📞 Call Us at 203.269.6111

Overview

Data security and privacy remain top priorities for any business exploring AI. This blog outlines how Microsoft safeguards customer information across Microsoft 365 with robust compliance frameworks, encryption standards, and access controls.

Read the content below to understand Microsoft’s security-by-design approach and contact UNAPEN, Inc. to discuss how your business can confidently adopt Copilot.

Frequently Asked Questions

How does Microsoft 365 Copilot utilize organizational data?

Microsoft 365 Copilot connects large language models (LLMs) to your organizational data by accessing content through Microsoft Graph.

It generates responses based on user documents, emails, calendar events, chats, and meetings that the user has permission to access.

This combination of content and context helps provide accurate and relevant responses. Importantly, prompts and responses are not used to train the foundation LLMs.

What measures are in place to protect organizational data?

Microsoft 365 Copilot employs a permissions model to ensure that only authorized users can access specific data.

It uses multiple layers of protection, including encryption for data at rest and in transit, and adheres to privacy regulations like GDPR.

Additionally, it implements logical isolation of customer content and honors usage rights granted to users, ensuring that sensitive information remains secure.

What data is stored from user interactions with Copilot?

When users interact with Microsoft 365 Copilot, data such as prompts and responses are stored as part of the user’s Copilot activity history.

This data is encrypted and processed in line with organizational commitments.

Admins can manage this stored data using tools like Microsoft Purview, and users have the option to delete their activity history through the My Account portal.

3 Core Components of Copilot

Microsoft 365 Copilot is a sophisticated processing and orchestration engine that provides AI-powered productivity capabilities by coordinating the following components:

Large language models (LLMs)
Content in Microsoft Graph, such as emails, chats, and documents that you have permission to access.
The Microsoft 365 productivity apps that you use every day, such as Word and PowerPoint.

For an overview of how these three components work together, see Microsoft 365 Copilot overview.

How Does Microsoft 365 Copilot Use Your Proprietary Organizational Data?

Microsoft 365 Copilot provides value by connecting LLMs to your organizational data. Microsoft 365 Copilot accesses content and context through Microsoft Graph.

It can generate responses anchored in your organizational data, such as user documents, emails, calendar, chats, meetings, and contacts. Microsoft 365 Copilot combines this content with the user’s working context, such as the meeting a user is in now, the email exchanges the user had on a topic, or the chat conversations the user had last week.

Microsoft 365 Copilot uses this combination of content and context to help provide accurate, relevant, and contextual responses.

How Does Microsoft 365 Copilot Protect Organizational Data?

The permissions model within your Microsoft 365 tenant can help ensure that data won’t unintentionally leak between users, groups, and tenants. Microsoft 365 Copilot presents only data that each individual can access using the same underlying controls for data access used in other Microsoft 365 services.

Semantic Index honors the user identity-based access boundary so that the grounding process only accesses content that the current user is authorized to access.

When you have data that’s encrypted by Microsoft Purview Information Protection, Microsoft 365 Copilot honors the usage rights granted to the user. This encryption can be applied by sensitivity labels or by restricted permissions in apps in Microsoft 365 by using Information Rights Management (IRM).

Multiple forms of protection have been implemented to help prevent customers from compromising Microsoft 365 services and applications or gaining unauthorized access to other tenants or the Microsoft 365 system itself.

Data Stored About User Interactions With Microsoft 365 Copilot

When a user interacts with Microsoft 365 Copilot (using apps such as Word, PowerPoint, Excel, OneNote, Loop, or Whiteboard), we store data about these interactions.

The stored data includes the user’s prompt and Copilot’s response, including citations to any information used to ground Copilot’s response. The user’s prompt and Copilot’s response to that prompt are called “content of interactions” and the record of those interactions is the user’s Copilot activity history.

For example, this stored data provides users with Copilot activity history in Microsoft 365 Copilot Chat (previously named Business Chat) and meetings in Microsoft Teams.

This data is processed and stored in alignment with contractual commitments with your organization’s other content in Microsoft 365. The data is encrypted while it’s stored and isn’t used to train foundation LLMs, including those used by Microsoft 365 Copilot.

To view and manage this stored data, admins can use Content search or Microsoft Purview. Admins can also use Microsoft Purview to set retention policies for the data related to chat interactions with Copilot.

How Does Copilot Block Harmful Content?

To help block harmful content, Microsoft 365 Copilot uses safeguards that work alongside AI models used to generate responses.

Depending on the scenario, these safeguards may include Microsoft first‑party protections or, in some cases, safety mitigations built into the underlying model.

These safeguards use a defense-in-depth approach and can include a mix of Microsoft first-party protections that help detect and reduce jailbreak attempts and prompt injection patterns (including cross-prompt injection attacks), content harm filters to identify harmful content in prompts or generated responses (such as Hate & Fairness, Sexual, Violence, and Self-harm), or in some scenarios, safety mitigations built into the underlying model.