Microsoft 365 Copilot does not bypass your security. It works inside it. Copilot only surfaces data the signed-in user can already access, so your real Copilot security controls are the ones you already have: permissions, sensitivity labels, data loss prevention (DLP), and how you govern connectors and custom agents. This guide shows which controls to configure, in what order, and where the gaps are.
Two products share the name, and search results mix them up.
This article focuses on the first, with a section on the second near the end. If you are weighing where Copilot fits in your workflows first, our Copilot use cases for 365 piece covers six pilots.
Microsoft’s architecture documentation is clear that Copilot never has access to data the user cannot access. That is reassuring, and it is also the source of the main risk.
Most small businesses have years of accumulated sharing. A folder opened to “everyone in the company” for one project in 2019. A SharePoint site created by a former employee. A finance spreadsheet saved to a shared library. None of that was a problem when nobody went looking. Copilot makes it easy to find, because a user can simply ask a question in plain language.
Microsoft’s own guidance frames the primary risk as oversharing of data that already exists in SharePoint and OneDrive, not the AI model itself. So the first control is not a Copilot setting. It is a clean-up.
Before you assign Copilot licences broadly, do this in order:
For a law firm or accounting practice, this step often takes the longest, because client matters live in many places. Our guide on SharePoint for law firms shows how structured libraries make this easier.
Sensitivity labels from Microsoft Purview let you classify content and attach protection, such as encryption and usage rights. Copilot respects them in specific ways.
These come from Microsoft’s own considerations page, and they catch people out.
The practical lesson: labels are a strong second layer, not a replacement for correct permissions. For a baseline that does not break your line-of-business apps, see our Microsoft 365 security baseline.
Data loss prevention is where you can stop sensitive data at the moment of interaction. As of October 2026, Purview DLP can block Microsoft 365 Copilot from processing prompts that contain sensitive information types, such as credit card or SIN numbers, and can stop it from using files or emails that carry specific sensitivity labels.
Supported sensitive information types include Microsoft’s built-in types and custom types you define. Endpoint DLP can also block users from pasting sensitive content from Microsoft 365 into browser-based third-party AI sites, which matters if staff are tempted to use unapproved tools.
You cannot combine a “content contains sensitive info types” condition and a “content contains sensitivity labels” condition in the same Copilot DLP rule. You need separate rules for each. For a business with several departments, that means more rules to maintain. Keep the structure simple:
| Rule purpose | Condition | Suggested scope |
|---|---|---|
| Keep SINs and card numbers out of prompts | Sensitive info types | All Copilot users |
| Keep labelled files out of responses | Sensitivity labels | Departments handling client or patient data |
| Stop pasting into outside AI sites | Endpoint DLP | All managed devices |
Start in test mode, review the matches, then enforce. Name rules clearly so the person who inherits them can understand them.
Copilot is tenant-aware, but not necessarily context-aware for external content. When you bring outside data in through plugins or Microsoft Graph connectors, that data may not support the same sensitivity labels and encryption as native Microsoft 365 documents.
What to do:
If your team builds custom agents, governance needs layers. Microsoft’s Copilot Studio guidance describes geographic data residency, DLP, and environment routing among its controls.
A workable pattern for a mid-sized business:
This is the same discipline you would apply to low-code apps. Our piece on Power Apps governance covers the overlap.
You cannot govern what you cannot see. Copilot interactions are covered by Microsoft Purview capabilities, and Microsoft publishes a capability table by product showing which Purview features support Copilot and Copilot Chat. Check it against your licence tier before you promise your board or regulator a given control.
Also decide how long prompts and responses are kept. Retention rules for mail and chat apply to your wider compliance picture, and our Exchange Online retention policies guide covers setup. Licensing affects what is available, so review the Microsoft 365 licensing guide before you design controls you may not be entitled to use.
Microsoft states that Copilot applies layered protections at several stages of prompt processing, aimed at reducing security, privacy and compliance risk before a prompt reaches the language model. These run without your configuration. They do not replace your own controls, but they are part of the picture when someone asks how the service defends against manipulation.
If your IT team or provider uses Microsoft Security Copilot for investigations, these points apply:
Review the data sharing default deliberately, especially if client confidentiality is a concern.
| Week | Focus | Output |
|---|---|---|
| 1 | Permissions review | List of overshared and ownerless sites |
| 2 | Remediation and labelling | Cleaned high-risk sites, labels on key files |
| 3 | DLP and connector review | Test-mode DLP rules, trimmed connector list |
| 4 | Pilot group and audit review | Small rollout, findings, go/no-go for wider use |
This is a starting frame. A firm with decades of file shares will need longer, and that is normal.
We see the same pattern with Ontario clients: the AI conversation starts with the licence and should start with the data. Copilot is not the risk. It is a very good search tool pointed at whatever your tenant already lets people see.
So we ask three questions before any rollout. Who can see what today? Which files would hurt if surfaced by the wrong person? Who owns the policies once we are done? Plain answers to those matter more than any single toggle.
We also suggest teams keep the rollout small and reversible. A pilot group, test-mode DLP and a named owner for connectors will teach you more in a month than a long planning document. As a SOC 2 Type II certified provider, we run our own processes the same way: documented, audited and repeatable.
— Geeshan
If you would rather not carry this work alongside your day job, our Microsoft 365 Optimization service covers tenant clean-up and configuration, and our managed IT services team can keep permissions, labels and policies maintained after launch. For monitoring and response around your Microsoft environment, see our 24/7 SOC and MDR options. For secure AI adoption more broadly, our AI adoption guide for small businesses is a good next read.
Microsoft’s documentation describes Copilot as operating on your data within your tenant’s boundaries and permissions. Training and data-handling terms differ by product and agreement, so confirm the current terms for your licence in Microsoft’s documentation and your contract. For Security Copilot, the data sharing setting is on by default and administrators can change it.
Not if the user cannot access them. Copilot works from the user’s existing rights. The gap is in files that are accessible but should not be, which is why a permissions review comes first. Label individual files, not only containers.
Yes. Purview DLP can block Copilot from processing prompts that contain specified sensitive information types, and from using files with chosen sensitivity labels. Use separate rules for types and labels, as they cannot be combined in one rule.
Microsoft has said local inferencing for Copilot interactions in Canada is to follow in 2027. Until then, check Microsoft’s current residency documentation against any contractual or regulatory requirement you have, and ask your provider to confirm in writing.
%20(1).avif){kind=logo}
%201.avif)
