Table of Contents
Microsoft Defender Prompt Injection Protection Now Part of MDO Plan 2
As discussed in the article covering the new Data Loss Prevention (DLP) capability to block external email from being used by Microsoft 365 Copilot when it responds to user prompts, Microsoft is obviously worried about the potential harm caused by prompt injections. A prompt injection is a type of attack where malicious instructions are introduced into content processed by an AI system to influence the system’s behaviour.
For example, a prompt injection could instruct Microsoft 365 Copilot to search for and exfiltrate confidential information from a user’s mailbox or a SharePoint Online site that they have access to.
Email is a good way for attackers to introduce malicious content into Microsoft 365 because they can hide the content in the email body or an attachment using hidden text. The text is indexed by Microsoft Search and becomes available to Microsoft 365 Copilot when it responds to user prompts, which is when the malicious instructions created by the prompt injection can wreak havoc.
Attackers started to use prompt injections against Copilot (in its many guises) soon after its introduction and Microsoft has done a lot to work to detect and suppress such attacks ever since. The new DLP policy and Prompt Injection Protection are part of that campaign.
Prompt Injections are High Confidence Phish
To block messages containing prompt injections from reaching user mailboxes, Microsoft has updated Microsoft Defender for Office 365 with a new technology called Prompt Injection Protection to “detect and block prompt injection content” before email reaches a mailbox and becomes available to an AI assistant.
No additional configuration or policy creation is required because the new protection is integrated alongside current checks to detect threats like business email compromise and spam. Microsoft Defender for Office 365 treats messages identified as containing prompt injections as high-confidence phishing and quarantines them automatically.
According to MC1422060 (9 July 2026), the change is now in public preview and is heading for general availability in early September 2026. Prompt Injection Protection is enabled by default for tenants with Microsoft Defender for Office 365 Plan 2 (included in Office 365 E5 and Microsoft 365 E5 and E7).
The Shared Mailbox Question
Microsoft 365 Copilot can read items in any shared mailbox to which the signed-in user has delegate access. Shared mailboxes can receive external email and therefore could be targeted by attackers with messages containing prompt injections. Because Copilot can access content stored in shared mailboxes through delegated permissions, shared mailboxes become part of the prompt-injection attack surface. Logically, this suggests that any shared mailbox receiving external email should be licensed for MDO Plan 2 in line with the updated guidance for MDO licensing issued in October 2025.
That article features a script to check the external email sent to shared mailboxes to detect the mailboxes that need to be licensed. The original version looked back over ten days of message trace data. The new version looks back over the full 90 days of available message trace data. The Get-MessageTraceV2 cmdlet can fetch up to ten days of data at a time, so the script fetches chunks of data and combines them together to check. I use the same technique in the script to check for inactive distribution lists.
In addition, the script checks whether the shared mailboxes have organized Teams meetings. As discussed here, this exposes another potential licensing requirement to retain meeting recordings captured for those meetings. Recordings are stored in the OneDrive account of the meeting organizer, which is great when the organizer is a fully licensed user account. Shared mailboxes use disabled accounts that usually aren’t licensed for OneDrive. Microsoft removes unlicensed OneDrive accounts 365 days after the account first became unlicensed, which creates an obvious potential for data loss. The script checks whether shared mailboxes have organised Teams meetings during the last 90 days and flags any mailbox where matching events are found. Email is sent to a nominated address to share the findings (Figure 1).
You can download the updated script from the Microsoft 365 for IT Pros GitHub repository.
Multiple Levels of Block
It’s always good when Microsoft increases the range of protection offered by Microsoft Defender for Office 365. Prompt Injection Protection stops malicious messages before they reach mailboxes, while the DLP capability limits Copilot’s ability to use external email content. Together, the two features provide protection at different stages of the attack chain.
Many will consider that preventing infection before it reaches mailboxes makes MDO a better solution to the prompt injection problem than a DLP rule. On the upside, the DLP rule has a retrospective effect when it blocks Microsoft 365 Copilot from using external email and it works for tenants where MDO Plan 2 isn’t available. Both approaches are useful and each contributes in its own way to threat suppression.
Support the work of the Microsoft 365 for IT Pros team by subscribing to the Microsoft 365 for IT Pros eBook. Your support pays for the time we need to track, analyze, and document the changing world of Microsoft 365 and Office 365. Only humans contribute to our work!