In short
Microsoft Copilot security is mainly about permissions. Microsoft says Copilot only surfaces organisational data a user can at least view, does not use prompts or responses to train foundation models, and honours Purview sensitivity label rights. The main risk is oversharing, plus the many non-Microsoft AI tools staff use that Copilot does not govern.
Get a quote for Microsoft Copilot security
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
Which Copilot this page is about
Microsoft uses the Copilot name for several products, so it is worth being precise:
- Microsoft Copilot for work: the assistant in Word, Excel, PowerPoint, Outlook, Teams and the Copilot app. Microsoft says the Microsoft 365 Copilot app is now called Microsoft Copilot, while the licences are still named Microsoft 365 Copilot. This page is about it.
- Microsoft Security Copilot: an AI tool for security teams investigating incidents. It is a different, separately licensed product, covered by our sister site's guide to Microsoft Security Copilot.
- GitHub Copilot: a coding assistant, covered in our guide to AI coding assistant security.
The licence matters for security. Microsoft describes Copilot Chat (Basic) and Microsoft 365 Copilot (Basic) as grounded in web data, using organisational content only when a user uploads it, works with open content in Outlook or Teams, or uses an agent. Microsoft 365 Copilot (Premium), the paid add-on, grounds answers automatically in your organisation's data through Microsoft Graph and Work IQ. Oversharing, below, is mainly a Premium question; data pasted or uploaded into Copilot Chat is a data leakage question on every licence.
Microsoft's commitments below apply to Microsoft 365 commercial customers signed in with work (Microsoft Entra) accounts. Microsoft also lists Copilot entry points for people signed in with a personal Microsoft account, and those commitments are not the ones that apply there, which is a shadow AI question. See what is shadow AI.
How Microsoft Copilot handles your data
Microsoft's Learn article *Data, Privacy, and Security for Microsoft Copilot* sets out how the service works. The points that matter for security:
- Permissions: Copilot "only surfaces organizational data to which individual users have at least view permissions", using the same access controls as the rest of Microsoft 365
- Training: prompts, responses and data accessed through Microsoft Graph are not used to train foundation large language models
- Stored interactions: prompts, responses and citations are stored as the user's Copilot activity history, encrypted and handled under the same contractual commitments as other Microsoft 365 content; admins can find them with Content search and set retention with Microsoft Purview, and users can delete their own history
- Sensitivity labels: where content is encrypted by Microsoft Purview Information Protection, through sensitivity labels or Information Rights Management, Copilot honours the usage rights granted to the user
- Prompt injection: Microsoft uses jailbreak and cross-prompt injection attack (XPIA) classifiers to help block high-risk prompts, and notes these may not be available in every Copilot scenario
- Web search: when web search is used, Copilot generates a search query from the prompt and sends it to the Bing search service
- Agents and connectors: Microsoft Graph connectors and agents can bring in third-party data; admins choose which agents are allowed in the Microsoft 365 admin center, and Microsoft advises checking each agent's privacy statement and terms
- Other AI models: admins can choose whether to use models from Anthropic and OpenAI as subprocessors, where additional terms may apply
- Where processing happens: EU traffic stays within the EU Data Boundary, but Microsoft says customers outside the EU may have queries processed in the US, EU or other regions, and that Anthropic models are currently excluded from the EU Data Boundary
For a UK organisation, the last two points are worth reading carefully alongside your records of processing and any DPIA.
The real risk: Copilot oversharing
Because Copilot shows people what they already have permission to see, the main Microsoft Copilot security risk is not Copilot leaking data outside the organisation. It is Copilot oversharing: surfacing content inside the organisation to people who technically have access but should not.
Before Copilot, an over-shared spreadsheet in a forgotten SharePoint site was hard to find. With Copilot, a user asking a plain question can be shown it in seconds. Typical causes:
- Sharing links set to "anyone in the organisation" and not removed since
- Sites, teams and libraries open to large groups by default
- Old project sites that still contain HR, finance or client material
- Permissions inherited from parent sites without anyone checking
- Guests and shared channels with access wider than intended
Illustrative examples, not incidents at any particular organisation: a user asks about pay rises and Copilot finds a salary review workbook; a new starter asks about a client and is shown a confidential dispute file; someone asks for "board papers this quarter" and gets drafts not meant for them. In each case Copilot is working as designed. The permissions are the problem.
Is Microsoft Copilot security the right fit for you?
We will check it against your systems and requirements and recommend the right option.
How to fix M365 Copilot oversharing
- Find your sensitive content. Identify the sites, teams and libraries that hold HR, finance, legal and client material, and who can reach them.
- Tighten sharing. Remove broad sharing links and organisation-wide access where they are not needed, and review guest and external access.
- Label and protect. Apply sensitivity labels with encryption to the content that matters, so Copilot honours the usage rights rather than relying on site permissions alone.
- Add DLP and retention. Use Microsoft Purview data loss prevention and retention policies for Copilot interactions where your licences allow.
- Restrict discovery while you review. Microsoft includes SharePoint Advanced Management with Microsoft 365 Copilot (Premium); its restricted content discovery can keep specific SharePoint sites out of organisation-wide search and Copilot responses while their permissions are reviewed.
- Pilot before broad rollout. Give Copilot to a representative group first and test what it can find for typical roles.
- Keep reviewing. Permissions drift; check them again as teams, projects and people change.
