Microsoft 365 Copilot – Privacy & Security Impact on User Data

On Day 18 of cybersecurity awareness month, learn how Microsoft addresses the privacy and security concerns when using Microsoft 365 Copilot and how it safeguards user data. Stay tuned for the upcoming blogs in our Cybersecurity blog series.

Imagine the digital world with AI where there is no need for taking notes, composing emails, writing creative posts, editing an image, and many more. Even catching up on the meeting notes later, helping with shopping, and suggesting the best vacation places based on the interest can also be done with the help of AI. How creative! Almost every human brain can think less and work less when AI is with them. Microsoft has now turned this into reality with Microsoft 365 Copilot, the power of next-generation AI to work! Additionally, MS extends its capability by introducing ‘Copilot Pro’ which contains Copilot GPTs, Copilot mobile app, etc. What more do Microsoft customers ask for!? Like how ChatGPT helps sysadmins, it’s time for Microsoft Copilot to start the game.

And what made them even more exciting is that Microsoft 365 Copilot is embedded in the most popular Microsoft 365 apps – Word, Excel, PowerPoint, Outlook, Teams, and more. Also, MS introduced ‘Business Chat’ that accesses all the data and does things we never expected before. Absolutely thrilling! However, now listen to what Noam Chomsky says

It’s dangerous when people are willing to give up their privacy.

-Noam Chomsky

As new technologies evolve, cyberattacks will increase exponentially, and the users’ privacy concerns tend to increase. Now, let’s dive into how Microsoft Copilot works and how privacy & security will be retained.

Microsoft 365 Copilot is the copilot for work that does really impressive things by integrating with various Microsoft 365 apps like Outlook, Word, Excel, PowerPoint, Teams, Power platform, etc. Microsoft 365 co-pilot combines large language models (LLM) with Microsoft Graph and Microsoft 365 apps to turn the users’ natural language into creative and productive outcomes. While coming to Business Chat, it works across the LLM, M365 apps, and users’ data like calendars, emails, chats, files, meetings, and contacts to provide the best results for the given prompts within seconds.

Note: Copilot users with any Microsoft license, including business and enterprice users can access Copilot features seamlessly. However, for Business licenses, 300-seat limitation is applicable.

When a user gives prompts to Copilot, it analyzes the respective data in Microsoft Graph and transfers the modified prompt to LLM. Once the LLM responds to the prompt, it will again be redirected to Microsoft Graph, and the final response will be given to Copilot and then to users. That’s how Copilot works behind the scenes. Let’s see how the Copilot processes the prompts given by users and how it responds back with better outcomes below.

Microsoft Copilot is integrated with M365 in two ways – One is Business Chat and the other is integration with M365 apps. This Microsoft 365 Copilot assists in your work and revolutionizes the way we work on a whole different level.

Business Chat (Microsoft 365 Chat) – It gives a whole new chat experience to users by working on all the users’ data right from calendars, emails, chats, meetings & contacts, and all M365 apps to excite us with the best insights generated from massive data.

Copilot for Word – Instead of starting from scratch, we will be offered the draft of creative content with simple prompt. As an author, we can control Copilot and make it rewrite, shorten the content, and ask for feedback by giving prompts. Also, we can edit the draft given by it and follow the manual process as well.

Copilot for Excel – Analyzing complex data trends and creating visualizations is no more difficult! With Copilot in hand, we will get professional-looking data visualizations in seconds based on various trends you want to incorporate in that.

Copilot for PowerPoint – With just a simple prompt, we can get amazing presentations that analyze and add content from any existing documents.

Copilot in Outlook – Right from drafting quick replies and summarizing long mail threads, to freeing up the inboxes quickly, Copilot is absolutely a go-to partner!

Copilot in Teams – No more concerns about taking key points during meetings, recalling who said what, tracking agreements & disagreements, and more, when Copilot is with us. Also, it suggests recommended actions in real-time to enhance the meeting experience and keep us updated on all things at any time.

Copilot in Power Platform – Building an app with exceptional ideas is always difficult and takes time to make it work as expected. But with Copilot at our fingertips, we can transform our creative ideas into building an app in minutes, automate tasks, and create chatbots.

