Microsoft 365 Copilot Data Q&A

Question:  I need to know if data entered and used in the $30 Copilot service in M365 is secured in the same way that data in the $0 M365 Copilot Chat. I cannot find a reference that explains this. I want to know if my users can use both without the risk of having our content exposed outside of our tenant.

 

Answer: Yes, both the $30 Microsoft 365 Copilot service and the $0 Microsoft 365 Copilot Chat offer the same level of data security and privacy protections. Both services are covered by the same enterprise data protection (EDP) controls and commitments under the Data Protection Addendum (DPA) and Product Terms. Your data is protected with encryption at rest and in transit. Also, Microsoft does not use your data to train foundation models.  In a nutshell, your data remains yours and yours alone. 

For additional references, see the following links:

https://learn.microsoft.com/en-us/copilot/privacy-and-protections

https://learn.microsoft.com/en-us/copilot/microsoft-365/enterprise-data-protection

https://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-privacy

 

 

Question: What encryption methods are used to secure my data for Microsoft 365 Copilot?

 

Answer: There are multiple encryption methods are used to secure your data:

1. Encryption at Rest: Data stored in Microsoft 365 is encrypted using BitLocker and Distributed Key Manager (DKM). This ensures that your data is protected even when it is not actively being used.
2. Encryption in Transit: Data transmitted between your device and Microsoft 365 services is encrypted using Transport Layer Security (TLS). This helps protect your data from interception during transmission.
3. Sensitivity Labels and Azure Rights Management: Microsoft Purview sensitivity labels and Azure Rights Management provide an extra layer of protection by applying encryption and access controls to your data. This ensures that only authorized users can access sensitive information.

For more information, visit https://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-architecture-data-protection-auditing

 

 

Question: What other security features does Microsoft 365 Copilot have?

 

Answer: Microsoft 365 Copilot has several security features for data protection:

1. Advanced Threat Protection: Microsoft 365 Copilot includes advanced threat protection to detect and mitigate potential security threats.  Features like Safe Links and Safe Attachments, help protect against phishing and malware attacks.
2. Data Loss Prevention (DLP): DLP policies help prevent sensitive information from being shared inappropriately. These policies can be customized.
3. Identity and Access Management: Microsoft 365 Copilot uses Azure Active Directory (Azure AD) for identity and access management. This includes features like multi-factor authentication (MFA), conditional access policies, and identity protection to help secure user accounts and control access to resources.
4. Compliance and Auditing: Microsoft 365 Copilot provides comprehensive compliance and auditing. Features like eDiscovery, audit logs, and compliance reports help organizations meet regulatory requirements and monitor user activity.
5. Information Protection: Microsoft Purview sensitivity labels and encryption provide an extra layer of protection for your data, applied to documents, emails, and other content.
6. Oversharing Controls: Microsoft 365 Copilot includes controls to prevent oversharing of data in SharePoint sites and OneDrive.

For more information, visit Microsoft 365 Copilot security documentation.