The configuration work sits in Microsoft 365 and Microsoft Purview. Our sister site covers it in detail: see Microsoft 365 security and Microsoft Purview.
Copilot security controls and what they leave
Microsoft's controls are strong inside Microsoft 365. They are not designed to govern the rest of your people's AI use:
| Risk | Microsoft control | What remains |
|---|---|---|
| Oversharing inside Microsoft 365 | Permission model, sensitivity labels, Purview | Fixing permissions is a project, not a setting |
| Training on your data | Prompts, responses and Graph data not used to train foundation models | Other AI tools staff use have their own terms |
| Prompt injection in emails and documents | Jailbreak and XPIA classifiers | Classifiers reduce risk but are not available in every scenario |
| Agents and connectors | Admin control of allowed agents in the admin center | Each agent's own terms and permissions need review |
| Staff using ChatGPT, Gemini, Claude, DeepSeek and others | Outside Copilot's scope | Needs discovery and controls in the browser and on the device |
| AI browser extensions and desktop AI apps | Outside Copilot's scope | Needs discovery and per-app policy |
| Personal Copilot or other personal AI accounts | Microsoft points admins to tenant restrictions to control personal Microsoft account sign-in | Personal accounts on other AI services need policy and managed versus unmanaged controls |
The bottom half of that table is outside Copilot's reach, and it is where a lot of everyday AI data leakage starts. Approving Copilot is a good way to give people a safer option; it does not make the other AI tools go away. See AI data leakage and ChatGPT security risks.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
Where Workforce AI Security fits alongside Copilot
Check Point Workforce AI Security does not replace Microsoft's permission model or Purview for content inside Microsoft 365, and we would not suggest it does. It covers what Copilot does not: the wider AI estate.
Check Point names Copilot among the public AI tools it covers, alongside ChatGPT, Gemini and Claude. From Check Point's material, it can:
- Discover the AI apps, extensions, coding assistants and agents in use, sanctioned or shadow, so you can see Copilot adoption next to everything else
- Apply per-app policies, including different policies for managed and unmanaged apps
- Redact or block personal data, credentials, source code and financial data in prompts, uploads, files and images, across the AI tools people use in the browser
- Govern agents and MCP-connected workflows, and block risky agentic actions at runtime, in the Enterprise tier
- Keep audit trails and reports of AI use across tools, not just Microsoft's
Workforce AI Security Essentials covers AI used through web applications; Workforce AI Security Enterprise adds desktop AI apps, code assistants such as GitHub Copilot, and agentic tools. See how Workforce AI Security works.
How we help
Forever Systems can help you prepare for and secure Microsoft Copilot from both sides: reviewing permissions, labels and Purview settings in Microsoft 365, and using Workforce AI Security to discover and control the AI tools your people use outside it. We start with discovery so you see where the real exposure is before rollout. Ask us for a quote.
To talk about Microsoft Copilot security, contact us.
How Forever Systems helps you use AI safely
We are an independent UK IT and cyber security provider. We supply Check Point Workforce AI Security and help organisations put sensible, workable rules around AI at work.
- See what is really in use: we can start with a discovery pilot, so you know which AI tools, browser extensions, coding assistants and agents your people use before anyone writes rules
- Policy you can enforce: we help you decide what to approve, restrict or block, and turn your AI acceptable use policy into Workforce AI Security policies
- The right tier: Essentials for browser-based AI, Enterprise when desktop apps, developer code assistants and agents are in the picture, confirmed at quote
- Staged roll-out: from monitoring to warnings, redaction and blocking at a pace your people can absorb, with reviews along the way
- Around the tool: Microsoft 365 permissions ahead of Copilot, device management for the extension and agent, and safe use of AI training for staff
We work with businesses, schools, charities and public sector organisations. Our guides are general information, not legal advice.
Frequently asked questions
Is Microsoft Copilot secure?
Microsoft says Copilot only surfaces organisational data users can at least view, does not use prompts, responses or Graph data to train foundation models, and honours Purview sensitivity label rights. The main risks are oversharing from loose permissions, staff using personal accounts, and AI tools outside Microsoft 365 that Copilot does not govern.
What is Copilot oversharing?
Copilot oversharing is Copilot surfacing content to users who technically have permission to see it but should not, because of broad sharing links, open sites or inherited permissions. Copilot works as designed; the fix is tightening permissions and applying sensitivity labels.
Does Microsoft Copilot use our data to train its models?
Microsoft says prompts, responses and data accessed through Microsoft Graph are not used to train foundation large language models, including those used by Microsoft Copilot.
Is Microsoft Copilot the same as Microsoft Security Copilot?
No. Microsoft Copilot, licensed to businesses as Microsoft 365 Copilot, is the assistant in Word, Outlook, Teams and other apps. Microsoft Security Copilot is a separately licensed tool for security teams investigating threats.
Where is Microsoft Copilot data processed for UK organisations?
Microsoft says EU traffic stays within the EU Data Boundary, while customers outside the EU may have queries processed in the US, EU or other regions, and Anthropic models are currently excluded from the EU Data Boundary. Check Microsoft's current documentation and your data residency terms.
Do we need other AI security if we use Copilot?
Usually yes. Copilot's controls cover Microsoft 365. Staff still use other AI tools, extensions, desktop apps and agents, which need discovery and controls such as Workforce AI Security to keep sensitive data out of them.
Still have a question about Microsoft Copilot security?
Ask us and a member of our team will reply by email.