Microsoft Copilot accesses data based on the signed-in user's permissions, including content they have at least view permissions for. However, SharePoint's default sharing settings are the most permissive, which can lead to accidental oversharing where the assistant retrieves documents shared too broadly.
To manage these risks, Microsoft provides several tools. Content Management Assessment identifies potentially overshared content, while Data access governance reports help find sites with sensitive data. The 'Everyone except external users' (EEEU) report lists the top 100 sites shared with the entire organization over the last 28 days.
Administrators can use Restricted Access Control to block access to sites for users not in a specific group, regardless of prior links. Alternatively, Restricted Content Discovery hides content from Copilot and organization-wide searches without changing existing site permissions.
For sensitive data, Microsoft Purview Information Protection allows encryption via sensitivity labels or Information Rights Management (IRM). This encryption can specifically exclude programmatic access, thereby limiting the assistant's ability to access the content.
Administrators can monitor Copilot's activity using Content search or Microsoft Purview, as stored data includes prompts, responses, and citations to the source documents. Users can independently delete their own activity history via the My Account portal.
