Module 19: Admin, Security, Privacy, and Governance
Lesson 19.1: Copilot Security and Privacy in Plain English
Lesson Promise
Explain what Copilot can access, how data is protected, and what users still must verify.
Real-World Scenario
An executive asks whether Copilot uses company prompts to train public AI models and whether it can expose private files.
Core Concept
Microsoft says Microsoft 365 Copilot operates within the Microsoft 365 service boundary and uses data the signed-in user is permitted to access.
Prompts, responses, and Microsoft Graph data accessed by Microsoft 365 Copilot are not used to train foundation LLMs used by Microsoft 365 Copilot.
Security still depends on identity, permissions, data governance, labels, policies, user behavior, and review discipline.
Step-By-Step Workflow
- Explain the user-permission boundary.
- Explain that generated content still needs human review.
- Identify sensitive data types and approved use cases.
- Check tenant privacy, web search, connected experiences, and compliance settings.
- Train users to verify sources and avoid oversharing prompts.
- Escalate regulated questions to legal, security, or compliance owners.
Prompt Lab
Bad Prompt
Is Copilot safe?
Better Prompt
Explain Copilot privacy and data access for our staff in plain English, including what it can access and what users must still review.
Expert Prompt
Create a plain-English Copilot security and privacy briefing. Include data access boundaries, training-data claims, Microsoft 365 service boundary, permissions, prompts and responses, source review, sensitive-data rules, user responsibilities, and questions to ask IT or compliance.
Hands-On Exercise
Draft a one-page Copilot privacy briefing for nontechnical users.
Deliverable
A plain-English Copilot security and privacy explainer.
Governance Review Checklist
Common Mistakes
- Assuming Copilot can see everything in the tenant instead of respecting user access boundaries.
- Buying licenses before cleaning up high-risk sharing and ownerless content.
- Ignoring sensitivity labels, retention, audit, DLP, and Purview workflows.
- Treating agent approval as a one-time app decision instead of lifecycle governance.
- Training users on prompts without training them on sources, privacy, and review.
Quiz / Checkpoint
What is the most important access principle for Microsoft 365 Copilot?
It surfaces organizational data based on the signed-in user's permissions and existing Microsoft 365 controls.
Official Sources To Verify
Want your AI product explained to a large AI-native audience?
Kingy AI helps AI companies turn complex products into clear, useful YouTube videos that drive awareness, product understanding, demos, clicks, and search visibility.
