[{"data":1,"prerenderedAt":899},["ShallowReactive",2],{"article-\u002Farticles\u002Fcopilot-security-settei-chusho":3,"article-series-m365-copilot":870},{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"date":10,"category":11,"series":12,"seriesNo":13,"seriesLabel":14,"author":15,"thumbnail":16,"tags":17,"faq":23,"body":36,"_type":864,"_id":865,"_source":866,"_file":867,"_stem":868,"_extension":869},"\u002Farticles\u002Fcopilot-security-settei-chusho","articles",false,"","Microsoft 365 Copilotのセキュリティ設定｜中小企業に秘密度ラベルとDLPは必要か","Microsoft 365 Copilotのセキュリティ設定として紹介されることの多い秘密度ラベルとDLP（データ損失防止）。一般的な中小企業の多くには、ここまでの設定は必要ありません。そう言える3つの理由と、それでも必要になる会社の判定チェック、必要ない会社が追加費用なしでやるべき3つのことを解説します。","2026-09-29","M365 Copilot導入","m365-copilot",4,"第4回（前編）","K.S.ロジャース株式会社","\u002Fimg\u002Fcontents\u002Fnews\u002Fthumb132.jpg",[18,19,20,21,22],"Microsoft 365 Copilot","情報セキュリティ","Microsoft Purview","中小企業","AX",[24,27,30,33],{"q":25,"a":26},"中小企業がMicrosoft 365 Copilotを入れるとき、秘密度ラベルとDLPは必要ですか？","一般的な中小企業の多くには、必要ありません。Copilot で実際に起きやすいのは、共有設定が広すぎて社内で見えてはいけない人に資料が見えることで、これは権限の整理で防げます。金融や防衛関連の製造など、業界の規制や取引先の要求で情報の区分管理が求められる会社は、秘密度ラベルと DLP を段階的に導入します。",{"q":28,"a":29},"Microsoft 365 Business Standardで秘密度ラベルは使えますか？","Microsoft Purview のサービス説明では、Business Standard は秘密度ラベルと DLP（Exchange Online・SharePoint・OneDrive）の対象プランとして記載されていません。これらを使うには、Business Premium 以上が必要です。一方、Copilot の利用が記録される監査ログ（Audit (Standard)）は、Business Standard でも使えます。",{"q":31,"a":32},"秘密度ラベルを使わない場合、給与や人事評価の資料はどう守ればよいですか？","ラベルを付けるより、見られる人を絞った専用の SharePoint サイトに移すほうが簡単で確実です。Copilot は質問した本人が閲覧できる情報しか使わないため、人事や役員だけがメンバーのサイトに置けば、それ以外の社員の Copilot の回答には出てきません。",{"q":34,"a":35},"追加費用なしでできるCopilotのセキュリティ対策はありますか？","あります。権限の整理、監査ログの確認、機密情報を含むプロンプトへの DLP の3つです。監査ログはどのプランでも Copilot の利用が記録され、プロンプトに対する DLP は Copilot を利用するすべてのユーザーが対象です（一部の機能はプレビュー）。",{"type":37,"children":38,"toc":845},"root",[39,58,78,90,103,150,157,162,186,321,338,344,351,356,377,383,399,411,417,422,427,433,438,454,524,535,540,545,551,557,569,587,592,598,611,623,628,634,654,667,672,677,683,695,739,751,757,762,775,780,836],{"type":40,"tag":41,"props":42,"children":43},"element","p",{},[44,47,56],{"type":45,"value":46},"text","※ Microsoft 365 Copilot は、2026年8月から「Microsoft Copilot」に名称が変わりました（Copilot Chat は「Microsoft Copilot Chat」）。移行期間中は旧名称も併用されているため、本記事では広く使われている「Microsoft 365 Copilot」の表記で統一しています（出典：",{"type":40,"tag":48,"props":49,"children":53},"a",{"href":50,"rel":51},"https:\u002F\u002Flearn.microsoft.com\u002Fja-jp\u002Fcopilot\u002Fmicrosoft-365\u002Fmicrosoft-365-copilot-privacy",[52],"nofollow",[54],{"type":45,"value":55},"Microsoft Learn「Microsoft Copilot のデータ、プライバシー、セキュリティ」",{"type":45,"value":57},"）。",{"type":40,"tag":41,"props":59,"children":60},{},[61,63,69,71,76],{"type":45,"value":62},"「Copilot のセキュリティ設定」を調べると、必ずといってよいほど出てくるのが、Microsoft Purview の",{"type":40,"tag":64,"props":65,"children":66},"strong",{},[67],{"type":45,"value":68},"秘密度ラベル",{"type":45,"value":70},"と ",{"type":40,"tag":64,"props":72,"children":73},{},[74],{"type":45,"value":75},"DLP",{"type":45,"value":77},"（データ損失防止）です。