AI Security
Copilot security: what Microsoft covers and what your admins still set
A plain guide for IT and security owners rolling out Microsoft Copilot. It sticks to what Microsoft Learn documents, says where the control sits (Microsoft or your tenant), and lists the questions to settle before staff use it.
Copilot security rests on one idea from Microsoft's documentation: Microsoft Copilot only accesses data that users are authorized to access. It inherits your Microsoft 365 identity and access controls, so a Copilot answer can include anything the person asking already has permission to open. Microsoft adds layered protections on prompts, grounding and responses, and gives admins tools such as Microsoft Purview data loss prevention and audit logs. The consequence is that Copilot can surface oversharing you already have. Cleaning up permissions and labels before rollout is the control that matters most, and it sits with your team.
definition
What does Copilot security cover?
Copilot security covers three things: who can reach what through Copilot, what protections run on prompts and answers, and how your team monitors and responds. Microsoft manages some of these controls and you configure others; Microsoft's own page says the availability of some protections depends on your organization's licensing.
This page summarizes what Microsoft Learn said when we read it on 2026-11-10, with links. Microsoft renamed the Microsoft 365 Copilot app to Microsoft Copilot, and its documentation changes often, so check the source before you rely on a detail.
permissions
How does Copilot use my permissions?
Microsoft's page says Copilot "is built on Microsoft 365 identity and access controls and aligns with Zero Trust principles such as strong identity verification, least-privilege access, and continuous evaluation." It also says Copilot "only accesses data that users are authorized to access."
That is reassuring and also the main risk. If a file is shared too widely, Copilot can surface it to anyone who can already open it. Microsoft says so directly: "Overshared or poorly governed content can affect Copilot results and increase risk." Fixing oversharing is a permissions and labeling job, done before rollout.
protections
What protections does Microsoft apply to prompts and answers?
Microsoft's prompt defense page describes protections at five stages: prompt input, prompt ingress, grounding, web search and response egress. Examples it lists include a block list for known malicious prompts and jailbreak attempts, responsible AI classifier filtering on prompts and on responses, detection of hidden Unicode instructions in pasted text, tool chain analysis, and Safe Links checks on links in responses.
The page separates what Microsoft manages from what you configure. Administrators can set Microsoft Purview data loss prevention for Copilot, restrict discovery of SharePoint content, control whether web search is allowed, and exclude sites from web grounding. Some of these need Purview or Defender licenses.
prompt injection
How does Microsoft handle prompt injection in Copilot?
Microsoft separates direct prompt injection, where a user types a prompt designed to make Copilot do something malicious, from indirect injection, where the instructions sit in a file, image, code or encoded text the prompt refers to. It says it applies prompt injection and jailbreak mitigation during prompt processing.
When its jailbreak classifiers trigger, Microsoft says they expose signals in the Microsoft Defender portal and in Microsoft Purview audit logs, so your security operations team can investigate. The audit records carry a JailbreakDetected flag. Someone on your team has to be watching those signals for them to help.
monitoring
Where do admins monitor Copilot security?
Microsoft describes two dashboards. The Copilot security dashboard in the Microsoft 365 admin center focuses on Copilot data protection, oversharing and compliance insights; viewing it needs the Global Reader role and making changes needs the AI Administrator role. The Microsoft Security Dashboard for AI gives a wider view across Copilot, Copilot Studio agents, Microsoft Foundry apps and agents, and third-party AI apps.
On the page we read, the Security Dashboard for AI was marked public preview and Microsoft warned that its capabilities might change before general availability. Confirm its status on the source page before you plan around it.
checklist
What should your team settle before rollout?
Use this list in a review with your IT, security and records owners. It is a set of questions, not a legal opinion or an audit.
Which SharePoint sites, Teams and shared drives are shared more widely than their content deserves? Who owns the clean-up?
Are sensitivity labels applied to the content that should be restricted, and do your data loss prevention policies cover Copilot?
Is web search allowed for Copilot in your tenant, and do you want it to be? Are any sites excluded from web grounding?
Which agents, plugins and connections can Copilot use, and who approves new ones? Microsoft says admins can review agent details such as data sources, tools and connections.
Are Copilot interactions in your audit logs, and who reviews jailbreak signals?
Which Microsoft licenses do you hold? Some protections need Purview or Defender licenses.
Who in the business may use Copilot first, and what are they told never to paste into it?
What do staff do when an answer shows content they should not be able to see?
not first
What we do not recommend doing first
We do not recommend a company-wide rollout before the permissions review. Start with a small group, a reviewed set of sites and the monitoring in place, then widen access. Copilot will not fix a permissions problem that was already there.
how kriv helps
How Kriv AI helps
Kriv AI is an AI services company. We help teams review permissions and labels, plan Copilot rollouts, set up approval and monitoring routines, and train staff, with work informed by Microsoft's published security documentation. We do not give legal advice and this page is not a security audit of your tenant. Engagements are scoped and priced after a short discovery call.
Related resources
Continue exploring
Straight answers
Frequently asked questions about Copilot security: what Microsoft covers and what your admins still set
Is Microsoft Copilot secure?
Microsoft documents layered protections on prompts, grounding and responses, and says Copilot only accesses data that users are authorized to access. Because it works within existing permissions, oversharing in your tenant can still show up in answers, so review permissions before rollout.
Can Copilot see files I do not have access to?
Microsoft says Copilot only accesses data that users are authorized to access. It follows the permissions of the person asking.
What is oversharing, and why does it matter for Copilot?
Oversharing means content is open to more people than it should be. Microsoft says overshared or poorly governed content can affect Copilot results and increase risk, so fix permissions and labels first.
Can admins turn off web search in Copilot?
Microsoft says administrators can configure whether to allow web search and can exclude sites from web grounding. Check the source page for the current defaults for your tenant type.
How do I see attempted jailbreaks or prompt injection in Copilot?
Microsoft says its jailbreak classifiers expose signals in the Microsoft Defender portal and in Microsoft Purview audit logs, and audit records carry a JailbreakDetected flag. Someone on your team needs to review them.
Does Kriv AI provide legal advice or a security audit?
No. We help teams plan and configure Copilot rollouts, working with your IT, security and legal owners. This page is general information, not an audit of your tenant.
Talk to the team that would do the work
Bring your requirements to a working session with the person who'll actually deliver.
Book a Discovery Call