Skip to the presentation
Copilot governanceA Guide to Cloud
Copilot / Governance

01 Copilot governance, made visible

What can Copilot actually reach?

Start with the source. Follow the permissions, the agent and the evidence.

Let’s follow one file.

Read the source Copilot privacy (opens in new tab)Security questions answered (opens in new tab)
Presenter notes

Public talk track only

This is Sush’s personal A Guide to Cloud training demo. It uses public documentation and fictional examples. It is neither a live tenant assessment nor a Microsoft guarantee.

This public route is marked noindex to reduce search discovery. That is not an access control.

Start by agreeing the workload, audience and source boundary. Use the experiments to discuss controls, then validate the exact experience in an authorised pilot. Documentation checked for 15 September 2026; service rollout and licensing can vary.

02 Start with the risk

Broad access becomes easy discovery.

For user-scoped Microsoft 365 retrieval, broad permissions can make existing data easier to find.

PeopleWho can reach the source? DataHide it, or block access? ActionsWhose authority does an agent use? EvidenceCan we investigate what happened?
Read the source Copilot privacy (opens in new tab)Security questions answered (opens in new tab)
Presenter notes

Public talk track only

Copilot can change the ease and speed of discovering information. Existing permissions are one important boundary, but they do not remove risks from oversharing, untrusted content, inaccurate answers or connected actions.

Choose one buyer question to follow. Return through Chapters if the conversation changes direction. These questions are a scoping aid, not a risk assessment.

03 Follow the request

The permission check is on the path.

A simplified view of built-in, user-scoped Microsoft 365 retrieval.

A simplified request path1 / 5
The file still has a gate.

A signed-in user asks a question. This diagram stays within the built-in Microsoft 365 retrieval path.

Read the source Copilot privacy (opens in new tab)Audit Copilot (opens in new tab)
Presenter notes

Public talk track only

This simplified path describes built-in Microsoft 365 Copilot retrieval in the user’s context. It does not claim every agent uses Microsoft Graph, user-delegated identity, or the same orchestration.

Web search, connectors and actions can cross other boundaries. Validate each configured service and identity. Audit records depend on the host and supported activity; do not promise visibility into every tool invocation.

04 Try the access model

Check the file AND the group.

RAC adds a group gate. It does not grant a missing source permission.

Start with a scenario →
Board-review-demo.txtA fictional SharePoint source
Configure source and group access
File permissionGranted
RAC group gateMissing
Direct access denied

Source permission exists, but the allowed RAC group membership is missing.

ACL AND (RAC off OR allowed group)

“I have . With , do I also belong to the ?”

Tap a phrase. Check the matching gate. ↑
Read the source Restricted access control (opens in new tab)
Presenter notes

Public talk track only

Illustrative model, not a tenant test. For this simplified SharePoint RAC example: eligible direct access = existing source permission AND (RAC disabled OR membership of an allowed RAC group).

This tests eligibility for direct source access, not retrieval ranking or a guarantee that Copilot will find, cite or use the file. Existing downloads and copies are not revoked. Propagation, group type and site-specific exceptions must be tested separately.

05 Find the review queue

Start with the sites that need a look.

Use SharePoint Advanced Management to prioritise an owner-led review.

Illustrative review queue3 FICTIONAL SITES
01
Project archive

Everyone except external users

Review the audience
02
Board demo

Broad sharing link

Inspect the link scope
03
Operations lab

Broken inheritance

Check unique grants
  1. Find
  2. Owner review
  3. Right-size
  4. Recheck

Illustrative risk factors only. These are not scanned results.

Check the licence boundary

One assigned qualifying Copilot licence plus the required base licence unlocks documented included SAM features, not all SAM capabilities. Check SAM Plan 1 exceptions and E5 requirements for sensitivity-label reports.

Read the source Data access governance (opens in new tab)SAM licensing (opens in new tab)
Presenter notes

Public talk track only

All three sites and findings shown here are fictional. EEEU means Everyone except external users. Broad sharing links and broken inheritance need context; they are signals for review, not proof that a breach occurred.

Data access governance and permission snapshot reports are asynchronous. Use the available reports, review them with the site owner, right-size access and rerun the relevant checks.

