Dynamics 365 Customer Service - WEM in M365 Copilot for CSRs and Supervisors

🚨 The Signal: Dynamics 365 Workforce Management integrates with Microsoft 365 Copilot, allowing CSRs and supervisors to manage schedules and requests via natural language in M365 apps. This expands the attack surface for agentic AI interactions.

The Impact

Customer service staff and supervisors are affected, with a new risk vector for data exposure through Copilot's natural language interface.

• Security Team: New attack surface for prompt injection and data exfiltration via Copilot.
• Supervisors: Risk of unauthorized schedule or request changes if Copilot is compromised.
• Customer Service Representatives: Potential for unauthorized access to personal schedules or leave balances.
• Admin: Increased complexity in monitoring and auditing data access through Copilot.

Domain: Agentic-AI · Impact: medium · Workload: M365 Apps