Copilot inherits your permissions

Microsoft clearly describes the security model: Copilot displays only corporate data for which the user has at least read access. The Semantic Index, which Copilot uses to find relevant content, also adheres to this identity-based restriction. If a document is encrypted with Microsoft Purview Information Protection, Copilot respects the access rights granted to the user via the sensitivity label.

This is both good news and a challenge. Copilot doesn't create new access points. However, it makes existing access points visible and usable. Typical legacy issues in established Microsoft 365 environments include:

• Teams and SharePoint sites that were set to "public" when they were created
• Sharing settings for "Everyone except external users" or links for "People in your organization"
• Abandoned sites from completed projects where no one maintains the member list anymore
• Folders containing payroll, HR, or contract data that were initially shared with a single person and have never been restricted again

As long as no one is specifically looking for them, such disclosures hardly stand out. A question like “Summarize the current salary adjustments for me” can quickly bring them to light.

What Microsoft Plans to Do in Preparation

Microsoft has published a dedicated deployment blueprint for Copilot on the topic of oversharing. It breaks down the preparation process into three areas: addressing oversharing, setting up guardrails, and meeting regulatory requirements. According to Microsoft, SharePoint Advanced Management is included in the Copilot license. In practice, the following features are particularly relevant:

Data Access Governance Reports

The reports show which sites have the highest traffic—for example, from thousands of members, external guests, or users with the "Everyone except external users" permission. Activity reports also show where a particularly large number of share links have been created over the past 28 days. This gives you a prioritized list instead of an endless inventory.

Restricted Content Discovery and Restricted Access Control

With Restricted Content Discovery, you can hide sites from Copilot and company-wide search without changing the permissions yourself. This serves as a temporary solution until a site has been cleaned up. Restricted Access Control goes a step further: Only members of a defined group can open the site at all, even if others previously had access via permissions or links.

Site Attestation and Inactive Sites

Through verification policies, site administrators regularly confirm whether owners, members, and permissions are still accurate. Policies for inactive sites identify abandoned sections and notify owners via email. Both measures ensure that cleanup is not a one-time effort.

Classification and DLP as a Second Line of Defense

Permissions control who is allowed to view content. Sensitivity labels and data loss prevention (DLP) also control what can be done with content that requires special protection. Microsoft Purview provides a dedicated DLP location for Microsoft 365 Copilot and Copilot Chat:

• Files and emails with specific sensitivity labels can be excluded from processing in Copilot responses. They may still appear as references, but their content will not be included in the response.
• Prompts that contain specific types of sensitive information may be blocked. In such cases, Copilot will not provide a response.
• Web searches can be blocked if a prompt contains sensitive data.

It is important to note a limitation that Microsoft itself documents: DLP checks only the text typed into the prompt, not files uploaded directly to a prompt. In addition, for each rule, either the “Sensitivity Label” condition or the “Sensitive Information Type” condition applies—not both. To ensure traceability, Microsoft notes that prompts and responses are recorded in the Unified Audit Log.

For these controls to be effective, the labels must actually be set. Microsoft notes that there is no automatic inheritance of protection for new content without a label. A classification that exists only on paper does not provide protection when using Copilot.

Data Protection: The applicable law is already in effect

For companies in Switzerland, data protection is not an issue to be addressed later. The FDPIC states that the current Data Protection Act applies directly to AI-supported data processing, regardless of future AI regulations. Anyone using AI must, among other things, ensure transparency regarding the purpose, functionality, and data sources. A data protection impact assessment is required if there are high risks to data subjects. You should consult with your data protection officer to determine whether and to what extent this applies to your use of Copilot.

Regarding data flows, Microsoft states that prompts, responses, and data retrieved via Microsoft Graph are not used to train the underlying language models. For users in the EU, additional safeguards apply under the EU Data Boundary. This information should be included in your record of processing activities and in the vendor assessment.

The AI security study conducted by the TÜV Association and the BSI in October 2026 for Germany illustrates just how far current practices may fall short of these requirements: 29 percent of the surveyed companies that use AI have not yet implemented any of the measures asked about, such as training, approval processes, or vendor vetting.