Microsoft Viva: Targeted audience surveys in the Copilot dashboard

🚨 The Signal: Microsoft Viva Pulse surveys can now be sent to targeted Copilot user groups directly from the Copilot dashboard by CxO roles. This streamlines feedback collection but expands data access for specific roles.

The Impact

CxO roles gain new data access, increasing the risk of unintended information exposure if roles are not properly managed.

  • CxO roles: New ability to access and survey specific Copilot user cohorts, increasing data exposure risk.
  • Security Teams: Must review and validate role assignments for CxO and CxO-delegate to prevent unauthorized data access.
  • Compliance Teams: Requires assessment of data privacy implications for targeted surveys and data handling.
  • Copilot Licensed Users: May be subject to targeted surveys, increasing data collection points.

The Action

  1. Review Entra ID role assignments for 'CxO' and 'CxO-delegate' to ensure least privilege is enforced.
  2. Audit existing Viva Pulse policies for data retention and privacy settings.
  3. Communicate new data collection capabilities to relevant privacy and compliance stakeholders.
  4. Monitor audit logs for survey creation and audience targeting activities by CxO roles.

Domain: Other · Impact: medium · Workload: Other · Essential Eight: Restrict Administrative Privileges · ISM: ISM-0445, ISM-1175, ISM-1380, ISM-1507, ISM-1508, ISM-1509, ISM-1647, ISM-1648, ISM-1650, ISM-1686, ISM-1688, ISM-1689, ISM-1883, ISM-1897, ISM-1898