Copilot for Microsoft 365 – Our tips for using the AI assistant

The social networks are filled with posts about Copilot. Setting up Microsoft's AI helper for the M365 Enterprise Apps is easy. All you need is a Microsoft 365 license (E3/E5, A3/A5, Business or Standard) and the additional Copilot license and you can start using Copilot in a protected environment. However, Microsoft points out the following in its Copilot Privacy:

“Microsoft Copilot for Microsoft 365 only displays organizational data for which individual users have at least viewing permissions. It is important that you use the permission models available in Microsoft 365 services such as SharePoint to ensure that the right users or groups have the right access to the right content in your organization.”

The Microsoft 365 Copilot can retrieve and process information from the Microsoft 365 tenant. Microsoft therefore obtains the information from the semantic data stored in appointments, documents, calendars and groups. The co-pilot user must have at least read access rights to this data. Microsoft also refers to authorization models that should be in place to protect against unauthorized access. The authorization models and concepts for cloud services such as M365 are diverse: data loss prevention (DLP), conditional access, zero trust, sensitivity labels, etc.

You should only activate Copilot in a production tenant once all these mechanisms are securely in place so that employees or external partners cannot access critical data. We have developed a series of workshops with which we work together with our customers to establish security and compliance in a Copilot project and thus meet the requirements of responsible AI.