Microsoft 365 Copilot Security for Business: Data Security Controls, Risks and Oversharing
Microsoft publishes strong data commitments for Copilot and, in the same documentation, states the limits of each one. The gap between those two halves is where almost every real Microsoft 365 Copilot security problem lives.
Direct answer
Microsoft 365 Copilot security rests on your existing Microsoft 365 permission model, not on a new control layer. Microsoft states it plainly: Copilot "only surfaces organizational data to which individual users have at least view permissions". That means Copilot does not create an oversharing problem, it makes an existing one searchable in plain English. Microsoft also confirms that prompts, responses and Graph data are "not used to train foundation LLMs, including those used by Microsoft Copilot". The genuine limit is on the safety side: Microsoft says its jailbreak and cross-prompt injection classifiers "may not be available in all Microsoft Copilot scenarios", and EchoLeak (CVE-2025-32711) showed a zero-click path that exfiltrated tenant data through the assistant with no user interaction at all.
Try it live
Watch Agentshield block an attack in real time.
Pick a scenario and drive the inspection lane yourself. No signup needed.
Run a request
Inspection lane
INSPECTINGPolicy trace
High-risk action held for approval
Audit trail
- § · → → →
The risk
The assessment usually happens once, at license purchase, against a product that summarizes your mail. What ships afterwards is different. Copilot Chat picks up web access, Graph connectors pull in third-party repositories, somebody publishes an agent into the tenant, and the same license now spans systems the original review never named. Meanwhile the permission debt underneath has not moved. Every SharePoint site left at "everyone except external users", every file shared with an "anyone" link during a 2019 project, every Teams channel nobody archived, all of it was technically discoverable before and practically invisible. Copilot removes the practical obscurity. The first time a payroll spreadsheet surfaces in an answer, nothing has been breached in the traditional sense. The permissions were always wrong.
How Agentshield handles it
Sequence it by what actually reduces exposure per hour spent. Start with discovery, because you cannot fix what you cannot see: Purview Data Security Posture Management runs oversharing assessments that show which sites and files Copilot can reach. Second, contain the blast radius while you remediate. Restricted SharePoint Search limits organization-wide Copilot answers to an allowlist of sites, and Microsoft is direct that it is a stopgap, "a temporary solution to review and apply proper permission settings to your sites". Third, label and enforce: sensitivity labels with Purview DLP stop Copilot summarizing content you have classified, and Information Rights Management encryption can exclude programmatic access so an agent cannot read the file even when the user can. Fourth, and this is the part no Microsoft setting covers, govern the agents you attach to the tenant, because Microsoft tells you to check each one yourself.
The controls
The controls that secure Microsoft 365 Copilot and Copilot Chat, the Graph connectors and third-party agents plugged into them, and the SharePoint, OneDrive, Teams and Exchange content those agents can reach on behalf of every licensed user.
What each Microsoft 365 Copilot security control covers, and where Microsoft says it stops
Read this table before any vendor blog on the subject. Most Microsoft 365 Copilot security coverage lists the controls and skips the caveats, and Microsoft publishes the caveats itself. Everything in the third column is Microsoft documentation, quoted, not our characterization.