ファイルに「社外秘」「極秘」といった区分を付け、区分に応じて警告したりブロックしたりする仕組みで、大企業向けの解説ではほぼ必須のように紹介されています。",{"type":40,"tag":41,"props":79,"children":80},{},[81,83,88],{"type":45,"value":82},"では、一般的な中小企業も、ここまでやる必要があるのでしょうか。私たちの答えは、",{"type":40,"tag":64,"props":84,"children":85},{},[86],{"type":45,"value":87},"多くの中小企業には必要ない",{"type":45,"value":89},"です。金融機関や防衛関連の製造のように、情報の区分管理が求められる会社には欠かせない仕組みですが、そうでない会社が標準の手順として取り組むと、手間と混乱のほうが大きくなります。",{"type":40,"tag":41,"props":91,"children":92},{},[93,95,101],{"type":45,"value":94},"本記事（前編）では、中小企業に秘密度ラベルと DLP が必要かどうかを判断する材料を整理し、必要ない会社がやるべきことをまとめます。必要な会社向けの具体的な設計は、",{"type":40,"tag":48,"props":96,"children":98},{"href":97},"\u002Farticles\u002Fcopilot-sensitivity-label-dlp\u002F",[99],{"type":45,"value":100},"後編",{"type":45,"value":102},"で扱います。",{"type":40,"tag":104,"props":105,"children":106},"blockquote",{},[107,115],{"type":40,"tag":41,"props":108,"children":109},{},[110],{"type":40,"tag":64,"props":111,"children":112},{},[113],{"type":45,"value":114},"この記事の要点",{"type":40,"tag":116,"props":117,"children":118},"ul",{},[119,133,138],{"type":40,"tag":120,"props":121,"children":122},"li",{},[123,125,131],{"type":45,"value":124},"一般的な中小企業の多くには、秘密度ラベルと DLP までは必要ありません。Copilot のリスクの中心は「社内で見えすぎる」ことで、これは",{"type":40,"tag":48,"props":126,"children":128},{"href":127},"\u002Farticles\u002Fcopilot-joho-rouei-sharepoint-kengen\u002F",[129],{"type":45,"value":130},"第3回",{"type":45,"value":132},"の権限の整理で防げます",{"type":40,"tag":120,"props":134,"children":135},{},[136],{"type":45,"value":137},"金融・防衛関連・医療など規制のある業種、取引先から情報管理を求められる会社、機微な個人情報を大量に扱う会社は、秘密度ラベルと DLP を段階的に導入します",{"type":40,"tag":120,"props":139,"children":140},{},[141,143,148],{"type":45,"value":142},"必要ない会社も、",{"type":40,"tag":64,"props":144,"children":145},{},[146],{"type":45,"value":147},"権限の整理・監査ログの確認・プロンプトへの DLP",{"type":45,"value":149}," の3つは、追加費用なしで取り組めます",{"type":40,"tag":151,"props":152,"children":154},"h2",{"id":153},"microsoft-365-copilotのセキュリティ設定は4つの層で考える",[155],{"type":45,"value":156},"Microsoft 365 Copilotのセキュリティ設定は4つの層で考える",{"type":40,"tag":41,"props":158,"children":159},{},[160],{"type":45,"value":161},"Copilot のセキュリティ設定というと、Copilot の管理画面に何か特別な設定があるように思われがちです。実際には、Copilot は Microsoft 365 の既存の仕組みに従って動くため、設定すべきものは次の4つの層に分かれます。",{"type":40,"tag":163,"props":164,"children":165},"picture",{},[166,168,176,177],{"type":45,"value":167},"\n  ",{"type":40,"tag":169,"props":170,"children":175},"source",{"media":171,"srcSet":172,"width":173,"height":174},"(max-width: 768px)","\u002Fimg\u002Fcontents\u002Farticles\u002Fcopilot-sensitivity-label-dlp\u002Flabel-dlp-sou-sp.svg",420,520,[],{"type":45,"value":167},{"type":40,"tag":178,"props":179,"children":185},"img",{"src":180,"alt":181,"width":182,"height":183,"loading":184},"\u002Fimg\u002Fcontents\u002Farticles\u002Fcopilot-sensitivity-label-dlp\u002Flabel-dlp-sou.svg","Copilotのセキュリティ設定の4つの層：権限（誰が場所を見られるか、第3回）、秘密度ラベル（ファイルの扱い）、DLP（止めるか）、監査（何が起きたか）",800,368,"lazy",[],{"type":40,"tag":187,"props":188,"children":189},"table",{},[190,219],{"type":40,"tag":191,"props":192,"children":193},"thead",{},[194],{"type":40,"tag":195,"props":196,"children":197},"tr",{},[198,204,209,214],{"type":40,"tag":199,"props":