Microsoft Copilot (Microsoft 365): Lists in Context IQ

🚨 The Signal: Copilot Chat can now access SharePoint Lists via Context IQ to ground prompts. This expands Copilot's data access, increasing the risk of sensitive list data exposure if not properly governed.

The Impact

All Copilot users are affected, increasing the risk of inadvertent exposure of sensitive SharePoint List data.

  • End Users: Risk of oversharing sensitive list data through Copilot prompts.
  • Security Team: Increased surface area for data leakage from SharePoint Lists.
  • Data Owners: Need to re-evaluate sensitivity labels and access for SharePoint Lists.
  • Compliance Officers: New considerations for data handling and regulatory compliance.

The Action

  1. Review and enforce SharePoint List permissions and access controls.
  2. Implement or refine Microsoft Purview sensitivity labels for SharePoint Lists containing sensitive data.
  3. Educate users on responsible data handling and prompt engineering when using Copilot with sensitive information.
  4. Monitor Copilot usage logs for unusual data access patterns related to SharePoint Lists.
  5. Review existing Data Loss Prevention (DLP) policies to ensure coverage for Copilot interactions with SharePoint List data.

Domain: Agentic-AI · Impact: high · Workload: SharePoint