Question

A financial services company is deploying Microsoft 365 Copilot to boost employee productivity. During pre-deployment testing, the security architect discovers that Copilot can surface sensitive documents (containing PII and financial records) to users who technically have SharePoint access but should not view them, due to years of accumulated permission sprawl and broad sharing links. Leadership wants to proceed with deployment but demands that Copilot not become a vector for data oversharing. Following Microsoft Cybersecurity Reference Architecture (MCRA) guidance for secure AI adoption, which approach should the architect prioritize FIRST?

Accepted Answer

Use Microsoft Purview to apply sensitivity labels with encryption and remediate oversharing through data access governance before broad Copilot rollout

Answer

Disable Copilot access to SharePoint Online entirely and restrict it to Exchange and Teams chat data only

Answer

Rely on Conditional Access policies to block Copilot queries from non-compliant devices

Answer

Enable Copilot for all users and use audit logs to retroactively investigate any inappropriate data exposure