200,"children":201},"th",{},[202],{"type":45,"value":203},"層",{"type":40,"tag":199,"props":205,"children":206},{},[207],{"type":45,"value":208},"決めること",{"type":40,"tag":199,"props":210,"children":211},{},[212],{"type":45,"value":213},"主な仕組み",{"type":40,"tag":199,"props":215,"children":216},{},[217],{"type":45,"value":218},"一般的な中小企業",{"type":40,"tag":220,"props":221,"children":222},"tbody",{},[223,250,272,294],{"type":40,"tag":195,"props":224,"children":225},{},[226,232,237,242],{"type":40,"tag":227,"props":228,"children":229},"td",{},[230],{"type":45,"value":231},"権限",{"type":40,"tag":227,"props":233,"children":234},{},[235],{"type":45,"value":236},"誰がその場所を見られるか",{"type":40,"tag":227,"props":238,"children":239},{},[240],{"type":45,"value":241},"SharePoint・Teams のメンバー、共有設定（第3回）",{"type":40,"tag":227,"props":243,"children":244},{},[245],{"type":40,"tag":64,"props":246,"children":247},{},[248],{"type":45,"value":249},"必須",{"type":40,"tag":195,"props":251,"children":252},{},[253,257,262,267],{"type":40,"tag":227,"props":254,"children":255},{},[256],{"type":45,"value":68},{"type":40,"tag":227,"props":258,"children":259},{},[260],{"type":45,"value":261},"そのファイルやメールをどう扱うか",{"type":40,"tag":227,"props":263,"children":264},{},[265],{"type":45,"value":266},"Microsoft Purview Information Protection",{"type":40,"tag":227,"props":268,"children":269},{},[270],{"type":45,"value":271},"必要な会社だけ",{"type":40,"tag":195,"props":273,"children":274},{},[275,279,284,289],{"type":40,"tag":227,"props":276,"children":277},{},[278],{"type":45,"value":75},{"type":40,"tag":227,"props":280,"children":281},{},[282],{"type":45,"value":283},"区分や内容に応じて、警告するか止めるか",{"type":40,"tag":227,"props":285,"children":286},{},[287],{"type":45,"value":288},"Microsoft Purview Data Loss Prevention",{"type":40,"tag":227,"props":290,"children":291},{},[292],{"type":45,"value":293},"プロンプトへの DLP だけ使う",{"type":40,"tag":195,"props":295,"children":296},{},[297,302,307,312],{"type":40,"tag":227,"props":298,"children":299},{},[300],{"type":45,"value":301},"監査",{"type":40,"tag":227,"props":303,"children":304},{},[305],{"type":45,"value":306},"実際に何が起きたか",{"type":40,"tag":227,"props":308,"children":309},{},[310],{"type":45,"value":311},"Microsoft Purview Audit",{"type":40,"tag":227,"props":313,"children":314},{},[315,319],{"type":40,"tag":64,"props":316,"children":317},{},[318],{"type":45,"value":249},{"type":45,"value":320},"（見る運用を決める）",{"type":40,"tag":41,"props":322,"children":323},{},[324,326,330,332,336],{"type":45,"value":325},"大企業向けの解説では4つの層すべてを整えることが前提になっていますが、中小企業にとっての土台は",{"type":40,"tag":64,"props":327,"children":328},{},[329],{"type":45,"value":231},{"type":45,"value":331},"と",{"type":40,"tag":64,"props":333,"children":334},{},[335],{"type":45,"value":301},{"type":45,"value":337},"です。秘密度ラベルと DLP は、その上に「必要な会社だけ」が重ねるものと考えてください。",{"type":40,"tag":151,"props":339,"children":341},{"id":340},"多くの中小企業に秘密度ラベルとdlpがいらない3つの理由",[342],{"type":45,"value":343},"多くの中小企業に秘密度ラベルとDLPがいらない3つの理由",{"type":40,"tag":345,"props":346,"children":348},"h3",{"id":347},"_1-そもそも契約中のプランに入っていないことが多い",[349],{"type":45,"value":350},"1. そもそも契約中のプランに入っていないことが多い",{"type":40,"tag":41,"props":352,"children":353},{},[354],{"type":45,"value":355},"中小企業で多く使われている Microsoft 365 Business Standard は、Microsoft Purview のサービス説明で、秘密度ラベルと DLP（Exchange Online・SharePoint・OneDrive）の対象プランとして記載されていません。