AB-900 lesson 7: Copilot and your data

Microsoft 365 Copilot reaches organisational data through Microsoft Graph and returns only content that the signed-in user is already allowed to open. It does not have its own key to the tenant, and the prompts, responses and data it retrieves through Graph are not used to train the foundation language models. The practical result is that Copilot is exactly as careful as the permissions underneath it. (Microsoft’s documentation has begun calling the product Microsoft Copilot; the AB-900 outline still uses Microsoft 365 Copilot, so this course keeps that name.)

The path of one prompt

Following a single request makes the model concrete. A user types a prompt in an app or in Copilot Chat. Copilot first works out what the request needs and builds a search over the user’s content and working context: email, files, chats, meetings, calendar and contacts. That retrieval step is called grounding, and it goes through Microsoft Graph, the layer that exposes the user’s Microsoft 365 data. Graph retrieval respects the user’s identity, so documents the user cannot open are never fetched. The retrieved snippets and the prompt then go to the large language model, which writes a response. The response is returned with citations to its sources.

The figure above shows where each safeguard sits. The permission boundary applies at the grounding step, before the model sees anything; the later controls inspect and record what happens around the response.

Permissions are the first control

Because grounding runs as the user, the existing permission model decides what can appear: SharePoint site and file permissions, sharing links, mailbox access, Teams membership. Microsoft’s guidance is that Copilot surfaces data the user has at least view permission to. That includes content reachable through sharing with people outside the organisation, for example through shared channels.

This leads to the idea behind the next lesson. Copilot does not widen access, but it removes the effort of finding things. A file shared with a whole department years ago may never have been noticed by anyone; once Copilot can search it in a second, the old decision becomes visible. If a user sees something surprising in an answer, the first diagnosis is almost always over-broad permissions, not a Copilot fault.

Additional controls that apply

Permissions are the floor, and Purview and Defender add layers on top.

• Sensitivity labels with encryption. Copilot checks the usage rights of the signed-in user. It works with an encrypted item only if the user has the right to view and to copy (the EXTRACT usage right); with view alone, Copilot will not summarise the content, although it can point to the file with a link. When a Copilot chat draws from several labelled items, the label with the highest priority is displayed. Items protected with Double Key Encryption are not returned by Copilot at all.
• Data loss prevention. DLP has a Microsoft 365 Copilot and Copilot Chat location. A rule there can stop Copilot from processing files and emails that carry chosen sensitivity labels, and can block prompts containing sensitive information types (the prompt control is still in preview in the current documentation).
• Audit and eDiscovery. Copilot interactions are audited and kept within Microsoft 365, so they can be found with Content search and eDiscovery and managed with retention policies. The audit log is meant for security and compliance, not for usage counts.
• Communication Compliance and Insider Risk Management. The first can review Copilot prompts and responses; the second has a risky AI usage template.
• Defender. Microsoft Defender XDR receives AI-related risk signals, and Copilot has built-in defences against harmful content and prompt injection attacks. The Copilot security dashboard in the Microsoft 365 admin center (Copilot, Overview, Security) pulls these topics together, and viewing it needs at least Global Reader.

DSPM for AI

Data Security Posture Management for AI is the Purview area for seeing AI use. It inventories which AI apps and agents are in use, shows activity including prompts and responses and whether they contained sensitive information, runs data risk assessments that look for oversharing, and offers one-click policies. The Purview portal now has a newer DSPM experience, and the earlier version is labelled DSPM for AI (classic).

Responsible AI principles

Microsoft frames its AI work around six principles: fairness, reliability and safety, privacy and security, inclusiveness, transparency and accountability. Copilot’s behaviour reflects them in practice: filters for harmful content, citations so people can check sources, and a reminder that users should review generated output. Responses are not guaranteed to be factual.

Worked example: a sales team asks about pay

In a 200-person company, a salesperson asks Copilot for the highest bonuses paid last year and receives figures from a finance workbook. The admin first confirms the cause: the workbook sits in a team site that was shared with all employees, so the salesperson could always open it. Copilot only made it easy to find. The fixes work at the source: tighten permissions on that site, apply an encrypted sensitivity label so that usage rights apply, and use DSPM for AI or the Copilot security dashboard to find similar cases before they cause surprises.

Easy to confuse

• Permissions versus labels. Permissions decide who can reach an item; an encrypted label additionally controls what rights the person has on it.
• Grounding versus training. Graph data is used to ground a single answer; it is not used to train the foundation models.

Key points

• Copilot grounds answers through Microsoft Graph, using only data the signed-in user may access.
• Prompts, responses and Graph data are not used to train the foundation models.
• Encrypted labels require both view and copy (EXTRACT) rights before Copilot summarises content.
• Purview (labels, DLP, audit, retention, eDiscovery, Communication Compliance, Insider Risk) and Defender add controls around Copilot.
• DSPM for AI shows AI activity and sensitive data in prompts and runs oversharing assessments.
• Unexpected answers usually point to oversharing, which is fixed in permissions.

Check yourself

This lesson covers the Copilot data security part of the data protection and governance domain of AB-900 (35-40% of the exam); the recap in AB-900 data protection and governance condenses it, and the topic pages on responsible AI principles and AI governance and risk add background.