Skip to main content
Microsoft filters what the user types into Copilot. It does not inspect what comes back from a tool, so an instruction hidden in the body of a ticket, a record or a document reaches the model as retrieved content. This policy closes that gap. It is the class of attack that matters once an agent has tools pointed at internal systems. Set up governed tool access first, and confirm a tool call reaches TrustGate Activity.

​
What is evaluated

1

Create the collector and policy

In Agent Security, create a collector for the application. Then create a runtime policy and assign that collector to it.In the policy’s Detectors tab, add the rules:Indirect Prompt Injection is the one that addresses the gap this page is about. Microsoft Purview DLP is worth considering early: the tenant running Copilot is the same tenant that holds the Purview policies, so the rules your organization already maintains apply to the tool traffic without being written a second time.Set each rule’s action to Monitor to begin with.
A tool result is evaluated by the Input rules. What returns from a tool is input heading toward the model, so Indirect Prompt Injection belongs on Input. Prompt Guard cannot be placed on Output, since it targets the user’s prompt.
2

Bind the policy to the gateway

In Agent Gateway → Policies → Catalog, add TrustGuard. Select the collector, set direction to request_response, and target the application.This entry declares coverage only. It carries no enforcement mode.
3

Switch to Enforce

Open the runtime policy at Agent Security → Policies → Basics and set Enforcement mode to Enforce.Enforce makes each rule’s own action real. A rule left on Monitor still logs and allows. Both have to agree: the policy on Enforce, and the rule you want to stop traffic on Block.

​
Verify

Create a record in a connected system, in a private space you control, with an innocuous title and an injected instruction in its body:
In Copilot, ask the agent to read and summarize that record. In TrustGuard Activity, the tool response is blocked with an Indirect Prompt Injection detection, and the agent reports that it could not retrieve the content. Delete the test record afterwards.
Do not run this test by typing the injection into the Copilot chat. Microsoft’s filter catches it there and nothing reaches the gateway, which tells you nothing about your policy. The attack has to arrive through a tool.

​
Reference

​
Separating a quiet detector from unreached content

The policy’s Test tab evaluates a pasted sample directly, without the gateway. Use it to tell “the detector did not fire” apart from “the text never reached the detector”.

​
What the user sees

A blocked result reaches the agent as a failed request, not as a policy decision, so the agent reports a failure rather than a block. Write the agent’s instructions to report policy blocks explicitly and never to answer from memory when a tool fails.

​
Fail mode

The TrustGuard policy in the gateway catalog carries a failure mode. With failure mode open, traffic continues when the detector cannot answer. Set it according to whether availability or enforcement takes precedence for the application.

​
Troubleshooting