使うには Business Premium 以上が必要です。",{"type":40,"tag":41,"props":357,"children":358},{},[359,361,368,370,375],{"type":45,"value":360},"さらに、「秘密度ラベルを付けたファイルを DLP で Copilot の処理から外す」機能は、Business Premium や Microsoft 365 E3 では対象外で、E5 などが必要です（出典：",{"type":40,"tag":48,"props":362,"children":365},{"href":363,"rel":364},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Foffice365\u002Fservicedescriptions\u002Fmicrosoft-365-service-descriptions\u002Fmicrosoft-365-tenantlevel-services-licensing-guidance\u002Fmicrosoft-purview-service-description",[52],[366],{"type":45,"value":367},"Microsoft Learn「Microsoft Purview service description」",{"type":45,"value":369},"）。Copilot のためにラベルと DLP を本格的に使おうとすると、",{"type":40,"tag":64,"props":371,"children":372},{},[373],{"type":45,"value":374},"Copilot のライセンスに加えて、上位プランへの切り替え",{"type":45,"value":376},"が必要になる会社がほとんどです。",{"type":40,"tag":345,"props":378,"children":380},{"id":379},"_2-中小企業のリスクの中心は見えすぎで権限の整理で防げる",[381],{"type":45,"value":382},"2. 中小企業のリスクの中心は「見えすぎ」で、権限の整理で防げる",{"type":40,"tag":41,"props":384,"children":385},{},[386,390,392,397],{"type":40,"tag":48,"props":387,"children":388},{"href":127},[389],{"type":45,"value":130},{"type":45,"value":391},"で整理したとおり、Copilot で実際に起きやすいのは、全社に共有されたままの給与表や役員会の資料が、質問した社員の回答に出てくる、という事故です。Copilot は質問した本人が閲覧できる情報しか使わないため、",{"type":40,"tag":64,"props":393,"children":394},{},[395],{"type":45,"value":396},"見られる人を絞れば、その人以外の Copilot には出てきません",{"type":45,"value":398},"。",{"type":40,"tag":41,"props":400,"children":401},{},[402,404,409],{"type":45,"value":403},"社員が数十人から数百人の会社なら、特に守るべき資料は、人事・給与、役員会、一部の顧客情報など、ある程度はっきりしています。これらは、ファイル1つ1つにラベルを付けるより、",{"type":40,"tag":64,"props":405,"children":406},{},[407],{"type":45,"value":408},"見られる人を絞った専用のサイトに移す",{"type":45,"value":410},"ほうが、簡単で確実です。",{"type":40,"tag":345,"props":412,"children":414},{"id":413},"_3-運用が続かず形だけになりやすい",[415],{"type":45,"value":416},"3. 運用が続かず、形だけになりやすい",{"type":40,"tag":41,"props":418,"children":419},{},[420],{"type":45,"value":421},"秘密度ラベルは、社員が文書を作るたびに正しい区分を付けて、初めて効果が出る仕組みです。専任の情報システム担当がいない会社では、最初は付けていても、しだいに付け忘れや付け間違いが増え、形だけになりがちです。",{"type":40,"tag":41,"props":423,"children":424},{},[425],{"type":45,"value":426},"DLP も同じです。条件の設定が少し広すぎるだけで、見積書や請求書のメールが送れなくなり、「仕事にならない」という声が上がります。例外を認めるたびにルールが骨抜きになり、最後は Copilot の導入そのものへの信頼を損ないます。",{"type":40,"tag":151,"props":428,"children":430},{"id":429},"それでも必要になる会社-判定チェック",[431],{"type":45,"value":432},"それでも必要になる会社 ― 判定チェック",{"type":40,"tag":41,"props":434,"children":435},{},[436],{"type":45,"value":437},"一方で、次のいずれかに当てはまる会社には、秘密度ラベルと DLP が必要です。",{"type":40,"tag":163,"props":439,"children":440},{},[441,442,447,448],{"type":45,"value":167},{"type":40,"tag":169,"props":443,"children":446},{"media":171,"srcSet":444,"width":173,"height":445},"\u002Fimg\u002Fcontents\u002Farticles\u002Fcopilot-security-settei-chusho\u002Fhitsuyou-hantei-sp.svg",600,[],{"type":45,"value":167},{"type":40,"tag":178,"props":449,"children":453},{"src":450,"alt":451,"width":182,"height":452,"loading":184},"\u002Fimg\u002Fcontents\u002Farticles\u002Fcopilot-security-settei-chusho\u002Fhitsuyou-hantei.svg","秘密度ラベルとDLPが必要かの判定：規制のある業種、取引先からの情報管理の要求、機微な個人情報を大量に扱う、上位プランを契約済みのいずれかに当てはまれば後編の段階設計へ。