Question

A financial services firm is deploying Microsoft 365 Copilot. During a pre-deployment readiness review, the security architect finds that many SharePoint sites containing confidential client portfolios have broad 'Everyone except external users' permissions, and much of the content is unlabeled. Leadership is concerned that Copilot could surface confidential data to employees who should not see it in generated responses. The architect must design a data-security control set that reduces oversharing risk without blocking Copilot entirely. Which approach best addresses the requirement?

Accepted Answer

Use Microsoft Purview to auto-apply sensitivity labels with encryption and usage rights to the confidential content, run SharePoint Advanced Management/oversharing reports to remediate excessive permissions, and rely on Copilot honoring label-based access before returning content.

Answer

Disable Copilot for all users who do not have an E5 license and enable Defender for Office 365 Safe Links to scan Copilot responses for confidential data.

Answer

Configure a Conditional Access policy that blocks Copilot access from unmanaged devices and enable multifactor authentication for all Copilot sessions.

Answer

Apply a DLP policy on Exchange Online transport rules to block emails containing confidential client data and enable audit logging for Copilot prompts.