SharePoint: AI input widget and content preview in Copilot

🚨 The Signal: SharePoint Copilot now shows content previews and allows form interaction. This increases the risk of inadvertent data exposure or oversharing through AI-generated summaries and responses.

The Impact

SharePoint users are affected, increasing the risk of sensitive data exposure via Copilot's content preview and interaction features.

• End users: Risk of inadvertently sharing sensitive information through Copilot interactions.
• Security Team: Increased surface area for data loss prevention monitoring and policy enforcement.
• Data Owners: Potential for sensitive data to be exposed in Copilot summaries or forms.
• Compliance Officers: New considerations for data handling and retention policies with AI-generated content.

The Action

1. Review and refine Microsoft Purview Data Loss Prevention (DLP) policies for SharePoint content.
2. Implement or strengthen sensitivity labels for documents stored in SharePoint.
3. Educate users on responsible use of Copilot, emphasizing data sensitivity and verification of AI outputs.
4. Monitor Microsoft Purview Audit logs for unusual Copilot activity or data sharing events.
5. Assess existing SharePoint site permissions and access controls to ensure least privilege.

Domain: Agentic-AI · Impact: high · Workload: SharePoint