当てはまらなければ権限の整理・監査ログ・プロンプトへのDLPの3つで十分",360,[],{"type":40,"tag":116,"props":455,"children":458},{"className":456},[457],"contains-task-list",[459,479,494,509],{"type":40,"tag":120,"props":460,"children":463},{"className":461},[462],"task-list-item",[464,470,472,477],{"type":40,"tag":465,"props":466,"children":469},"input",{"disabled":467,"type":468},true,"checkbox",[],{"type":45,"value":471}," ",{"type":40,"tag":64,"props":473,"children":474},{},[475],{"type":45,"value":476},"業界の規制やガイドラインで、情報の区分管理が求められている",{"type":45,"value":478},"——金融機関、防衛関連の製造、医療機関など",{"type":40,"tag":120,"props":480,"children":482},{"className":481},[462],[483,486,487,492],{"type":40,"tag":465,"props":484,"children":485},{"disabled":467,"type":468},[],{"type":45,"value":471},{"type":40,"tag":64,"props":488,"children":489},{},[490],{"type":45,"value":491},"取引先から情報管理を求められている",{"type":45,"value":493},"——大手企業のサプライチェーンに入っていて、セキュリティチェックシートへの回答や、取引先による監査がある",{"type":40,"tag":120,"props":495,"children":497},{"className":496},[462],[498,501,502,507],{"type":40,"tag":465,"props":499,"children":500},{"disabled":467,"type":468},[],{"type":45,"value":471},{"type":40,"tag":64,"props":503,"children":504},{},[505],{"type":45,"value":506},"機微な個人情報を大量に扱う",{"type":45,"value":508},"——マイナンバー、健康情報、多数の顧客の個人情報などを日常的に扱う",{"type":40,"tag":120,"props":510,"children":512},{"className":511},[462],[513,516,517,522],{"type":40,"tag":465,"props":514,"children":515},{"disabled":467,"type":468},[],{"type":45,"value":471},{"type":40,"tag":64,"props":518,"children":519},{},[520],{"type":45,"value":521},"すでに上位プランを契約している",{"type":45,"value":523},"——Microsoft 365 E5 を契約している、または Business Premium で秘密度ラベルをすでに運用している",{"type":40,"tag":41,"props":525,"children":526},{},[527,529,533],{"type":45,"value":528},"1つでも当てはまる場合は、",{"type":40,"tag":48,"props":530,"children":531},{"href":97},[532],{"type":45,"value":100},{"type":45,"value":534},"の段階設計（見える化 → ラベルを付ける → 警告する → 止める）を参考に、秘密度ラベルと DLP を導入してください。",{"type":40,"tag":41,"props":536,"children":537},{},[538],{"type":45,"value":539},"なお、防衛・原子力・輸出管理の対象になる技術情報などは、秘密度ラベルや DLP で守るかどうか以前に、法令や業界の基準、発注元との契約によって、クラウドの AI（Microsoft 365 Copilot を含む）の利用そのものが制限されることがあります。ここで問題になるのは、AI の学習に使われるかどうかではなく、データがどこの国で処理され、誰の管理下に置かれるかです。こうした情報は「クラウド不可」の区分として分け、オンプレミスの AI を使うか AI の対象から外すかを、輸出管理や情報セキュリティの担当部門と決めておきます。",{"type":40,"tag":41,"props":541,"children":542},{},[543],{"type":45,"value":544},"どれにも当てはまらない場合は、次の3つで十分です。",{"type":40,"tag":151,"props":546,"children":548},{"id":547},"必要ない会社がやる3つのこと追加費用なし",[549],{"type":45,"value":550},"必要ない会社がやる3つのこと（追加費用なし）",{"type":40,"tag":345,"props":552,"children":554},{"id":553},"_1-権限を整理し機微な情報は専用のサイトに分ける",[555],{"type":45,"value":556},"1. 権限を整理し、機微な情報は専用のサイトに分ける",{"type":40,"tag":41,"props":558,"children":559},{},[560,562,567],{"type":45,"value":561},"まずは第3回の権限の棚卸しです。