabled**.
4. Select **Trellix DLP Endpoint for Windows**.
5. Select the **Classifications** tab.
6. Configure the target application:
  - To block data uploads or text copying to Microsoft Teams, select **MS Teams** in **Applications**.
  - To block data uploads or text copying to Microsoft Copilot, select **MS Copilot** in **Applications**.
7. Select the **Exceptions** tab, then select **Add Rule Exception** to configure exceptions.
8. Set **State** to **Enabled** and select the classification.

1. Under **Reactions**, configure the action and select the check boxes in **Report Incident**.
2. Select **Save**.

#### Step 4. **Apply policy changes**

For information, see [Assign and push a policy to a system](https://docs.trellix.com/data-and-email/docs/assign-and-push-a-policy-to-a-system-2).

**Result:** When the end user uploads a file, the file itself is not blocked, but the content inside the file appears blank.

### Supported policy enforcement options

As a DLP Administrator, you can manage the sharing of sensitive content across these relevant business platforms and applications to ensure data security. The following table lists the available policy enforcement options for data protection.

| **Configuration** **Option** | **Vector** | **Enforcement Result** |
| --- | --- | --- |
| **Meeting** **Attachment** **Protection** | Microsoft Teams Events/Meetings | Blocks classified attachments and notifies the user. |
| **Calendar Protection** | Microsoft Calendar | Blocks classified attachments and notifies the user. |
| **Cloud Storage** **Upload Control** | OneDrive/SharePoint | Blocks classified file uploads and notifies the user. |
| **External Sharing** **Control** | Guest/External Accounts | Blocks unauthorized file shares and notifies the user. |
| **Chat Attachment** **Control** | Teams Chat/Channels | Blocks drag-and-drop or file uploads and notifies the user. |
| **Screen Capture** **Restriction** | Microsoft Teams Microsoft Copilot | Restricts screen capture of classified data and notifies the user. |
| **Clipboard** **Protection** | Microsoft Copilot External/Unmanaged Apps | Blocks paste actions into Teams and notifies the user. |
| **File Movement** **Control** | Microsoft Teams Microsoft Copilot to File System | Blocks drag-and-drop transfers and notifies the user. |
| **Print Control** | Microsoft Teams Microsoft Copilot | Prevents printing of classified content and notifies the user. |