Navigating the Microsoft Copilot Landscape: Essential Insights for Every Enterprise

Summary: The Microsoft Copilot landscape continues to evolve, bringing new capabilities and associated risks. This article covers the latest features and essential considerations for managing them effectively.

Within the framework of our Microsoft 365 Academy series, we recently collaborated with experts in eDiscovery and information governance to examine the current capabilities of Microsoft 365 Copilot. Our discussion focused on the varying risks linked to Copilot across different M365 applications and how to leverage Microsoft Purview to maintain oversight while integrating AI into business operations.

Key Insights for Managing Microsoft Copilot

Here are seven significant insights to assist organizations in effectively overseeing Copilot and AI technologies:

1. Unlicensed Use of Copilot

Many users are interacting with Copilot Chat, a free browser-based tool, even if they lack a corporate Copilot license. This situation can lead to complications during data discovery, as any exchanges made in Copilot could be stored in Exchange mailboxes if enterprise data protection is enabled. This makes them part of discoverable assets.

• Enterprise Risk: Users may inadvertently create discoverable content without realizing it.
• Opportunity: This scenario can prompt organizations to establish clear retention policies and monitor how their employees engage with Copilot.

2. Creation of Multiple Artifacts

Every interaction with Copilot generates at least two primary items:

• User prompt
• Copilot response
• Optionally, related files from platforms like SharePoint or OneDrive

Reference documents in these interactions can add complexity to discoverable content, potentially inflating data volumes.

• Enterprise Risk: A lack of information governance could lead to excessive data intensive for discovery.
• Opportunity: Understanding these artifacts can help organizations optimize eDiscovery processes and data management strategies.

3. Adapting Retention Policies

Organizations can now use Purview to differentiate retention policies related to Copilot interactions from Teams chats. However, different applications still cannot have distinct retention settings for Copilot-generated prompts.

• Enterprise Risk: Generic policies might result in keeping Copilot content too long or deleting it prematurely, raising compliance issues.
• Opportunity: Leveraging metadata in Microsoft Purview can help classify Copilot artifacts for more effective eDiscovery.

4. Limitations of Security by Obscurity

Some organizations mistakenly believe their data is secure because users don’t know about its existence. With the Microsoft Graph powering Copilot’s intelligence, this could lead to unintended sharing of sensitive information.

• Enterprise Risk: Users may access outdated or sensitive information without realizing it, which can lead to inaccuracies.
• Opportunity: Mapping your enterprise data and conducting regular assessments can improve content quality and data governance.

5. The Role of Sensitivity Labels

Copilot utilizes Microsoft Sensitivity labels to safeguard sensitive data, assigning the highest-level label from any referenced documents to new content it creates.

• Enterprise Risk: If sensitivity labels are not applied, Copilot might inadvertently generate files using restricted information, resulting in inconsistent labeling.
• Opportunity: Establishing a labeling strategy can ensure that Copilot adheres to content protections effectively.

6. Evolving Support from Purview Tools

Organizations can use various features in Microsoft Purview to manage AI-related risks effectively:

• Data Lifecycle Management for retention and deletion
• Data Loss Prevention to identify sensitive content in Copilot prompts
• Communication Compliance to flag problematic prompts
• Insider Risk Management for correlating behaviors across file access and Copilot
• Data Security Posture Management (DSPM) for visibility into AI usage

• Enterprise Risk: Unaddressed configurations can lead to compliance and security gaps.
• Opportunity: Most of the governance mechanisms necessary for Copilot are accessible via existing Purview tools and can be configured proactively for enhanced safety.

7. A Measured Approach to Scaling

As Copilot integrates into more areas of the M365 ecosystem, organizations may feel overwhelmed. A prudent strategy is to begin by limiting access to selected SharePoint sites, gradually expanding as controls and governance practices are established.

• Enterprise Risk: An all-encompassing rollout could inadvertently expose sensitive or outdated content.
• Opportunity: Starting small allows organizations to realize early success while refining their information governance practices.

Focus on Education

Implementing Copilot technology is not just about turning on features; it requires aligning stakeholders across legal, compliance, privacy, and IT sectors to ensure everyone understands Copilot’s mechanics and controls. Gaining consensus on necessary policies can be the most challenging aspect of the implementation process.