Outlook: Copilot Chat available in shared and delegate mailboxes

🚨 The Signal: Copilot Chat is now available in shared and delegate mailboxes in classic Outlook. This expands AI access to sensitive shared data, increasing the risk of data leakage and over-retention if not properly governed.

The Impact

Users with shared mailbox access are affected, increasing the risk of sensitive data exposure via AI.

  • Shared mailbox users: Increased risk of accidental data exposure through Copilot Chat.
  • Delegates: Potential for over-privileged AI access to sensitive information.
  • Security Teams: New vector for data exfiltration and compliance challenges.
  • Data Owners: Reduced visibility and control over how shared data is processed by AI.

The Action

  1. Review existing shared mailbox permissions for least privilege access.
  2. Implement or update data loss prevention (DLP) policies for Copilot interactions.
  3. Educate users on responsible AI usage, especially with shared sensitive data.
  4. Monitor Copilot activity logs for unusual data access patterns in shared mailboxes.
  5. Assess and update information governance policies for AI-processed shared data.

Domain: Agentic-AI · Impact: high · Workload: M365 Apps