HEBook a call
Book a callHE
Our solutionsMicrosoft 365 SecurityGriffin31Admin RightsPatchingWeb SecurityCISO as a Service
AboutCustomer storiesBlogContactBook a call
Microsoft 365 Copilot · GitHub Copilot

Copilot Security

Your employees want Copilot, and your developers want GitHub Copilot. We prepare the organization, configure the controls, and run a penetration test to prove sensitive data stays inside.

When companies call us

  • Before a Copilot rollout

    You want to turn on Microsoft 365 Copilot, and don’t know what it will find in your folders and sites.

  • Developers already use AI

    Your development teams want GitHub Copilot, and your code can’t leave the organization.

  • Regulation and audit

    You need to show a regulator, an auditor or management that AI use is controlled and recorded.

  • Copilot is already on

    Copilot was turned on without a plan, and you want to know what’s open today and close it.

Microsoft 365 Copilot

Copilot doesn’t break permissions. It finds, in seconds, everything a user can already open. So we start with data and permissions, and only then with Copilot’s own settings.

  • Readiness and oversharing — Find SharePoint sites and files that are shared too widely, and restrict sensitive sites so they don’t surface in Copilot answers.
  • Access — Dedicated Conditional Access for Copilot: phishing-resistant MFA, a managed device, and personal and other-organization accounts blocked.
  • Sensitivity labels and DLP — Labeled data isn’t used to build answers, and sensitive data pasted into the chat or into other AI sites is detected.
  • Agents and side doors — Set who can use agents and Copilot Studio, and turn off file uploads, feedback to Microsoft and data sharing when they’re not needed.
  • Retention and monitoring — A retention policy for chats, detection of prompts and responses with sensitive data, and alerts on risky use.

GitHub Copilot for developers

An enterprise GitHub Copilot licence brings the whole GitHub platform with it. If developers only need a coding assistant in the IDE, everything else gets closed.

  • GitHub for licensing and governance only — Block repository creation, forks, Pages, Actions and outside collaborators, while code stays in your existing source control.
  • Organization-managed identities — Managed accounts provisioned from Entra ID, Conditional Access, and admin roles through PIM.
  • Copilot restrictions — Approved models only, with web search, MCP servers and unapproved agents blocked.
  • Managed IDE — VS Code and Visual Studio settings through Intune: approved extensions only, and Copilot only with the company account.
  • Network and DLP — Copilot reaches only approved endpoints through the corporate proxy, and DLP blocks keys and passwords inside prompts.

How it works

  1. Assessment. We check what’s already configured, what your licences include, and what Copilot would see in your environment today.
  2. Plan. A prioritized list of controls that fits your security policy and regulation.
  3. Hardening in a pilot group. We configure the controls on a small group, without stopping everyone else’s work.
  4. Penetration test. We try to get around the controls with real scenarios: a personal account, an unmanaged device, sensitive data in a prompt, agents, pushing code out.
  5. Rollout. We fix what the test found and expand Copilot to the rest of the organization.

From the blog

Microsoft 365 Copilot5 practical steps to secure Microsoft 365 CopilotCopilot sees everything a user can see. Five steps to take before and during rollout (access, oversharing, DLP, side doors and monitoring) and what a penetration test taught us.GitHub CopilotSecuring GitHub Copilot in the enterprise: what to lock down before developers get AIAn enterprise Copilot licence brings the whole GitHub platform with it. Which settings to close in GitHub Enterprise, Entra ID, the IDE and the network, and what a penetration test taught us.

All articles on the blog

FAQ

  • Can Copilot expose files an employee has no access to? — No. It only works with what the employee can already open. The problem is that in many organizations employees can open far more than anyone thinks, which is why we start with an oversharing check.
  • Do we need E5 to secure Copilot? — Not for every control. Some, such as advanced DLP and chat monitoring, need Purview licensing. In the assessment we’ll see what your licences already include and what’s worth adding.
  • Can we use GitHub Copilot without hosting code on GitHub? — Yes. GitHub Enterprise is used only to license and govern Copilot, and the code stays in your existing source control.
  • Should we wait with Copilot until everything is in place? — No. Start with a pilot group and the access controls, fix the sensitive sites, then expand step by step.

Works well with

Microsoft 365 SecurityZero Trust for identities, devices and dataLearn more →Griffin31Continuous checks of your tenant's security settingsLearn more →

Want Copilot without exposing data?

A one-hour technical intro with a security architect from the team: we’ll see what you have today, and what Copilot would see.

Book a meetingContact us