| Control | What it covers | What Microsoft states it does not cover |
|---|---|---|
| Permission inheritance | Copilot honors existing Microsoft 365 access control. Semantic Index respects the user identity access boundary, so grounding only reads content the current user may read | Verbatim: "It's important that you're using the permission models available in Microsoft 365 services, such as SharePoint, to help ensure the right users or groups have the right access to the right content." The control is your permission hygiene, and Microsoft says so |
| Training and retention | Verbatim: "Prompts, responses, and data accessed through Microsoft Graph aren't used to train foundation LLMs, including those used by Microsoft Copilot." Copilot services have opted out of Azure OpenAI abuse monitoring and its human review | Governs training and retention only. It says nothing about what Copilot can surface to a user at runtime, which is where every published incident has happened |
| Prompt injection classifiers | Proprietary jailbreak and cross-prompt injection attack (XPIA) classifiers analyze inputs and block high-risk prompts before model execution | Verbatim, and this is the most important sentence on the page: "These classifiers may not be available in all Microsoft Copilot scenarios." The protected-material detection carries the same caveat |
| Purview DLP and sensitivity labels | DLP policies stop Copilot and agents summarizing content carrying labels you select. Copilot honors IRM usage rights, and encryption can exclude programmatic access entirely | Only covers content that is already labeled correctly. Unlabeled data, which in most tenants is the majority of data, is unaffected by a label-scoped policy |
| Agent extensibility controls | Admins see the permissions and data access an agent requires in the Integrated apps section of the admin center, and choose which agents are allowed in the tenant | Verbatim: "check the privacy statement and terms of use of the agent to determine how it will handle your organization's data". Microsoft surfaces the request and hands the diligence back to you |
Read the third column as a group and a shape emerges. Microsoft's commitments about its own handling of your data are strong, specific and contractual. The commitments about what happens at the boundary, where untrusted text arrives and where third-party agents act, are deliberately qualified. That is an honest split rather than a hidden one, and it should determine what you buy. If your concern is Microsoft training on your mail, the documentation already answers you and no additional product is required. If your concern is an agent doing something with the access it holds, no Microsoft 365 setting resolves it, because the classifiers Microsoft offers carry an explicit availability caveat.
One naming change matters for anyone reading older documentation. Microsoft notes that "Microsoft 365 Copilot is now named Microsoft Copilot, and Microsoft 365 Copilot Chat is now named Microsoft Copilot Chat", and that some licenses and capabilities still use the old names during the transition. Microsoft adds that there are "no changes to security, compliance, and privacy for organizations" as a result. The rename is cosmetic for your controls and genuinely confusing for procurement, because it collides with a different product covered further down this page.
If Copilot in your tenant now opens tickets, writes to line-of-business systems or calls external services through an agent, the relevant questions have moved from what it can read to what it is permitted to do. That is the same boundary that governs agents built in Copilot Studio and GitHub Copilot agent mode, and it is worth treating as one program rather than three.
EchoLeak (CVE-2025-32711): the first zero-click attack on an AI agent
EchoLeak is the reference incident for Microsoft 365 Copilot security, and it is widely misquoted. Here is the record, with the scoring disagreement that most write-ups leave out.
| Field | Value |
|---|---|
| Identifier | CVE-2025-32711, named EchoLeak by the researchers who found it |
| NVD description | Verbatim: "Ai command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network." |
| Score | Microsoft as CNA scored it 9.3 critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N). NVD scored the same issue 7.5 high (S:U instead of S:C). CWE-74 |
| Found by | Aim Labs, the research arm of Aim Security, reported to the Microsoft Security Response Center. Aim Security was acquired by Cato Networks in September 2025 |
| Published | June 11, 2025. Fixed server-side by Microsoft, with no customer action required and no reported exploitation in the wild |
The scoring gap is worth understanding rather than picking a side on. Microsoft applied Scope:Changed, arguing the vulnerable component and the impacted component differ, since injected content in one trust boundary causes data disclosure across another. NVD applied Scope:Unchanged and landed at 7.5. If your risk register pulls automatically from NVD, EchoLeak entered it as a high, while every headline called it critical. Both numbers are defensible. Neither changes what happened.
The mechanism is what makes it a landmark. The researchers describe an "LLM Scope Violation": untrusted external input causes the model to reach into privileged context it should not mix with, then emit it. Delivery was an ordinary email containing hidden instructions. The victim never had to open it, click anything or use Copilot on it deliberately. When the user later asked Copilot an unrelated business question, Copilot retrieved the attacker's email as grounding material, followed the embedded instructions, and pulled data from the user's accessible scope, which can include chat history, OneDrive files, SharePoint content and Teams messages. That is a zero-click chain against an AI assistant, and it is the first of its kind to receive a CVE.
Three lessons generalize past this one patch. First, the retrieval boundary is an attack surface: anything your assistant can be made to read is effectively an input channel, and email is an input channel anyone on earth can write to. Second, Microsoft's XPIA classifiers exist precisely to catch this, which is the practical meaning of the caveat that they "may not be available in all Microsoft Copilot scenarios". Third, and most useful for planning, the fix was server-side and invisible, so no amount of endpoint hardening on your side would have mattered. When the control lives in the vendor's pipeline, your only lever is the record of what the assistant actually did, which is why AI agent hardening for tenant-hosted assistants leans so heavily on output monitoring rather than input filtering.
