Microsoft Copilot (Microsoft 365): Complex web search with Copilot in Excel

🚨 The Signal: Copilot in Excel now uses a multi-agent system for complex web searches, improving accuracy and completeness. This enhances data analysis capabilities but increases the potential for sensitive data exposure via web queries.

The Impact

All users with Copilot in Excel are affected, increasing the risk of inadvertent sensitive data exposure through enhanced web search capabilities.

• End users: Risk of exposing internal data via web searches.
• Security teams: Increased complexity in monitoring data exfiltration.
• Compliance officers: New challenges in data residency and sovereignty.
• Data owners: Potential for unauthorized disclosure of sensitive information.

The Action

1. Review and update Microsoft Purview Data Loss Prevention (DLP) policies to monitor Copilot interactions and web content access.
2. Implement or refine Microsoft Defender for Cloud Apps (MDA) policies to detect and alert on unusual data transfers or sensitive information shared via Copilot's web search.
3. Educate users on responsible AI use, data handling, and the risks of querying sensitive internal data with Copilot's web search features.
4. Assess existing Copilot governance policies for data interaction and external service access, ensuring alignment with organizational data classification.
5. Configure Copilot data residency settings to align with Australian data sovereignty requirements where applicable.

Domain: Agentic-AI · Impact: high · Workload: M365 Apps