Planner: Save AI-generated filters in Planner Agent chat

🚨 The Signal: Planner Copilot can now save AI-generated filters for plans. This introduces persistent AI-driven content, potentially exposing sensitive data through saved queries if not properly governed, increasing the risk of information over-retention or unauthorised access.

The Impact

All users interacting with Planner Copilot are affected, increasing the risk of sensitive data exposure through persistently saved AI-generated filters.

• End users: Risk of inadvertently saving filters that expose sensitive plan data.
• Security teams: Increased surface area for data exfiltration via AI-generated content.
• Data owners: Challenges in ensuring appropriate data retention and access controls for saved filters.
• Compliance officers: Difficulty in demonstrating adherence to data lifecycle policies for AI-generated artifacts.

The Action

1. Review and update data retention policies to explicitly address AI-generated content and saved queries within Microsoft 365 applications.
2. Implement or reinforce Microsoft Purview Data Loss Prevention (DLP) policies to detect and prevent sharing of sensitive information within Planner, including AI-generated filters.
3. Educate end-users on responsible use of AI features, emphasising the potential for sensitive data exposure when saving AI-generated content.
4. Monitor Microsoft 365 audit logs for unusual activity related to Planner and Copilot interactions, specifically around saved queries and data access.
5. Assess existing access controls for Planner plans to ensure least privilege is applied, mitigating the risk of unauthorised access to saved AI filters.

Domain: Agentic-AI · Impact: high · Workload: Other