Question

Your organization has rolled out Microsoft 365 Copilot to all licensed users. The security team is concerned that Copilot's ability to reference content from the public web could return unvetted information in responses. Leadership asks you to turn off only the web-grounding capability while keeping Copilot fully functional against internal Microsoft 365 data. Which action should you take?

Accepted Answer

In the Microsoft 365 admin center, disable the Copilot web search (web content plugin) setting for the organization.

Answer

Remove the Microsoft 365 Copilot license from all users until the web feature can be reviewed.

Answer

Create a Purview DLP policy that blocks all Copilot responses containing external URLs.

Answer

Disable Microsoft Graph connectors so Copilot cannot reach any external data source.