Guides › Copilot security review

Microsoft 365 Copilot Security Review Checklist: Permissions, Purview, Retention and Agents to Confirm

Hunter Moore, Founder and CTO · Updated October 18, 2026

A Microsoft 365 Copilot security review is mostly a review of your own tenant. Microsoft's commitments on training, retention and processing are settled by the Data Protection Addendum and apply to the service as a processor; what decides the exposure is what the tenant's permissions already allow, how much content carries sensitivity labels, which Purview policies are in force, whether web grounding and Copilot Studio agents are enabled, and whether anyone has measured what Copilot returns before users do. This checklist covers Microsoft's side in one table and the tenant's side in another, gives the configuration sequence, and names what remains after both are done, as of October 2026.

The review in four lines

Microsoft's side is mostly settled. Prompts, responses and Graph data are not used to train foundation models; the DPA and Product Terms govern; interactions are stored in Microsoft 365 under your retention policies and are auditable.
Your side is the risk. Copilot reads whatever the user's identity can open. Oversharing in SharePoint and OneDrive is the finding in almost every review.
Labels and DLP are the content control. Copilot inherits sensitivity labels; a Purview DLP policy on the Copilot location can stop processing of labeled items. Unlabeled content is uncovered.
Watch the edges. Web search goes to Bing outside the EU Data Boundary, Anthropic models inside Copilot are excluded from it, Copilot Studio agents carry their own terms, and uploaded agent documents have no user authentication.

Scope the review to the Copilot you are enabling

“Copilot” covers several products with different data terms. Microsoft 365 Copilot and Copilot Chat used by an organization fall under enterprise data protection: the DPA and Product Terms with Microsoft as processor, no training of foundation models on prompts, responses or Graph data, and interactions stored and auditable in Microsoft 365. Consumer Copilot and personal Microsoft accounts are outside that, and employees have them. Copilot Studio agents and agents published into Copilot carry their own privacy terms and their own knowledge sources. And models from other providers can now be selected inside Copilot, with Microsoft stating that Anthropic models are excluded from the EU Data Boundary and in-country processing commitments. The review should name which of these is being approved, because the answers below differ. The provider policy comparison puts Copilot beside ChatGPT, Claude and Gemini if the review spans platforms.

Microsoft's side: the commitments

These rows are what Microsoft's documentation states as of October 2026. They need to be confirmed against your subscription, because Microsoft notes that the specific controls vary by it.

Area	Question	What Microsoft's documentation supports (October 2026)	Confirm in
Training	Are prompts, responses or our data used to train models?	No; prompts, responses and Graph data are not used to train foundation models.	DPA and Product Terms
Processing role	Who is the controller?	Microsoft acts as processor under the Data Protection Addendum for Microsoft 365 Copilot and Copilot Chat used by organizations.	DPA
Retention	How long are interactions kept?	Interaction data is stored in Microsoft 365 and governed by your Purview retention policies.	Configuration (Purview)
Permissions	What can Copilot read?	Only content the user is authorized to access, through Microsoft Graph under the user's identity.	Your tenant
Labels	Do sensitivity labels carry through?	Copilot inherits sensitivity labels; Purview DLP policies can prevent processing of labeled items.	Configuration (Purview)
Audit	What is recorded?	Interaction records with accessed resources and their label IDs, host app, agent and model provider; audit retention per your policies.	Configuration (Purview)
Residency	Is the EU Data Boundary honored?	Supported, excluding web search queries (to Bing, identifiers removed) and Anthropic models inside Copilot.	Contract and configuration
Healthcare and web	What is covered by the BAA and DPA?	HIPAA supported for properly configured implementations; web queries fall outside the DPA and BAA.	Contract
Agents	What terms apply to Copilot Studio agents?	Agents carry their own privacy terms. Uploaded agent documents have no user authentication; SharePoint, Dataverse and connector sources respect user access when agent user authentication is configured.	Agent-by-agent review

Your side: the tenant

This is where the review spends its time. Each row is a question about the tenant, what a defensible answer looks like, and the Microsoft tooling that produces it. The Copilot oversharing guide covers the first three rows in depth.

Tenant question	What a defensible answer looks like	Where it comes from
How much content is open to Everyone except external users?	A list of sites and items, with the regulated ones remediated or hidden before pilot	SAM data access governance reports (EEEU insights, permission state)
How many organization-wide and anyone links exist, and where?	Sites ranked by link activity, expiry policy set, worst offenders cleaned	SAM sharing links activity report; sharing policy
What can a sample of real identities open?	Five to ten users across roles enumerated, including a new hire and a contractor	SAM site permissions for a given user; manual check
What does Copilot return for questions it should refuse?	A measured rate under sample identities, recorded with the approval, re-run before each expansion	Refusal test (leakage self-test procedure)
Which sites are hidden from Copilot while permissions are fixed?	A per-site list with exit criteria and dates	Restricted Content Discovery
What share of regulated content is labeled?	Label coverage measured; auto-labeling where feasible; the DLP policy written against the highest labels	SAM sensitivity label snapshot; Purview
Is web grounding on, and should it be?	A deliberate decision, recorded, with the Bing exclusion from the EU Data Boundary and DPA understood	Copilot admin settings
Which agents exist and what do they know?	Inventory of Copilot Studio agents with knowledge sources, authentication mode, ungrounded-responses setting and official-source flags	Copilot Studio admin; agent owners
Which non-Microsoft models are enabled?	Explicit decision per model with the EU Data Boundary exclusion noted	Copilot admin settings
Who reads the audit, and how long is it kept?	A named reviewer, a weekly check of accessed-resource label IDs in the first month, an audit retention policy set	Purview audit; retention policy

Configuration before go-live

The sequence below assumes SharePoint Advanced Management is available, which Microsoft positions as the preparation tooling for Copilot and agents. Steps one to four are reporting and remediation; five to eight are the controls and the measurement loop.

