Add and upload your custom skills to OneDrive from within PowerPoint Copilot (Desktop)

🚨 The Signal: Users can now create and upload custom Copilot skills directly within PowerPoint, storing them in OneDrive. This decentralises skill management, increasing the risk of unapproved or malicious custom instructions impacting data and system integrity.

The Impact

Microsoft 365 Copilot users are affected, with a security risk of unapproved code execution and data exfiltration via custom skills.

• Copilot users: Risk of executing unapproved or malicious custom instructions.
• Security teams: Increased attack surface for data exfiltration and integrity compromise.
• Administrators: New challenge in monitoring and governing custom Copilot skill usage.
• Organisations: Potential for policy violations and compliance breaches due to unmanaged skills.

The Action

1. Review and update existing Copilot governance policies to specifically address custom skill creation and usage.
2. Implement Microsoft Purview Data Loss Prevention (DLP) policies to monitor and restrict sensitive data handling by Copilot and custom skills.
3. Educate users on the risks associated with creating and using unverified custom Copilot skills.
4. Monitor Microsoft 365 audit logs for unusual activity related to custom skill creation or modification in OneDrive.
5. Consider implementing Conditional Access policies to restrict access to Copilot features based on device compliance or location.

Domain: Agentic-AI · Impact: high · Workload: M365 Apps · Essential Eight: Application Control, User Application Hardening · ISM: ISM-0843, ISM-1412, ISM-1485, ISM-1486, ISM-1490, ISM-1542, ISM-1544, ISM-1582, ISM-1585, ISM-1656, ISM-1657, ISM-1658, ISM-1659, ISM-1660, ISM-1667, ISM-1668, ISM-1669, ISM-1670, ISM-1823, ISM-1824, ISM-1859, ISM-1860, ISM-1870, ISM-1871