We worked with a large financial organization on its Copilot rollout: we configured the controls and then ran a penetration test to see what was actually blocked. Here are the five steps, in the order we'd do them.
Step 1: Who uses Copilot, and from where
- Conditional Access for Copilot: Microsoft's Zero Trust guidance for Copilot recommends the common policies: require MFA for administrators and for all users, and block legacy authentication, with Microsoft 365 services and your other SaaS apps in the scope of the policies. With Entra ID P2 (included in Microsoft 365 E5), add MFA when sign-in risk is medium or high.
- Organization accounts only: tenant restrictions block signing in to Copilot with a personal account or another organization's account from company devices.
- No self-service purchase: in the Microsoft 365 admin center, block Copilot self-service trials and purchases so no one turns it on outside your controls. (On Copilot Business? Also read about the usage-based billing that turns on on 1 December.)
Step 2: Fix oversharing before Copilot finds it
Copilot answers from whatever the user can access. A SharePoint site accidentally shared with "everyone in the organization" becomes an answer any employee can get.
- Site access reviews: Data access governance reports show which sites are overshared and ask site owners to review them.
- Restricted Content Discovery: sensitive sites don't surface in Copilot answers or organization-wide search, even for people with access.
- Restricted Access Control: a sensitive site opens only for members of a set group, even if someone else got a link before.
- External sources: check that no Graph connectors feed data from other systems into Copilot answers without a decision to do so.
Step 3: Sensitivity labels and DLP for Copilot
- Purview DLP for the Microsoft 365 Copilot location: files with a given sensitivity label aren't used to build the answer. Copilot can show a link to them, but not their content.
- DLP for AI sites in the browser: detects sensitive data pasted or uploaded to external AI sites from Edge, Chrome and Firefox.
- File uploads: a Defender for Cloud Apps session policy can block uploading files to a Copilot chat.
Step 4: Close the side doors
- Agents: in Integrated apps, set who can use Copilot agents: no one, or an approved group.
- Copilot Studio: block it, or limit who builds agents, who they can be shared with, and which connectors Power Platform DLP allows. Our Power Platform security guide covers this in detail.
- Copilot in Power Apps and data sharing: turn them off if you don't use them, and turn off data sharing with Microsoft for Dynamics 365 and Power Platform Copilot features.
- Feedback to Microsoft: feedback from Copilot can include the prompt, the response, a screenshot and related files. Turn it off in the Microsoft 365 Apps cloud policy.
Step 5: Retain, review and monitor
- Retention policy for Copilot interactions: keep prompts and responses as your regulations require, for example two years.
- Communication Compliance: detects prompts and responses with sensitive data or inappropriate content in Copilot chats.
- Insider Risk and DSPM for AI: policies that detect risky prompts and responses containing sensitive data, and raise an alert.
You don't have to finish all five steps before you start. Begin with a pilot group and steps 1 and 2, then expand. We do all of this in our Copilot security service, as part of our Microsoft 365 security projects.
Can Copilot see files I don't have access to?
No. It only works with what the user can already open. The problem is that in many organizations users can open far more than anyone thinks.
Does Microsoft use our data to train its models?
According to Microsoft, Microsoft 365 Copilot prompts, responses and data aren't used to train the models. Feedback a user sends is a separate channel, which is why we turn it off.
Should we wait with Copilot until everything is in place?
No. Start with a small group and the access controls, fix oversharing on the sensitive sites, then expand.
Want to roll out Copilot without exposing data? We'll check what Copilot would see in your environment before you roll it out.
Talk to us