Work IQ: Retrieve

🚨 The Signal: Copilot agents can now retrieve content from Microsoft 365. This expands agent capabilities, increasing the risk of data exfiltration or inappropriate access if not properly governed.

The Impact

Security teams and data owners are affected by increased data exposure risk from autonomous agents.

• Security teams face new risks from agent identities accessing sensitive data.
• Data owners must understand how agents retrieve and use their information.
• Compliance officers need to assess agent data access against regulatory requirements.
• Admins must configure agent permissions to prevent unintended data exposure.

The Action

1. Review and define data access policies for Copilot agent identities in Microsoft Entra.
2. Implement Microsoft Purview Data Loss Prevention (DLP) policies to monitor agent data interactions.
3. Utilise Microsoft Purview Audit to track agent content retrieval activities.
4. Educate users on responsible use of Copilot agents and data handling.
5. Regularly audit agent permissions and access logs for anomalous behaviour.

Domain: Agentic-AI · Impact: high · Workload: Other