It is also worth being precise about scope creep in the coverage. EchoLeak did not breach Microsoft, did not cross tenants, and did not expose data the signed-in user could not already access. It exfiltrated that user's own scope to an outsider. That is serious and it is narrower than "Copilot leaked the company's data", which is how it was frequently reported.
Why Microsoft 365 Copilot turns oversharing into your biggest security risk
Ask any team six months into a Copilot rollout what actually went wrong and you will not hear about prompt injection. You will hear that somebody asked a normal question and got an answer containing salary bands, an unannounced reorganization or a draft acquisition memo.
Nothing failed. Microsoft is unambiguous that Copilot "only surfaces organizational data to which individual users have at least view permissions". The content was already readable by that account. What changed is the cost of finding it. Before Copilot, locating a stray compensation file meant knowing it existed, knowing roughly where it lived, and searching for it on purpose. After Copilot, it means asking a question in English and having the answer assembled for you, with a citation. Semantic search over a permissive tenant does not leak data so much as it audits your access control in public, one prompt at a time.
The remediation sequence that works, in the order that buys the most safety per hour:
| Step | Control | What it buys you | Honest limitation |
|---|---|---|---|
| 1 | Purview DSPM oversharing assessments | Shows which sites, files and links Copilot can actually reach, so remediation is targeted rather than guessed | Reporting only. It changes nothing on its own, and the queue it produces is usually much longer than expected |
| 2 | Restricted SharePoint Search | Limits organization-wide Copilot answers to an allowlist of reviewed sites. Off by default with an empty allowed list | Microsoft calls it "a temporary solution". It suppresses symptoms while permissions stay wrong, and it degrades Copilot's usefulness in the meantime |
| 3 | Sensitivity labels plus Purview DLP | Stops Copilot and agents summarizing labeled content. IRM encryption can exclude programmatic access, so agents cannot read it even when the user can | Works only on correctly labeled data. In most tenants the majority of files carry no label, and auto-labeling accuracy is the real project |
| 4 | Permission remediation and link expiry | The only step that fixes the underlying problem: removes broad grants, expires "anyone" links, archives dead sites | Slow, political, and owned by people who do not report to security. Budget quarters, not sprints |
| 5 | Agent authorization at the action | Governs what tenant-connected agents may do, not just what they may read, with an audit record per call | Not a Microsoft 365 setting. Only relevant once agents act on systems, and pointless if your agents only summarize documents |
Step 4 is the one that gets skipped, and skipping it is why so many rollouts stall at step 2 indefinitely. Restricted SharePoint Search is genuinely useful as a circuit breaker on launch week. Left switched on for a year, it means you are paying full price for an assistant that has been told not to look at most of your company, and the permission debt it was meant to buy time against has not been touched.
Where this connects to the rest of your program: the same access questions apply to every non-human identity in the tenant, which is why access control for AI agents and AI agent identity end up on the same roadmap. If Copilot is your first significant agent deployment, treat it as the pilot for that policy rather than a one-off.
Microsoft 365 Copilot vs Microsoft Security Copilot: two different products
These are separate products with separate licensing, separate buyers and opposite purposes, and the naming makes that almost impossible to guess. It is one of the most common procurement mix-ups we see, and the recent rename of Microsoft 365 Copilot to Microsoft Copilot has made it worse.