One assigned qualifying Microsoft 365 Copilot licence with the required base licence unlocks the documented included SAM features. It does not include every SAM capability. Check SAM Plan 1 exceptions and the separate E5 requirements for sensitivity-label reports.

06 Two controls, two jobs

Hide discovery? Or restrict access?

Look at the setting, then ask which route it controls.

Official Microsoft SharePoint demonstration. Restricted content discovery is On at left; restricted access control is Not set at right.

This hides discovery.
The file can still open.

Cropped for readability. Original UI and redactions retained. Official Microsoft demonstration from Sush’s published oversharing article, not today’s Caldova tenant. UI and behaviour vary.
Read the source Restricted content discovery (opens in new tab)Restricted access control (opens in new tab)SharePoint oversharing controls (opens in new tab)
Presenter notes

Public talk track only

RCD limits organisation-wide discovery while owners review a site. Existing permissions remain. Direct access and site-context search are separate from organisation-wide discovery; in-use content is not the same as a source-access block.

The current RCD page conflicts with itself on recently interacted files: its introduction includes them, while a later section says they remain discoverable. Validate current behaviour in the target tenant. Do not promise universal denial for an existing agent.

RAC requires both source permission and membership in an allowed group. Group and search-index propagation take time. Shared and private channel sites need their own configuration; a parent team’s RAC policy is not inherited. External participants in a shared channel are not evaluated against the resource tenant’s RAC policy.

The screenshot is an official Microsoft demonstration reproduced in Sush’s published oversharing article. It is not today’s Caldova tenant or a customer assessment. UI and behaviour may vary by tenant.

07 The label is the starting point

“Confidential” is not the whole answer.

Check the container setting, item rights and DLP action separately.

Three separate decisionsCONCEPT
01
Site / container

Set the collaboration boundary

A site label does not label every file inside it.
02
Item / encryption

Apply a label and usage rights

Read and extraction rights affect supported processing.
03
DLP / processing

Apply the configured policy action

Check conditions, scope and the Copilot surface.
LABEL NAME ONLYConfidential
REVIEW THE CONFIGURATIONSettings + rights + policy
Read the source Purview protections (opens in new tab)Copilot DLP (opens in new tab)
Presenter notes

Public talk track only

Container labels configure a site, group or team. They do not automatically label every item inside. Item labels can carry encryption and usage rights. DLP applies its own configured conditions and actions.

Supported encrypted content needs VIEW and EXTRACT rights for Copilot processing. Rights Management OWNER is a usage right; it is not the same as SharePoint Full Control. Supported in-app experiences and the active Edge page have additional considerations, so test the exact surface.

08 Be precise about DLP

What exactly are we blocking?

Simulation, labelled content and sensitive prompts are different policy questions.

Choose the policy questionILLUSTRATION
OBSERVE

See matches before enforcement

Simulation lets you review policy matches without blocking the interaction.

Use the evidence to tune scope and conditions before turning on enforcement.

A separate action: block external web search for matching sensitive prompts while permitted internal grounding can continue.

Read the source Copilot DLP (opens in new tab)Purview protections (opens in new tab)
Presenter notes

Public talk track only

This is an explanatory illustration, not a live Purview rule editor or an enforcement test. It does not submit or inspect a prompt.

Simulation observes matches rather than blocking. A label-based Copilot policy can exclude supported content from processing even if the user can open the file; citations can still appear.

Prompt sensitive-information-type blocking is a separate preview capability. That check does not inspect uploaded file contents. A separate web-search-only action can block external web search while allowing a response using permitted internal sources.

Label-based content protection requires eligible Purview E5-equivalent entitlements. Do not apply that blanket licensing claim to the prompt preview. Verify current tenant rollout and licence terms; allow up to four hours for policy changes to take effect.

09 Which agent are we discussing?

The chat window is only the front door.

Microsoft 365 Copilot can host both approaches. The engine and connected services still matter.

INTERACTION CHANNELMicrosoft 365 Copilot

Can host both approaches

Declarative

Microsoft 365 Copilot orchestration

  • Define instructions and knowledge
  • Review tools and configured access

Custom-engine

Your configured orchestration

  • Build with Studio / Foundry
  • Review models, tools and services
FOLLOW EACH PATHSources → copies → connections → destinations
Read the source Custom-engine agents (opens in new tab)Agent data flow and governance (opens in new tab)Copilot privacy (opens in new tab)
Presenter notes

Public talk track only

Microsoft 365 Copilot can host declarative and custom-engine agents. A channel is where a person interacts; architecture determines how orchestration, models, sources and tools are used.

