Key Insights
In June 2025, the National Institute of Standards and Technology (NIST) National Vulnerability Database logged CVE-2025-32711, an AI command-injection flaw in Microsoft 365 Copilot that let an unauthorized attacker disclose information over a network. Microsoft Copilot security covers how the assistant accesses company data and how organizations control that access and output. Many risks start with existing sharing settings, because Copilot works with permissions people already hold.
This guide follows organizational data from retrieval to the moment someone acts on an answer. It also examines access boundaries, labels, data loss controls, and hidden instructions. It then turns to the governance, deployment, and investigation decisions that remain with the organization.
How Copilot Accesses and Processes Organizational Data
Copilot answers a prompt by retrieving content the signed-in user can already open, sending that grounded prompt to a large language model inside Microsoft's service boundary, and returning the response. Grounding draws on the user's emails, files, chats, meetings, and calendars, and Copilot stores interactions in the user's chat history.
Retrieval runs through Microsoft Graph and a semantic index that honors each user's permissions, set through identity and access management, so the service boundary limits where processing happens, not what each user sees. Inside the boundary, Microsoft applies these controls:
Identity Controls: Microsoft enforces identity through Entra authorization, role-based access control, Conditional Access, and multi-factor authentication (MFA).
Tenant and Data Protection: Microsoft isolates tenants logically and applies data protection controls to information at rest and in transit.
Training Limits: Microsoft commits not to train foundation models on prompts, responses, or Graph-accessed data.
With web search on, Copilot sends Bing a query without user or tenant identifiers, and Microsoft handles it as an independent data controller. Copilot connectors move data in the opposite direction, bringing content from outside services into the Microsoft 365 service boundary.
Why Authorized Access Can Still Expose Sensitive Data
Authorized access exposes sensitive data when people share content more broadly than intended, because Copilot finds whatever a user's permissions allow and no control has to fail. An overshared file in an obscure folder becomes easy to find with a natural-language question. Four conditions create this exposure, each a configuration problem that predates Copilot:
Permissive Defaults: SharePoint sharing settings start at the most permissive option unless an administrator changes them.
Broad Links and Groups: "Anyone" and organization-wide links, along with the "Everyone except external users" group, make items effectively public internally.
Broken Inheritance: Broken permission inheritance can hide who can open a site.
Ownerless Content: Unlabeled, public, ownerless, or inactive sites are high-risk indicators because their access can go unreviewed.
Fixing these conditions through least privilege reduces exposure for every user and search, with or without Copilot.
What Labels and Data Controls Restrict
Labels and data controls each govern one part of what Copilot can reach, so a gap in one stays open even when the others are correct. Knowing where each control stops is what keeps a team from assuming one of them covers another:
Control | Boundary It Governs | Limit to Plan Around |
|---|---|---|
Permissions | Who can open an item, and what Copilot retrieves | Broad links and inherited access stay in scope until fixed |
Encryption usage rights | Whether Copilot can extract encrypted content for a given user | Users with EXTRACT rights can receive summaries |
Sensitivity labels | Classification and protection inherited by Copilot output | Copilot does not recognize labels on Teams meetings and chats |
Data loss prevention (DLP) | Whether Copilot processes sensitive prompts or labeled items | Checks typed prompt text, not uploaded files |
Discovery restrictions | Whether content appears in organization-wide search and Copilot | Temporary, and underlying permissions stay unchanged |
Permission cleanup comes first because every other control either depends on correct access or leaves it untouched. Labels then carry protection forward, since Copilot in Word, PowerPoint, and Outlook applies the highest-priority source label to new content, though users can override it.
DLP adds a processing check with its own gaps, since blocking a labeled file stops Copilot from summarizing it, but the item can still appear in citations. Microsoft's default Copilot DLP policy also starts in simulation mode, logging matches until someone switches it to enforce. Controls that block web grounding for sensitive prompts and external email processing are both in preview.
How Untrusted Content Redirects Copilot Answers and Agent Actions
Untrusted content redirects Copilot because the model reads retrieved emails and documents as context and cannot reliably separate hidden instructions from ordinary data. Connected actions then decide how far a redirected answer can reach.
