Use OneDrive-stored user-defined custom skills in PowerPoint Copilot (Mac)

🚨 The Signal: PowerPoint Copilot for Mac now supports user-defined custom skills stored in OneDrive. This allows users to extend Copilot's capabilities with personal scripts, potentially introducing unvetted code into the M365 environment and increasing supply chain risk.

The Impact

Users can introduce custom code, creating a supply chain risk for the organization.

• End users: Can inadvertently introduce malicious or vulnerable code via custom skills.
• Security team: Faces increased risk of unvetted code execution and data exfiltration.
• Administrators: Must manage new vectors for code execution and data handling within Copilot.
• Organization: Faces potential data breaches or system compromise from untrusted custom skills.

The Action

1. Review Microsoft's guidance on governing Copilot custom skills and extensions.
2. Develop and communicate an organizational policy on the creation and use of Copilot custom skills.
3. Implement data loss prevention (DLP) policies to monitor and restrict sensitive data handling by Copilot skills.
4. Educate users on the risks associated with custom skills and the importance of only using trusted sources.

Domain: Agentic-AI · Impact: high · Workload: M365 Apps