Copilot Studio and Microsoft Foundry can be used to build custom-engine agents. Do not assume all services connected to an agent inherit the core Microsoft 365 Copilot privacy boundary.

An uploaded file may be a separate copy. Revoking access to the original source does not necessarily remove that copy. Record source locations, copies, retention and destinations before approval.

10 Follow the authority

Who owns this connection?

The person asking and the identity doing the work can differ.

Choose a connection modelCONCEPT
Person asksAgent calls a toolUser’s connection

Authority to inspect

The user’s granted scope

The tool acts through the signed-in user’s delegated connection. Downstream permissions and authorisation still matter.

Check connection owner, permissions, downstream authorisation and destination.

Read the source Agent tools and credentials (opens in new tab)Agent data flow and governance (opens in new tab)
Presenter notes

Public talk track only

A user-delegated connection can act within the signed-in user’s granted scope. A maker-provided connection can use the maker’s configured authority, including during an interactive conversation.

An automated run uses the configured connection for that tool or flow. Do not assume every autonomous action uses one identity, or that maker credentials only apply to autonomous runs.

Review authentication mode, connection owner, permissions, downstream authorisation and data destinations. Approval of an agent’s audience is not proof that each connection is safe.

11 Before you publish

An owner at every gate.

Keep source access, agent audience and tool connections separate.

Publish with ownershipFIVE GATES
  1. 01
    Environment + maker

    Agree where it can be built and who can build it.

  2. 02
    Sources + connectors

    Approve source scope, connections and destinations.

  3. 03
    Publish + audience

    Validate channel controls and separate sharing grants.

  4. 04
    Owner + monitoring

    Keep an inventory. Know the coverage gaps.

  5. 05
    Retire + verify

    Revoke the relevant agent, source and connection paths.

Registry coverage depends on platform integration. An empty findings list does not prove an agent is clean.

Read the source Power Platform data policies (opens in new tab)Agent tools and credentials (opens in new tab)Agent data flow and governance (opens in new tab)
Presenter notes

Public talk track only

Power Platform data policies control connector combinations, channels and supported endpoints. They are not a universal sensitive-content classifier. Coverage and enforcement differ by platform and channel.

Agent registries and inventory depend on integration and platform coverage. No finding or a zero risk indicator does not prove that an agent is clean. There is no universal kill switch that automatically contains every channel and downstream connection.

Sharing an agent does not automatically grant every source permission. Agent Builder can optionally grant source access as part of sharing; that separately granted access can persist after agent access is revoked. Review both grants.

12 Read the evidence

An event is not the conversation.

Audit can connect the user, host and resources. Full prompt and response text needs a separate route.

CopilotInteractionINVENTED DATA

OperationCopilotInteraction

UserFictional pilot user

AppHostMicrosoft 365 Copilot

Resource referencedemo-resource-01

Message referencedemo-message-01

Who initiated the activity? Check the recorded user identity within the supported event.

Full prompt and response
Not in the standard audit event.

Read the source Audit Copilot (opens in new tab)Auditing Copilot (opens in new tab)
Presenter notes

Public talk track only

This field sketch is synthetic, not an exact export schema. The IDs demo-message-01 and demo-resource-01 are invented. No actual account identifiers, IP addresses or event timestamps are included.

CopilotInteraction and associated fields vary by supported host and activity. Message identifiers and resource references help investigations, but not every event includes all fields or every tool call.

Full content review needs a separate authorised path such as supported DSPM experiences, eDiscovery or the interaction export API. Being someone’s manager is not sufficient permission.

13 Then read the content

This is the content view.

Published, redacted August lab evidence. Select a crop to read the prompt, response or files.

Published, redacted August lab screenshot of a Purview conversation detail view. Original red annotations identify the prompt, full response and referenced files.

The prompt, with the original lab annotation. Content is cropped for readability, not changed.