Run the SAM data access governance reports.Permission state, Everyone except external users, sharing links, sensitivity label snapshot. Export and date them.
Rank and hide.Order sites by exposure and sensitivity; apply Restricted Content Discovery to the top of the list with an exit criterion for each.
Remediate.Remove EEEU grants, expire organization-wide links, use restricted access control on sites with a known audience, and delegate the rest through site access reviews.
Label and write the Copilot DLP policy.Label regulated content, then a Purview DLP policy on the Copilot location that prevents processing of the highest labels.
Set retention and audit.Purview retention policy for Copilot interactions and an audit retention policy long enough for your obligations.
Decide the edges.Web grounding on or off, which non-Microsoft models are enabled, and which Copilot Studio agents are allowed, each recorded with its reason.
Pilot with a bounded group and run the refusal test.Under five to ten real identities, before the pilot and before each expansion.
Schedule the reports.Monthly EEEU and sharing-link reports, quarterly access reviews, a standing agent inventory.

What the review cannot settle

Three things remain after both tables are green. The gap between what a user is authorized to open and what they were meant to see is a human judgment per site, and the reports only find the candidates. Purview's audit records show which resources Copilot touched per interaction, with sensitivity label IDs, host app, agent and model provider, which is strong evidence of what happened and still not a comparison against entitlement; the entitlement question is answered by a refusal test under real identities, repeated before each expansion. And anything that leaves the Microsoft 365 service boundary, whether a Bing web query, an Anthropic model selected inside Copilot, an agent calling an external system, or an employee pasting an answer into a personal account, is governed by other terms or by none. The ChatGPT Enterprise and Claude Enterprise checklists apply the same structure to the other two platforms most reviews cover.

Where Hardshell sits

Hardshell measures and governs the parts of this that the tenant controls cannot. Before rollout it tests what Copilot and the agents around it can be made to disclose under real identities and maps each finding to MITRE ATLAS technique IDs. For data connected to Copilot, ChatGPT, Claude, Gemini or an internal assistant, it enforces each user's existing permissions at query time without migrating the data, substitutes stand-ins for real identifiers before content reaches a third-party model, and records every retrieval under opaque IDs. It deploys as a cloud service, in a private cloud, or as an offline bundle.

Frequently asked questions

Does Microsoft 365 Copilot train on our data?

No. Microsoft states that prompts, responses and data accessed through Microsoft Graph are not used to train foundation models, and that Microsoft 365 Copilot used by organizations falls under the Data Protection Addendum and Product Terms with Microsoft as processor.

Does Copilot respect our SharePoint permissions?

Yes. Copilot can only summarize or reference content the user is authorized to access. The exposure is what those permissions already allow, which in most tenants is more than intended; measure it with the SharePoint Advanced Management reports before enabling Copilot.

Can we stop Copilot from using documents with a particular sensitivity label?

A Purview DLP policy scoped to the Microsoft 365 Copilot location can prevent Copilot from processing items that carry specified labels, for SharePoint and OneDrive files and emails; Microsoft notes the item may still appear in citations. Coverage depends on label coverage, which the sensitivity label snapshot report shows.

Is Copilot covered by the EU Data Boundary?

Microsoft lists the EU Data Boundary among Copilot's commitments with two stated exclusions: web search queries, which go to Bing as a separate service with identifiers removed, and Anthropic models offered inside Copilot. Confirm the scope for your subscription and the models you enable.

What does the Copilot audit log record?

Purview records each interaction with the user, time, hosting app, agent, model provider, and the resources Copilot accessed with their sensitivity label IDs. Prompt and response text are not described as part of the record. Retention follows your audit retention policies, so set one.

Should we restrict Copilot to a list of sites?

Restricted SharePoint Search, the allow-list approach, is capped at 100 sites, is described by Microsoft as not a security boundary, and can no longer be newly enabled since July 31, 2026. Use Restricted Content Discovery per site as a temporary measure while permissions are fixed, and treat the fix as the control.

Sources (accessed October 2026)

Microsoft Learn, Enterprise data protection in Microsoft Copilot; Microsoft 365 Copilot architecture: data protection and auditing; Audit Copilot and AI applications in Microsoft Purview (updated 26 August 2026); Restrict discovery of SharePoint sites and content (updated 11 October 2026); Restricted SharePoint Search; SharePoint Advanced Management overview; Knowledge in Copilot Studio.