OneNote: Multimodal capture in Copilot Notebooks (Android)

🚨 The Signal: Multimodal capture in OneNote for Android allows Copilot to combine audio, images, and notes into structured pages. This expands data ingestion vectors for AI, increasing the risk of sensitive information exposure and requiring enhanced data governance.

The Impact

Users with Copilot licenses on Android are affected, increasing the risk of sensitive data exposure through new multimodal capture capabilities.

  • End-users: Risk of inadvertently capturing and processing sensitive data via audio/image.
  • Security Teams: Increased surface area for data exfiltration and compliance breaches.
  • Data Governance Teams: New challenges in classifying and protecting multimodal AI-generated content.
  • Compliance Officers: Potential non-compliance with data handling regulations due to expanded capture.

The Action

  1. Review and update Microsoft Purview Data Loss Prevention (DLP) policies to include multimodal content types (audio, images) and Copilot Notebooks as data sources.
  2. Implement or refine Microsoft Purview Information Protection (MIP) sensitivity labels for Copilot Notebooks and associated content, ensuring automatic classification where possible.
  3. Educate users on responsible use of multimodal capture, emphasizing the risks of capturing sensitive information in public or unsecure environments.
  4. Monitor Copilot activity logs for unusual data capture or sharing patterns, focusing on multimodal content.
  5. Review and update data retention policies for Copilot Notebooks and AI-generated content to align with regulatory requirements.

Domain: Agentic-AI · Impact: high · Workload: M365 Apps