Copilot Notebooks now supports Markdown (.md) files as grounding sources

🚨 The Signal: Copilot Notebooks can now use Markdown (.md) files as grounding sources, expanding the data available for AI responses. This increases the risk of sensitive information exposure if Markdown files are not properly secured.

The Impact

Users with Copilot Notebooks access are affected, increasing the risk of sensitive data exposure through AI grounding.

• Copilot Notebooks users: Risk of unintended exposure of sensitive data from Markdown files.
• Teams maintaining Markdown documentation: Increased need for content review and access controls.
• Organizations using Copilot: Higher risk of AI-generated responses containing restricted information.
• Security teams: New vector for data leakage requires updated monitoring and data loss prevention policies.

The Action

1. Review and classify all Markdown (.md) files in SharePoint and OneDrive for sensitivity.
2. Implement or refine Microsoft Purview Data Loss Prevention (DLP) policies to detect and restrict sensitive Markdown content.
3. Audit access permissions for all repositories containing Markdown files used for Copilot grounding.
4. Educate users on responsible use of Markdown files as Copilot grounding sources and the risks of sensitive data exposure.
5. Monitor Copilot usage logs for unusual access patterns or data exposure incidents related to Markdown files.

Domain: Agentic-AI · Impact: high · Workload: M365 Apps