Cropped for readability. Original UI and redactions retained. Published demo capture, not live telemetry. Redacted August lab image from Sush’s auditing article.
Read the source DSPM permissions (opens in new tab)Authorised interaction export (opens in new tab)Audit retention (opens in new tab)Auditing Copilot (opens in new tab)
Presenter notes

Public talk track only

This is an already-public, redacted August lab capture from Sush’s auditing article, including its original red annotations. It is published demo evidence, not live telemetry or today’s customer tenant.

Supported DSPM content views and eDiscovery require the relevant roles and scoped access. The interaction export API is a separate authorised application route with its own permissions and availability requirements. A manager relationship alone grants none of these.

Copilot audit events have a default 180-day retention period, including for E5 users. Configure custom audit retention where entitled. Conversation/content retention and legal holds are a separate policy plane; audit retention does not preserve the full conversation by itself.

14 Respond deliberately

Contain the path. Keep the evidence.

Investigate what happened before deciding what to remove.

A scoped response pathINVESTIGATE FIRST
  1. 01

    Preserve evidence

    Keep relevant events and content through authorised processes.

  2. 02

    Contain the path

    Review source access, agent audience and tool connections.

  3. 03

    Investigate actual scope

    Establish what was reached, copied, shared or acted on.

  4. 04

    Remediate + retest

    Correct the grants and policies. Verify allowed and denied cases.

Keep what explains it.

Read the source Audit Copilot (opens in new tab)Audit retention (opens in new tab)Security questions answered (opens in new tab)
Presenter notes

Public talk track only

Use a scoped incident process rather than a purge or delete default. Preserve relevant evidence, identify source access, agent publication and tool connections, then contain the affected paths.

Audit event retention differs from content retention. Retention requirements and holds can preserve content despite user deletion; involve the authorised records and legal teams.

For a fictional policy-retrieval pilot, use the approved version, name a content owner and require human review. This experience provides no clinical advice and must not substitute for clinical judgement.

15 Make a bounded decision

What must be true before the pilot?

A discussion checklist. A checked box does not make a tenant ready.

Before the pilot
Pilot discussion gates

0 of 6 discussion gates marked. Evidence still needs review.

Changing this checklist does not change your tenant.

Read the source SAM licensing (opens in new tab)Copilot DLP (opens in new tab)Security questions answered (opens in new tab)
Presenter notes

Public talk track only

This is a discussion checklist, not certification, a risk score or proof of control effectiveness. No information is sent or stored externally. Selections exist only in this page’s memory and clear on reload.

For each gate, agree who owns it and what evidence will be reviewed. Test allowed and denied source access, configured connections, investigation roles and incident handling in the actual target environment.

Confirm feature-specific licensing and service rollout before promising a control. Record the bounded audience, approved sources and a review date outside this demo in the organisation’s approved system.

16 The next conversation

A small pilot. Evidence we can check.

Agree the audience, an owner and a review date.

Keep the conversation grounded15 SEP 2026
01Auditing Copilot02SharePoint oversharing controls03Agent data flow and governance04Security questions answered
Microsoft Learn reference desk
Copilot privacyRestricted content discoveryRestricted access controlData access governanceSAM licensingPurview protectionsCopilot DLPCustom-engine agentsAgent tools and credentialsPower Platform data policiesAudit CopilotAudit retentionDSPM permissionsAuthorised interaction export

Carry these caveats into the room

RCD docs currently conflict on recently interacted files. Test the exact route.

Restricted SharePoint Search new enablement was blocked from 31 July 2026. It is not a new rollout recommendation here.

Roles, licences, channels and rollout vary. Validate the target tenant.

Read the source Auditing Copilot (opens in new tab)SharePoint oversharing controls (opens in new tab)Agent data flow and governance (opens in new tab)Security questions answered (opens in new tab)
Presenter notes

Public talk track only

Reference position: 15 September 2026. Public documentation and service rollout can change. Restricted SharePoint Search is not proposed as a new rollout control: new enablement was blocked from 31 July 2026.

The RCD documentation has a current contradiction about recently interacted files. Test the target tenant and exact route. Verify platform, channel, licence and role coverage rather than treating the controls in this guide as universal guarantees.

Personal A Guide to Cloud training material, assembled from public sources and fictional examples. No confidential customer content, live tenant connection, customer-data collection or added telemetry.

16 scenes / a guided conversation

Choose the next question

Arrow keys or Space move between scenes when focus is outside a control. Escape closes dialogs. Print shows every scene.

Original published capture