| Microsoft 365 Copilot (now Microsoft Copilot) | Microsoft Security Copilot | |
|---|---|---|
| Purpose | Productivity. Drafts, summarizes and answers questions over your Microsoft Graph content | Security operations. Assists analysts with incident investigation, hunting and response |
| Who uses it | Every information worker you license | Your SOC, incident responders and security admins |
| Pricing model | Per user per month, on top of a required base license. List price 30 USD per user per month on an annual commitment, verified August 2026 | Capacity based, billed by Security Compute Unit. Microsoft's billing example uses 4 USD per provisioned SCU and 6 USD per overage SCU, with a minimum of one provisioned SCU billed hourly |
| Included with E5? | No. Copilot is always an add-on purchase | Partly. Verbatim: "Eligible Microsoft 365 E5 and E7 customers will have 400 Security Compute Units (SCUs) per month for every 1000 user licenses, up to 10,000 SCUs per month" |
| Relationship to this page | It is the thing being secured. It reads your business data on behalf of users | It is a tool for your security team. It does not protect Microsoft 365 Copilot |
The single sentence worth carrying out of this section: buying Microsoft Security Copilot does nothing to secure Microsoft 365 Copilot. They point in opposite directions. One is AI applied to your security work; the other is AI applied to your business data, which then needs securing. Teams occasionally approve SCU spend believing it covers the Copilot rollout risk, and it does not touch it.
Microsoft attaches its own caveat to the SCU figures, which we repeat rather than smooth over: "Prices are estimates only and are not intended as actual price quotes. Actual pricing may vary depending on the type of agreement entered with Microsoft, date of purchase, the currency exchange rate and taxes." Treat every number in that row as a planning figure and confirm it on your own paper. The same applies to the 30 USD Copilot list price, which sits on top of a base suite whose price changed in mid-2026, so the all-in per-seat cost is materially higher than the add-on line suggests.
This is a different confusion from the one that affects the developer tools. Microsoft Security Copilot, GitHub Copilot and Copilot Studio are three more distinct products sharing the name. We keep GitHub Copilot security and Copilot Studio security on separate pages for exactly that reason, and the AI security vendor comparison hub carries a name-collision table for the wider market.
Where AgentShield helps with Microsoft 365 Copilot, and where it does not
We would rather lose a deal than sell against a problem we do not solve. Microsoft 365 Copilot is a Microsoft-hosted assistant, and a large share of its security surface is only reachable with Microsoft's own tooling. Here is the honest split.
| Concern | Can AgentShield help? | What to use |
|---|---|---|
| Oversharing in SharePoint and OneDrive | No | Purview DSPM oversharing assessments, Restricted SharePoint Search and permission remediation. This is Microsoft-native work and we do not duplicate it |
| Stopping Copilot summarizing labeled content | No | Purview sensitivity labels with DLP for the Copilot location. It is built in, it works, and it is included in the licensing you already hold |
| Prompt injection inside Microsoft's own pipeline | No | Microsoft's XPIA classifiers, server-side. We sit outside that pipeline and cannot inspect grounding calls Microsoft makes internally |
| Auditing what tenant-connected agents did, in one record | Yes | A gateway audit trail across Copilot agents and your non-Microsoft agents, so evidence is not split across Purview and three other consoles |
| Authorizing actions by agents you build or connect | Yes | Policy at the action for custom agents, Graph connectors and MCP-connected tools, where Microsoft hands diligence back to you |
The first three rows are the reason many readers should close this page and open the Purview admin center instead. If your Copilot deployment is information workers asking questions about documents, your security work is permissions and labels, both of which Microsoft already sells you. Adding a runtime gateway to that picture would be spend without a matching risk.
The last two rows are where an external control earns its place. The moment Copilot stops answering questions and starts taking actions, through a custom agent, a Graph connector to a third-party system, or an MCP server wired into the tenant, you are running an autonomous agent against production systems. Microsoft's own guidance at that boundary is to check each agent's terms yourself. That is a reasonable position for a platform vendor and a poor control for a regulated business, and it is the gap enterprise agent governance is meant to close.
If you are evaluating the category more broadly, the AI security vendor landscape covers who does what, including several vendors whose Microsoft 365 coverage is stronger than ours.
FAQ
Common questions about microsoft 365 copilot security.
Is Microsoft 365 Copilot secure?
For most enterprises, yes, with one dependency. Microsoft commits contractually that prompts and Graph data are not used to train foundation models, and Copilot honors existing permissions. The dependency is that those permissions are correct. Copilot is as secure as your SharePoint and OneDrive access control, which in most tenants has never been audited.
What are the security risks of Microsoft 365 Copilot?
