Microsoft Copilot (Microsoft M365): Copilot Chat can now better match search results from text that appears inside images embedded in Word, Excel, and PowerPoint file

🚨 The Signal: Copilot Chat can now extract and search text within images embedded in Microsoft 365 files. This expands the data Copilot can access, increasing the risk of sensitive information exposure if not properly governed.

The Impact

All users are affected, increasing the risk of sensitive data exposure via Copilot if image content is not properly classified and protected.

  • End users: Increased risk of inadvertently exposing sensitive data in images through Copilot queries.
  • Security teams: New vector for data exfiltration and compliance breaches via image content.
  • Data owners: Expanded scope of data requiring classification and protection within M365 files.
  • Compliance officers: Greater challenge in demonstrating adherence to data handling policies.

The Action

  1. Review and enforce Microsoft Purview Data Loss Prevention (DLP) policies to include image content analysis for sensitive information types.
  2. Educate users on responsible Copilot usage, emphasizing that image content is now searchable and subject to existing data governance policies.
  3. Implement or refine Microsoft Purview Information Protection (MIP) sensitivity labels to classify documents containing sensitive image data.
  4. Monitor Copilot usage logs for unusual data access patterns, particularly concerning documents with embedded images.
  5. Assess existing data retention and deletion policies to ensure they adequately cover text within images.

Domain: Agentic-AI · Impact: high · Workload: Microsoft Purview