Prompt Injection Through Retrieved Content
Prompt injection through retrieved content happens when Copilot follows hidden instructions in an email or file it pulls into context. EchoLeak shows the full indirect prompt injection chain. A published EchoLeak case study from researchers at George Washington University traces how an attacker sent one benign-looking email with hidden instructions.
When the victim later asked Copilot a routine question, the assistant retrieved the email, followed its hidden instructions, and placed internal data in an image link. The Copilot client fetched that link automatically through a Microsoft Teams preview API that Copilot's Content Security Policy permitted, so data left without a click. Microsoft deployed a server-side fix, Copilot could reach only data the victim could already access, and Microsoft reported no evidence of in-the-wild exploitation. EchoLeak therefore documents a technique rather than a live exposure.
The researchers recommend defenses at each stage of the chain, including input and output filtering, prompt partitioning, provenance-based access control, and strict content security policies. Those stages translate into controls a team can configure:
Context Limits: DLP rules that stop Copilot from processing external email and a preview capability limit what enters context.
Access Limits: Least privilege limits what an injected instruction can collect.
Model-Side Layers: Microsoft's Prompt Shields classifier screens for injected instructions, and Spotlighting marks external text so the model can tell it apart from user instructions.
Outbound Limits: Rule-based blocks on untrusted links and images narrow the exit.
No single control blocks every injection attempt, and they are meant to layer rather than substitute for one another.
Agent Actions Across Connected Services
Agents extend the injection problem from answers to actions, because a Copilot agent can draw on knowledge sources, connectors, external services, and actions that write or send data. Built-in agents are on by default, and access defaults to "All users," so an agent population exists before anyone reviews it. Deployed connectors are also tenant-wide unless an administrator restricts external item security.
An attacker who controls data returned by a custom action might craft a payload that steers an agent, so limiting agents to declarative ones that use trusted knowledge sources and REST APIs narrows that path. Controls include an agent inventory in the admin center, deployment scoped to specific users or groups, Copilot Studio data policies over connectors and HTTP requests, and human confirmation for consequential actions.
In a guide to adopting agentic AI, the Cybersecurity and Infrastructure Security Agency and international partners advise against broad or unrestricted agent access and suggest starting with low-risk, non-sensitive use cases. Abnormal's AI Agent Security, in private preview, is designed to discover agents, map their ownership, and track the privileges and data each one can reach.
Which Copilot Security and Compliance Decisions Remain with the Organization
The organization retains control over acceptable use, privacy impact, and proof of control. Microsoft's commitments cover how it processes and protects Copilot data.
Microsoft is the data processor under its Products and Services Data Protection Addendum (DPA) and supports the Health Insurance Portability and Accountability Act (HIPAA) only for properly configured implementations. Bing queries fall outside the DPA, the HIPAA business associate agreement, and the EU Data Boundary, so organizations handling regulated data must decide whether to allow web grounding.
The NIST AI Risk Management Framework offers a voluntary structure but no Copilot-specific mapping, so this editorial alignment assigns each function a task:
Govern: A written AI security policy names accountable owners for Copilot, agents, and high-risk sites, and sets acceptable use.
Map: A review checks each use case, such as HR summaries or customer correspondence, for the data it touches.
Measure: Testing confirms restricted content stays protected, and the team tracks DLP and audit findings.
Manage: Response plans cover exposure, injection attempts, and harmful outputs.
Worked through in order, these functions turn Microsoft's commitments into evidence the organization owns. Abnormal's AI Governance can help compliance teams map which AI tools, Copilot included, are in use and who owns them.
A Norwegian data protection review of Copilot advises that organizations will generally need a data protection impact assessment (DPIA) before using generative AI that processes personal data. Each organization runs its own DPIA, and that non-binding report judged HR use high risk.
How to Deploy Microsoft Copilot Securely
Deploying Copilot securely means fixing access first, then rolling it out to a small test group before adding more users and agents. Secure deployment runs in four stages: preparation, small-group testing, broader deployment, and ongoing operation.
Preparation Through Permission Cleanup and Guardrails
Preparation closes oversharing gaps and sets guardrails before anyone turns Copilot on. An AI council can review data protection and security requirements first, and the AI Administrator role lets a team manage Copilot without Global Administrator rights. Most preparation steps depend on the one before, so the order matters:
High-Risk Content Discovery: Microsoft Purview Data Security Posture Management (DSPM) oversharing assessments and data access governance reports flag broadly shared sites.
