Outlook: Draft, edit and format emails conversationally with Copilot in Outlook

🚨 The Signal: Copilot in Outlook now drafts, refines, and formats emails using agentic AI. This changes how sensitive information is processed and generated, increasing the risk of data leakage and prompt injection vulnerabilities.

The Impact

All users are affected, with a heightened risk of sensitive data exposure through AI-generated content and prompt injection.

• End Users: Risk of inadvertently exposing sensitive data via AI-generated emails.
• Security Teams: Increased surface area for prompt injection attacks and data exfiltration.
• Compliance Teams: New challenges in monitoring and auditing AI-generated communications.
• Administrators: Need to review and enforce Copilot data governance policies.

The Action

1. Review and configure Microsoft 365 Copilot data governance policies in the Microsoft 365 admin center.
2. Implement and enforce sensitivity labels for emails to restrict Copilot's access to highly sensitive data.
3. Educate users on responsible AI usage, data handling, and prompt engineering best practices.
4. Monitor Copilot usage logs for unusual activity or potential data leakage incidents.
5. Assess and update existing data loss prevention (DLP) policies to include Copilot-generated content.

Domain: Agentic-AI · Impact: high · Workload: M365 Apps