そのうえで、人事・給与、役員会、M&A の検討資料など、特に見られては困る情報は、",{"type":40,"tag":64,"props":563,"children":564},{},[565],{"type":45,"value":566},"メンバーを限定した専用の SharePoint サイトやチーム",{"type":45,"value":568},"に移します。",{"type":40,"tag":116,"props":570,"children":571},{},[572,577,582],{"type":40,"tag":120,"props":573,"children":574},{},[575],{"type":45,"value":576},"全社向けのサイトに、機微な資料を置かない",{"type":40,"tag":120,"props":578,"children":579},{},[580],{"type":45,"value":581},"専用のサイトは「プライベート」にし、メンバーを必要な人だけにする",{"type":40,"tag":120,"props":583,"children":584},{},[585],{"type":45,"value":586},"サイトの所有者を2人以上決め、異動や退職のときにメンバーから外す手順を決める",{"type":40,"tag":41,"props":588,"children":589},{},[590],{"type":45,"value":591},"秘密度ラベルが「ファイルごとに扱いを決める」仕組みだとすれば、こちらは「置き場所で扱いを決める」方法です。区分が少ない中小企業には、置き場所で分けるほうが運用しやすくなります。",{"type":40,"tag":345,"props":593,"children":595},{"id":594},"_2-監査ログを見る運用を決める",[596],{"type":45,"value":597},"2. 監査ログを見る運用を決める",{"type":40,"tag":41,"props":599,"children":600},{},[601,603,610],{"type":45,"value":602},"Copilot を利用すると、Microsoft Purview の監査ログ（Audit (Standard)）に自動で記録が残ります。追加の設定は要らず、Business Standard を含むどのプランでも使えます（出典：前掲「Microsoft Purview service description」、",{"type":40,"tag":48,"props":604,"children":607},{"href":605,"rel":606},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fpurview\u002Faudit-copilot",[52],[608],{"type":45,"value":609},"Microsoft Learn「Audit logs for Copilot and AI applications」",{"type":45,"value":57},{"type":40,"tag":41,"props":612,"children":613},{},[614,616,621],{"type":45,"value":615},"監査ログでは、誰が、いつ、どのアプリで Copilot を使い、回答のためにどのファイルを参照したかが分かります。導入直後は週1回、落ち着いたら月1回を目安に、",{"type":40,"tag":64,"props":617,"children":618},{},[619],{"type":45,"value":620},"想定外の資料が参照されていないか",{"type":45,"value":622},"を確認します。見る担当と、気になる記録があったときの報告先を決めておくことが大切です。",{"type":40,"tag":41,"props":624,"children":625},{},[626],{"type":45,"value":627},"保存期間は180日です。取引先との契約や社内規程で、それより長く残す必要があるかも確認しておきます。",{"type":40,"tag":345,"props":629,"children":631},{"id":630},"_3-機密情報を含むプロンプトに-dlp-をかける",[632],{"type":45,"value":633},"3. 機密情報を含むプロンプトに DLP をかける",{"type":40,"tag":41,"props":635,"children":636},{},[637,639,644,646,653],{"type":45,"value":638},"DLP のうち、",{"type":40,"tag":64,"props":640,"children":641},{},[642],{"type":45,"value":643},"プロンプト（Copilot への質問）に対する DLP は、Copilot を利用するすべてのユーザーが対象",{"type":45,"value":645},"とされています（出典：前掲「Microsoft Purview service description」）。たとえばクレジットカード番号やマイナンバーのような機密情報の種類がプロンプトに含まれたとき、次の制御ができます（出典：",{"type":40,"tag":48,"props":647,"children":650},{"href":648,"rel":649},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fpurview\u002Fdlp-microsoft365-copilot-location-learn-about",[52],[651],{"type":45,"value":652},"Microsoft Learn「Microsoft Purview DLP for Microsoft 365 Copilot and Copilot Chat」",{"type":45,"value":57},{"type":40,"tag":116,"props":655,"children":656},{},[657,662],{"type":40,"tag":120,"props":658,"children":659},{},[660],{"type":45,"value":661},"外部の Web 検索を使わず、社内のデータだけで回答させる（提供中）",{"type":40,"tag":120,"props":663,"children":664},{},[665],{"type":45,"value":666},"Copilot が応答しないようにする（2026年9月時点ではプレビュー）",{"type":40,"tag":41,"props":668,"children":669},{},[670],{"type":45,"value":671},"社員が誤って機密情報を貼り付けたときの「うっかり」を減らすための設定で、ファイルに区分を付ける運用は要りません。