Microsoft 365 Copilot: Draft Outlook emails directly in Copilot Chat on mobile

🚨 The Signal: Copilot Chat on mobile will now embed Outlook email drafts directly within the chat interface. This streamlines email creation, but increases the surface area for sensitive data exposure within the Copilot mobile experience.

The Impact

Users leveraging Copilot Chat on mobile are affected, with a security risk of increased exposure of sensitive email content within the Copilot interface.

• End users: Risk of sensitive email content being visible within Copilot Chat history on mobile devices.
• Security team: Increased surface area for data exfiltration or accidental disclosure via Copilot Chat.
• Compliance team: New data flow paths for email content may complicate data residency and classification adherence.
• Mobile users: Potential for sensitive data to be cached or displayed in Copilot Chat on less secure mobile devices.

The Action

1. Review existing Microsoft 365 Copilot data governance policies for mobile access and data retention.
2. Educate users on the implications of drafting sensitive emails within Copilot Chat on mobile.
3. Assess mobile device security postures, especially for devices accessing Copilot Chat with email drafting capabilities.
4. Monitor Copilot usage logs for unusual activity related to email drafting and sensitive information handling.
5. Update data classification and retention policies to explicitly cover content generated and displayed within Copilot Chat.

Domain: Agentic-AI · Impact: high · Workload: M365 Apps