Copilot in Windows – Microsoft Cortona in Windows 11 is deprecated to favour Microsoft 365 Copilot. Cortona did provide basic assistance and voice control, but Copilot does much more and makes complicated tasks simple! Being available on the taskbar, it seamlessly assists with all the apps we use at work, school, or home. Also, it analyzes our current active tab or window to provide interesting outcomes. Thus, we can complete tasks on time without much burden.

Copilot in Microsoft 365 Mobile App – Microsoft also brings Copilot to the Microsoft 365 mobile app for Android and iOS for individuals having Microsoft account. It will begin rolling out from next month from which you can easily access and export the content you create using Copilot to a Word or PDF document.

Bing Chat Enterprise – Bing Chat Enterprise is an AI- powered chat for work at no additional cost, which helps to analyze immensely, write creatively, and do more than expected.

Even though certain customers are excited to use Copilot in their businesses, many are not, as they have concerns about their data privacy and security. It is true that

Data is the pollution problem of the information age, and protecting privacy is an environmental challenge.

– Bruce Schneier

A responsible security admin, IT admin, or anyone who wants to protect their organization’s data should think again and again before trusting and integrating a new technology into the organization’s resources. While thinking about enabling Microsoft Copilot, there are plenty of questions looping in the mind. It starts at,

• Is installing and enabling Microsoft Copilot safe?
• Can I implement MFA in Microsoft 365 Copilot for added security?
• As it has access to all the data, does it introduce any unwanted risks?
• Does Microsoft Copilot share my data with third parties?
• How does the access restriction of a user work to prevent unauthorized access to data?
• How can I ensure that my data is encrypted and stored securely?
• Are there any specific security certifications or standards that Copilot adheres to?
• Does Copilot violate the organization’s privacy and security policies and rules?
• While communicating with an AI chat assistant, does it store the prompts and responses?
• How much does it cost, and is it really worthy subscribing?
• As it reads browser tab and window, does it store browsing history or tab data?
• How does Microsoft 365 Copilot handle the privacy of user data, and what data is collected and stored?

The above-listed questions are only a few! But there might be many questions that loop in our mind. Since how much we secure the data, there is someone out there to pull it off. So, these are the concerns for which some organizations have a fear of using Microsoft Copilot.

Microsoft addresses the customer’s concerns and promises that it will continue to protect users’ data as it has for years. Also, it uses AI to secure our data and introduces Microsoft Security Copilot early access program, a cybersecurity AI. Let’s explore how it secures user data.

• In Bing Chat Enterprise, the prompts and responses given by users aren’t logged. And Microsoft doesn’t use them to train their large language model (LLM).
• Microsoft continues to maintain enterprise-grade security, privacy, compliance, and responsible AI in Microsoft 365 Copilot.
• When analyzing and accessing data upon receiving prompts from a user, Copilot will access only the data to which the user has access. It works the same as the MS access restrictions to ensure that the unauthorized data won’t be accessed.
• Microsoft 365 Copilot is compliant with the regulatory compliance including GDPR and EU Data Boundary.
• The data encrypted by Microsoft Purview Information Protection won’t be accessed by Copilot unless the user has at least View permission.
• Microsoft Security Copilot, a natural language security analysis tool helps security analysts to quickly respond to threats, processes signals at machine speed, and analyzes risk exposure within minutes.
• It enhances security by detecting vulnerabilities, prioritizing risks, and providing recommendations to remediate and prevent harmful threats.
• The customizable report provided by Security Copilot after gathering all the activities, threats, and incidents is all a security professional craves for.

Note: As MS does all the things to secure the data from threats when using Copilot, there is no information available regarding additional authentication or security requirements.

There are many things besides these few points listed above. Like humans, AI might also be wrong sometimes. So, to minimize the errors, it is better to follow the prompting guide. When it comes to pricing concerns, Microsoft Copilot for business and enterprise customers at $30 per user per month and it is generally available from now. MS hasn’t revealed the Microsoft Security Copilot pricing yet and states that it will be revealed soon. However, customers don’t need to worry. If you don’t want to purchase the Security Copilot once it becomes generally available, MS won’t store or use your data and it will be purged according to their data retention policy.

Final Thoughts

We must accept the fact that technology trust is a good thing, but control over it matters. I hope this blog helps admins understand how this AI feature works and secures their organization’s data. We wanted to hear your concerns and feedback on using Microsoft Copilot and Security Copilot. If you have any, drop them in the comments section. Happy defending!