Keep PII safe in every LLM call

Personal and company data reaches your models from every direction. A customer pastes a card number into a support chat, an agent forwards a case file, and a model repeats an email address it saw earlier in the conversation. When each team filters its own traffic, or nobody does, sensitive values reach a provider you do not control and come back out in answers to people who were never meant to see them.

What you can do

• Inspect both the prompt and the model’s response on every call through a surface so that sensitive values are caught on the way in and on the way out.
• Redact a match and continue, or block the call outright, for each guard so that every type of data gets the handling its sensitivity calls for.
• Replace values with stable NER IDs instead of blanking them so that the model can still tell one person or address from another, and the caller gets the real values back.
• Detect free-form PII, such as names, organisations, and addresses, with a model-backed detector so that protection covers more than values a pattern can describe.
• Ground answers on Microsoft 365 documents through Microsoft 365 Copilot so that the documents themselves never leave the Microsoft 365 boundary.

How it works

Prompt Guard runs on both seams of a surface, so one surface configuration covers what is sent to the model and what comes back from it. On the request seam, Regular Expression guards match well-shaped values such as email addresses, card numbers, and phone numbers from built-in patterns or your own custom regex. AI Matching guards, offered on the request seam only, add a model-backed detector for free-form PII such as people, organisations, and addresses. The AI Matching detector fails closed by default, so an unavailable detector rejects the request instead of passing unchecked text to the provider.

On the response seam, Regular Expression guards screen the model’s answer before it reaches the caller. Text already streamed to a caller cannot be taken back, so a surface with a response guard holds a streamed answer until it has been screened, then returns it.

Each guard’s When detected setting picks what happens to a match: Reject the call completely, Redact the text that matches the pattern, or Use a NER ID to preserve context. A NER ID is a stable pseudonym, such as [EMAIL_NER_001], reused for the same value everywhere it appears, so the provider reasons over consistent text without ever seeing the real value. With Restore original values in the response turned on for a Regular Expression guard, or Restore in response for an AI Matching guard, the real values are swapped back into the answer as the last step, for the caller only.

For questions over company documents, the Microsoft 365 Copilot provider calls Microsoft 365 Copilot as the signed-in user with a delegated Entra token. Copilot grounds its answer on that user’s OneDrive, SharePoint, mail, and calendar under their existing Entra access control lists (ACLs), and returns only the synthesised answer. The raw documents never reach the agent, the editor, or the appliance.

Prompt Guard inspects message text and tool-call arguments, including text the Document File element extracts from an attachment. A document forwarded to the provider as a file reaches the model without PII inspection, so have the Document File element extract its text when the contents must be screened. Attached audio and images also pass through uninspected, since they carry no message text.

Related

• PII protection: How the two detectors, the three actions, and NER ID restoration work in full.
• Detect free-form PII with AI matching: Step-by-step configuration of a model-backed PII detector on a surface.
• Pseudonymise PII with NER IDs: How to replace values with stable pseudonyms and restore them in the response.
• Providers and Models: How the Microsoft 365 Copilot provider grounds answers without exposing raw documents.
• Shut down the OWASP top risks: The wider guardrail pipeline that blocks prompt injection, jailbreaks, and toxic content.