Three recur in real assessments. Oversharing, where Copilot surfaces content users could technically always reach but never found. Indirect prompt injection, demonstrated by EchoLeak, where untrusted content steers the assistant. And third-party agents attached to the tenant, where Microsoft explicitly asks you to review the terms and data handling of each agent yourself.
Does Microsoft 365 Copilot use my company data to train its models?
No. Microsoft states that prompts, responses and data accessed through Microsoft Graph are "not used to train foundation LLMs, including those used by Microsoft Copilot". Copilot services have also opted out of the Azure OpenAI abuse monitoring that includes human review. Optional customer feedback is separate and admin-manageable.
Can Microsoft 365 Copilot see files I do not have access to?
No. Copilot only surfaces data you already have at least view permissions on, enforced through the same access controls as the rest of Microsoft 365, and Semantic Index honors that identity boundary during grounding. The common surprise is not Copilot exceeding permissions, it is discovering how much your account could always read.
What is EchoLeak and does it still affect Microsoft 365 Copilot?
EchoLeak is CVE-2025-32711, the first zero-click attack on an AI agent, found by Aim Labs and published June 11, 2025. A crafted email caused Copilot to leak data from the scope of the signed-in user with no interaction. Microsoft fixed it server-side with no customer action required and reported no exploitation in the wild.
Is EchoLeak rated critical or high?
Both, depending on the source. Microsoft as CNA scored it 9.3 critical using Scope:Changed. NVD scored the same issue 7.5 high using Scope:Unchanged. If your risk register ingests NVD automatically, it will show as high while press coverage calls it critical. The disagreement is about scope modeling, not about the facts.
How do I stop Microsoft 365 Copilot from exposing sensitive files?
Run Purview DSPM oversharing assessments to see the exposure, apply sensitivity labels with a Purview DLP policy for the Copilot location, and use Restricted SharePoint Search as a temporary circuit breaker while you remediate permissions. Microsoft itself calls Restricted SharePoint Search a temporary solution, so treat it as a stopgap.
What is the difference between Microsoft 365 Copilot and Microsoft Security Copilot?
Microsoft 365 Copilot is a productivity assistant licensed per user that reads your business content. Microsoft Security Copilot is a security operations tool for your SOC, billed by Security Compute Unit. They serve opposite purposes, and buying Security Copilot does nothing to secure a Microsoft 365 Copilot deployment.
Is Microsoft Security Copilot included in Microsoft 365 E5?
Partly. Microsoft states that "eligible Microsoft 365 E5 and E7 customers will have 400 Security Compute Units (SCUs) per month for every 1000 user licenses, up to 10,000 SCUs per month". Consumption beyond that allocation is billed separately, so it is an included allowance rather than unlimited access.
Does Microsoft 365 Copilot block prompt injection?
It tries, with proprietary jailbreak and cross-prompt injection attack classifiers that analyze inputs and block high-risk prompts before model execution. Microsoft attaches an explicit caveat: "these classifiers may not be available in all Microsoft Copilot scenarios". Treat injection resistance as a strong default rather than a guarantee you can evidence to an auditor.
Do I need third-party security tooling for Microsoft 365 Copilot?
Usually not, if Copilot only summarizes documents for information workers. Permissions and Purview labels are the work, and you already own them. Third-party tooling starts earning its place when Copilot takes actions rather than answering questions, through custom agents, Graph connectors or MCP-connected tools on production systems.
Is Microsoft 365 Copilot compliant with HIPAA and GDPR?
Microsoft lists GDPR, ISO 27001, HIPAA and ISO 42001 among the compliance offerings listed for Copilot, and Copilot is covered by Microsoft 365 data residency commitments as of March 1, 2024. One caveat worth noting: Microsoft states that Anthropic models offered as a subprocessor are currently excluded from the EU Data Boundary.
Can I audit what Microsoft 365 Copilot did?
Yes, within Microsoft. Prompts and responses are stored as Copilot activity history, and admins can use Content search or Microsoft Purview to view them and apply retention policies. The gap appears when agents act outside Microsoft 365, because that evidence lands in other systems and has to be correlated to reconstruct a single sequence.
More use cases