'Record A Skill' Capability in PowerPoint Copilot

🚨 The Signal: PowerPoint Copilot will allow users to record actions as reusable 'skills'. This could lead to sensitive data exposure if recorded workflows include confidential information or interact with restricted resources, bypassing existing controls.

The Impact

Users creating recorded skills introduce a risk of data exposure and privilege misuse if not properly governed.

• End users: Risk of inadvertently recording sensitive data or actions, leading to exposure.
• Security teams: Increased attack surface for data exfiltration and unauthorized access via automated skills.
• Compliance officers: New challenge in auditing and ensuring data handling policies are maintained within automated workflows.

The Action

1. Review and update existing data loss prevention (DLP) policies to include Copilot skill content and execution.
2. Implement Microsoft Purview Information Protection labels for sensitive content that might be processed by recorded skills.
3. Educate users on the risks of recording sensitive information or privileged actions within Copilot skills.
4. Monitor Microsoft 365 audit logs for unusual Copilot skill creation or execution patterns, especially those interacting with sensitive data.

Domain: Agentic-AI · Impact: high · Workload: M365 Apps · Essential Eight: Application Control, User Application Hardening · ISM: ISM-0843, ISM-1412, ISM-1485, ISM-1486, ISM-1490, ISM-1542, ISM-1544, ISM-1582, ISM-1585, ISM-1656, ISM-1657, ISM-1658, ISM-1659, ISM-1660, ISM-1667, ISM-1668, ISM-1669, ISM-1670, ISM-1823, ISM-1824, ISM-1859, ISM-1860, ISM-1870, ISM-1871