Microsoft Copilot (Microsoft 365): Session and Response Sharing in M365 Copilot

🚨 The Signal: Microsoft 365 Copilot now allows users to share full chat sessions or individual responses via a link. This feature simplifies content sharing but introduces new vectors for sensitive information exposure if not properly governed.

The Impact

All users are affected, with a high risk of unintended sensitive data exposure if sharing policies are not enforced.

• End users: Risk of inadvertently sharing sensitive company information.
• Security teams: Increased surface area for data exfiltration and compliance breaches.
• Compliance officers: New challenge in enforcing data governance and retention policies.

The Action

1. Review and update Microsoft Purview Data Loss Prevention (DLP) policies to include Copilot content.
2. Educate users on responsible sharing practices for Copilot outputs, especially regarding sensitive data.
3. Monitor Copilot sharing activities through Microsoft Purview Audit logs for policy violations.
4. Evaluate existing information protection labels for applicability to Copilot shared content.

Domain: Agentic-AI · Impact: high · Workload: Microsoft Purview