Microsoft 365 app: Use Copilot in PDFs within the Microsoft 365 Copilot mobile app

🚨 The Signal: Copilot in Microsoft 365 mobile app now summarises PDFs. This expands AI access to sensitive document content on mobile devices, increasing data exposure risk if not properly governed.

The Impact

All users are affected, increasing the risk of sensitive information exposure through AI processing on mobile devices.

• End users: Risk of inadvertent data exposure when using Copilot with sensitive PDFs.
• Security teams: Increased surface area for data loss prevention (DLP) monitoring and policy enforcement.
• Compliance officers: New considerations for data handling and retention policies with AI-generated content.
• IT administrators: Need to review mobile device access to sensitive PDF content and Copilot usage.

The Action

1. Review and update Microsoft Purview Data Loss Prevention (DLP) policies to include mobile app access and Copilot interactions with sensitive PDF content.
2. Implement or refine Microsoft Intune App Protection Policies (APP) for the Microsoft 365 mobile app to restrict data movement and sharing.
3. Educate users on responsible AI usage, data classification, and the risks of processing sensitive information with Copilot on mobile devices.
4. Monitor Microsoft Purview Audit logs for Copilot interactions with sensitive documents on mobile devices.
5. Assess existing data classification labels and ensure they are effectively applied to PDF documents.

Domain: Agentic-AI · Impact: high · Workload: M365 Apps