設定の前に、シミュレーションモードでどれくらい該当するかを確かめてから有効にします。",{"type":40,"tag":41,"props":673,"children":674},{},[675],{"type":45,"value":676},"なお、社員が個人のアカウントで無償の生成AIサービスを使い、業務の情報を貼り付けてしまうリスクは、ここまでの設定では防げません。こちらは社内ルールの問題として、第5回（生成AIの社内ルールの作り方）で扱います。",{"type":40,"tag":151,"props":678,"children":680},{"id":679},"必要な会社は後編の段階設計へ",[681],{"type":45,"value":682},"必要な会社は、後編の段階設計へ",{"type":40,"tag":41,"props":684,"children":685},{},[686,688,693],{"type":45,"value":687},"判定チェックに当てはまった会社は、秘密度ラベルと DLP を導入します。ただし、その場合も",{"type":40,"tag":64,"props":689,"children":690},{},[691],{"type":45,"value":692},"いきなりブロックから始めない",{"type":45,"value":694},"ことが大切です。",{"type":40,"tag":696,"props":697,"children":698},"ol",{},[699,709,719,729],{"type":40,"tag":120,"props":700,"children":701},{},[702,707],{"type":40,"tag":64,"props":703,"children":704},{},[705],{"type":45,"value":706},"見える化する",{"type":45,"value":708},"——監査ログと DLP のシミュレーションで、現状を把握する",{"type":40,"tag":120,"props":710,"children":711},{},[712,717],{"type":40,"tag":64,"props":713,"children":714},{},[715],{"type":45,"value":716},"ラベルを付け始める",{"type":45,"value":718},"——区分を3〜4つに絞り、手動で付ける運用から始める",{"type":40,"tag":120,"props":720,"children":721},{},[722,727],{"type":40,"tag":64,"props":723,"children":724},{},[725],{"type":45,"value":726},"警告する",{"type":45,"value":728},"——DLP のポリシーヒントで警告し、誤検知と業務への影響を確かめる",{"type":40,"tag":120,"props":730,"children":731},{},[732,737],{"type":40,"tag":64,"props":733,"children":734},{},[735],{"type":45,"value":736},"止める",{"type":45,"value":738},"——例外がほとんど出ない条件だけをブロックする",{"type":40,"tag":41,"props":740,"children":741},{},[742,744,749],{"type":45,"value":743},"秘密度ラベルが Copilot にどう扱われるか、ラベル付きのファイルを Copilot から外す方法、機能ごとのライセンス要件、各段階の具体的な設定は、",{"type":40,"tag":48,"props":745,"children":746},{"href":97},[747],{"type":45,"value":748},"後編：秘密度ラベルとDLPを「警告」から始める段階設計",{"type":45,"value":750},"で詳しく解説しています。",{"type":40,"tag":151,"props":752,"children":754},{"id":753},"ksrogers-の支援",[755],{"type":45,"value":756},"K.S.Rogers の支援",{"type":40,"tag":41,"props":758,"children":759},{},[760],{"type":45,"value":761},"K.S.Rogers では、Microsoft 365 Copilot の導入に向けたセキュリティ設定を、会社の規模や業種、取引先からの要求に合わせて伴走しています。「大企業向けの解説を読むと全部やらないといけない気がするが、自社にどこまで必要なのか分からない」という段階から、必要な設定の見極め、権限の整理、監査ログを見る運用づくり、必要な会社には秘密度ラベルと DLP の段階的な導入までを支援します。",{"type":40,"tag":41,"props":763,"children":764},{},[765,767,773],{"type":45,"value":766},"ご相談は",{"type":40,"tag":48,"props":768,"children":770},{"href":769},"\u002Fcontact\u002F",[771],{"type":45,"value":772},"お問い合わせ",{"type":45,"value":774},"からどうぞ。",{"type":40,"tag":151,"props":776,"children":778},{"id":777},"まとめ",[779],{"type":45,"value":777},{"type":40,"tag":116,"props":781,"children":782},{},[783,795,820,825],{"type":40,"tag":120,"props":784,"children":785},{},[786,788,793],{"type":45,"value":787},"Copilot のセキュリティ設定は、",{"type":40,"tag":64,"props":789,"children":790},{},[791],{"type":45,"value":792},"権限・秘密度ラベル・DLP・監査",{"type":45,"value":794},"の4層で考えます。