Dynamics 365 Sales: Sales tools, skills and plugin are now available in Copilot Cowork

🚨 The Signal: Copilot Cowork now integrates Dynamics 365 Sales data and actions via a new plugin. This expands AI agent capabilities to directly access and manipulate sensitive sales information, increasing data exposure risk.

The Impact

Sales teams using Copilot Cowork are affected, with increased risk of sensitive sales data exposure and potential for unauthorised actions via AI agents.

• Sales users: Risk of inadvertent data exposure through Copilot interactions.
• Security teams: New attack surface for data exfiltration and unauthorised actions via AI agents.
• Compliance officers: Requires re-assessment of data governance and privacy policies for AI agent interactions.
• Administrators: Need to manage and secure new plugin deployments and permissions for AI agents.

The Action

1. Review and update data loss prevention (DLP) policies to include Copilot Cowork and Dynamics 365 Sales data.
2. Implement granular access controls for the Sales plugin within Copilot Cowork, following least privilege principles.
3. Educate sales users on responsible AI usage, data handling, and potential risks when interacting with Copilot Cowork.
4. Monitor Copilot Cowork audit logs for unusual activity related to Dynamics 365 Sales data access and actions.
5. Assess the security posture of the Dynamics 365 MCP server and its integration with Copilot Cowork.

Domain: Agentic-AI · Impact: high · Workload: Other