Data protection and governance tasks for Microsoft 365 and Copilot
Copilot inherits, it does not grant
Microsoft 365 Copilot only surfaces content the signed-in user already has permission to see. It respects SharePoint and OneDrive sharing, sensitivity labels, and conditional access. The governance risk is therefore oversharing: broad "Everyone except external users" site permissions can feed Copilot content nobody intended to expose. Administrators address this with SharePoint permission reviews, SharePoint Advanced Management tools such as restricted content discovery, and Restricted SharePoint Search to limit which sites Copilot and search can use.
The controls a candidate must name
- Sensitivity labels (Purview): classify and, with encryption, restrict content. Encrypted items that Copilot cannot process may be dropped from responses.
- Retention labels and policies: keep, retain, or delete content for a defined period; retention differs from deletion.
- Data loss prevention (DLP): blocks or audits sensitive information in locations including Exchange, SharePoint, and Copilot interactions when the relevant policy is configured.
- Audit log and eDiscovery: Copilot prompts and responses are captured in the user's mailbox and are discoverable.
- DSPM for AI: discovers AI usage and risky interactions across the tenant.
Traps to expect
Questions often imply Copilot "breaks permissions" or "reveals hidden files" - false. Others confuse retention with backup, or assume labels apply automatically without a publishing policy. Watch for items that assume Copilot honors file-level sharing while ignoring site-level permissions; it honors both.
Rule of thumb
If the user can already open it, Copilot can reason over it; if a label blocks processing, Copilot cannot. Worked example: a finance team says Copilot summarizes a confidential merger site. Verify site membership first - if 200 people are members through a broad group, remediation is permission cleanup or restricted content discovery, not a Copilot setting.