一般的な中小企業の土台は、権限と監査です",{"type":40,"tag":120,"props":796,"children":797},{},[798,800,805,807,812,813,818],{"type":45,"value":799},"多くの中小企業には、秘密度ラベルと DLP までは必要ありません。",{"type":40,"tag":64,"props":801,"children":802},{},[803],{"type":45,"value":804},"プランに入っていない",{"type":45,"value":806},"、",{"type":40,"tag":64,"props":808,"children":809},{},[810],{"type":45,"value":811},"リスクの中心は権限の整理で防げる",{"type":45,"value":806},{"type":40,"tag":64,"props":814,"children":815},{},[816],{"type":45,"value":817},"運用が続かない",{"type":45,"value":819},"、の3つが理由です",{"type":40,"tag":120,"props":821,"children":822},{},[823],{"type":45,"value":824},"規制のある業種、取引先から情報管理を求められる会社、機微な個人情報を大量に扱う会社、上位プランを契約済みの会社は、後編の段階設計で導入します",{"type":40,"tag":120,"props":826,"children":827},{},[828,829,834],{"type":45,"value":142},{"type":40,"tag":64,"props":830,"children":831},{},[832],{"type":45,"value":833},"権限の整理と専用サイトへの分離、監査ログの確認、プロンプトへの DLP",{"type":45,"value":835},"の3つは、追加費用なしで取り組めます",{"type":40,"tag":41,"props":837,"children":838},{},[839,843],{"type":40,"tag":48,"props":840,"children":841},{"href":97},[842],{"type":45,"value":100},{"type":45,"value":844},"では、秘密度ラベルと DLP が必要な会社に向けて、「警告」から始める段階設計を解説します。",{"title":7,"searchDepth":846,"depth":846,"links":847},2,[848,849,855,856,861,862,863],{"id":153,"depth":846,"text":156},{"id":340,"depth":846,"text":343,"children":850},[851,853,854],{"id":347,"depth":852,"text":350},3,{"id":379,"depth":852,"text":382},{"id":413,"depth":852,"text":416},{"id":429,"depth":846,"text":432},{"id":547,"depth":846,"text":550,"children":857},[858,859,860],{"id":553,"depth":852,"text":556},{"id":594,"depth":852,"text":597},{"id":630,"depth":852,"text":633},{"id":679,"depth":846,"text":682},{"id":753,"depth":846,"text":756},{"id":777,"depth":846,"text":777},"markdown","content:articles:copilot-security-settei-chusho.md","content","articles\u002Fcopilot-security-settei-chusho.md","articles\u002Fcopilot-security-settei-chusho","md",[871,876,881,885,890,895,898],{"_path":872,"title":873,"seriesNo":874,"seriesLabel":875},"\u002Farticles\u002Fm365-copilot-donyu-roadmap","Microsoft 365 Copilot 導入ロードマップ｜非IT企業がライセンス配布前に決めること",1,"第1回",{"_path":877,"title":878,"seriesNo":879,"seriesLabel":880},"\u002Farticles\u002Fcopilot-shanai-kitei-edp","Copilotのエンタープライズデータ保護（EDP）とは｜「外部AI禁止」の社内規程でも使えるかの判断手順",1.5,"特別編",{"_path":882,"title":883,"seriesNo":846,"seriesLabel":884},"\u002Farticles\u002Fcopilot-data-okiba-box-sharepoint","Copilotは社内データを学習する？｜参照できるデータの条件とSharePoint・OneDrive・Boxの使い分け","第2回（前編）",{"_path":886,"title":887,"seriesNo":888,"seriesLabel":889},"\u002Farticles\u002Fcopilot-mail-chat-ikou-checklist","Exchange Online移行の注意点とLINE WORKSからTeamsへの判断｜Microsoft 365 Copilot導入前チェックリスト",2.5,"第2回（後編）",{"_path":891,"title":892,"seriesNo":893,"seriesLabel":894},"\u002Farticles\u002Fm365-copilot-iranai-google-hikaku","Microsoft 365 Copilotはいらない？無料版との違い・料金と「Googleより高い」への答え方",2.8,"番外編",{"_path":896,"title":897,"seriesNo":852,"seriesLabel":130},"\u002Farticles\u002Fcopilot-joho-rouei-sharepoint-kengen","Microsoft 365 Copilotの情報漏洩対策｜SharePoint・OneDrive・Teamsの権限を棚卸しして是正する手順",{"_path":4,"title":8,"seriesNo":13,"seriesLabel":14},1790609064843]