PowerPoint: Skills in Brand Kit

🚨 The Signal: PowerPoint Copilot now supports custom 'skills' uploaded via Brand Kit. This allows organisations to extend Copilot's capabilities with internal knowledge, but introduces new vectors for data exfiltration or malicious code execution if not properly governed.

The Impact

Security teams and content owners are affected by the risk of data exposure and malicious skill injection through custom Copilot skills.

• Security Teams: Risk of data exfiltration via custom skills.
• Content Owners: Need to vet and approve all uploaded skill files.
• Compliance Teams: New data handling processes require policy updates.
• End Users: Potential for exposure to untrusted or malicious Copilot responses.

The Action

1. Define and implement a policy for custom Copilot skill creation and approval.
2. Establish a review process for all .md files uploaded to Brand Kit for Copilot skills.
3. Educate users on the risks associated with custom Copilot skills and responsible usage.
4. Monitor Copilot usage logs for unusual activity related to custom skills.
5. Review Microsoft Purview Data Loss Prevention (DLP) policies to ensure coverage for custom skill content.

Domain: Agentic-AI · Impact: high · Workload: M365 Apps