SharePoint: Create new workflows with Copilot in SharePoint

🚨 The Signal: Copilot in SharePoint now allows users to create automated workflows using natural language. This introduces new avenues for data exfiltration and unauthorized process automation if not properly governed.

The Impact

All users are affected, increasing the risk of unauthorized data movement and process manipulation via AI-generated workflows.

  • End users: Risk of inadvertently creating insecure workflows.
  • Security teams: Increased attack surface for data exfiltration.
  • Admins: New governance challenges for AI-driven automation.
  • Compliance teams: Difficulty in auditing AI-generated processes.

The Action

  1. Review and update existing SharePoint workflow governance policies to include AI-generated workflows.
  2. Implement data loss prevention (DLP) policies to monitor and restrict sensitive data movement via SharePoint workflows.
  3. Educate users on secure workflow creation practices and the risks of sharing sensitive information.
  4. Monitor SharePoint audit logs for unusual workflow activity or data exfiltration attempts.
  5. Consider restricting Copilot access for workflow creation to specific user groups if risk is deemed too high.

Domain: Agentic-AI · Impact: high · Workload: SharePoint