Use OneDrive stored user defined custom skills in PowerPoint Copilot (web)

🚨 The Signal: PowerPoint Copilot on the web now supports personal, user-defined custom skills stored in OneDrive. Users can upload skill folders, and manage them directly, enabling tailored Copilot functionality but introducing new vectors for malicious skill injection.

The Impact

Users and security teams are affected by the introduction of user-defined custom skills, posing a risk of malicious code execution and data exfiltration.

• Users: Can inadvertently execute malicious code via custom skills.
• Security Teams: Must now monitor and govern user-defined Copilot skills.
• Administrators: Need to define policies for custom skill usage and storage.
• Organisations: Face increased risk of data exfiltration and integrity compromise.

The Action

1. Review and update your organisation's acceptable use policy for Copilot and custom skills.
2. Implement data loss prevention (DLP) policies to monitor skill content and data interactions.
3. Educate users on the risks of uploading and using unverified custom skills.
4. Monitor Microsoft Purview audit logs for unusual activity related to skill uploads and Copilot interactions.
5. Consider restricting OneDrive access for skill storage if not explicitly required for business functions.

Domain: Agentic-AI · Impact: high · Workload: OneDrive · Essential Eight: Application Control, User Application Hardening · ISM: ISM-0843, ISM-1412, ISM-1485, ISM-1486, ISM-1490, ISM-1542, ISM-1544, ISM-1582, ISM-1585, ISM-1656, ISM-1657, ISM-1658, ISM-1659, ISM-1660, ISM-1667, ISM-1668, ISM-1669, ISM-1670, ISM-1823, ISM-1824, ISM-1859, ISM-1860, ISM-1870, ISM-1871