Durable Access Remediation: Site access reviews let owners remove broad groups, and access restrictions limit a site to one security group.
Interim Discovery Limits: Restricted SharePoint Search is off by default and does not hide content users own or previously accessed.
Identity and Device Requirements: MFA for all users and Conditional Access policies on location and device compliance protect the accounts Copilot acts for.
Labels and DLP: Default sensitivity labels and DLP policies give Copilot something to enforce, with the default DLP policy moved out of simulation.
Most of these preparation steps are recommendations rather than automatic protections, and the defaults lean open. Web search is available unless an administrator turns off optional connected experiences. A tenant that skips preparation starts testing with the broadest settings.
Small-Group Testing Before Wider Access
The test group shows whether boundaries hold under real questions. These checks are editorial recommendations rather than a Microsoft certification list, and each produces evidence for the decision to widen access:
Restriction Testing: Test users in HR, finance, and legal ask about topics the organization knows are sensitive, such as compensation or pending deals, and the team confirms nothing inappropriate surfaces.
Connected-Service Review: The team lists the agents, connectors, and web search settings the test group has and confirms someone deliberately approved each one.
Assessment Refresh: The team revisits DSPM recommendations and the DPIA whenever users or agents join, so each expansion starts from current evidence.
User Guidance: Users learn to keep unnecessary sensitive details out of prompts, especially where web search is on, and to verify outputs that drive financial, legal, or personnel decisions.
Widening access only after a test round surfaces no inappropriate content is a reasonable threshold. Broader deployment repeats these checks at scale, and in ongoing operation they become periodic reviews tied to monitoring. Each new department then enters with the same evidence the test group produced.
How to Monitor and Investigate Copilot Activity
Monitoring Copilot means recording each interaction so investigators can trace the user, the content touched, and any risk signal, though no single log holds everything. With auditing on, Purview generates a CopilotInteraction record with the user, time, location, and AccessedResources, and a JailbreakDetected flag marks jailbreak attempts.
Teams should confirm in their tenant whether the audit log captures prompt and response text. This editorial sequence, not a Microsoft procedure, ties all evidence to one interaction:
Interaction Record Location: Investigators find the CopilotInteraction entry for the user and time window.
Referenced Resource Review:AccessedResources shows labels, policy actions, and injection flags.
Prompt and Response Retrieval: Content Search, Data Security Investigations, or the DSPM for AI activity explorer can show prompt text and referenced files.
Mailbox Evidence Preservation: eDiscovery holds cover the user's mailbox, where Copilot stores interactions.
User-Risk Alert Correlation: Insider Risk Management alerts for the same user, such as attempted prompt injection, add context.
Integrity review covers cases in which access works correctly, but the answer is wrong. An answer can cite a real file and still misstate what it says. Reviewers therefore compare each answer with its cited files and record the prompt, output, and resulting decision.
Expand Copilot Access Only as Boundaries Hold
Copilot security depends on access matched to business need, approved limits for agents and web queries, and a reviewable trail for consequential answers. The evidence each stage produces, rather than a rollout schedule, should decide when the next department or agent gets access.
Abnormal's AI Security suite integrates with Microsoft Copilot. Its AI Governance, generally available, can help teams discover AI tools and map ownership, and AI Agent Security is in private preview. Explore the AI Security platform to see how Abnormal maps Copilot alongside other AI tools.
Frequently Asked Questions
Can Copilot reference encrypted content without summarizing it?
Yes, for label-applied encryption, Copilot returns content only when the user holds both the VIEW and EXTRACT usage rights. A user with VIEW but not EXTRACT can receive a link to the item, but Copilot will not summarize it. Copilot does not return items protected with Double Key Encryption or S/MIME-protected emails.
Do SharePoint site labels cover every file Copilot can reach?
No, items inside a container, such as a SharePoint site or Microsoft 365 group, do not inherit its sensitivity label. Copilot handles each file based on its own label and encryption, so a confidential site can contain unlabeled files that Copilot treats like any other accessible content.
Which retention policy applies to Copilot when several overlap?
The longest duration wins, whether it comes from a Purview retention policy or a hold. These policies can retain or delete Copilot prompts and responses, but teams should not assume a default. Users receive no notification when a policy deletes their Copilot messages.