From the course: Microsoft Copilot Essentials by Microsoft Press

Data privacy, boundaries, and safe usage - Microsoft Copilot Tutorial

From the course: Microsoft Copilot Essentials by Microsoft Press

Data privacy, boundaries, and safe usage

“

Now, let's address the elephant in the room, data privacy. Your organization trusts you with sensitive information. Understanding Copilot's boundaries protects that trust and your reputation. Data privacy is the elephant in the room. Your organization trusts you with sensitive info, as I mentioned a moment ago. You need to know how Copilot handles that data. Here's the clear picture. First, prompts and responses are not used to train foundation models. This is Microsoft's commitment. What you type into Copilot and what it generates back do not get fed into model training. Your proprietary information stays proprietary. Furthermore, your data stays within your Microsoft 365 tenant boundary. When Copilot accesses your emails and documents through Graph, that data doesn't leave your tenant. The processing happens within Microsoft's enterprise infrastructure with the same protections as the rest of M365. Existing security, compliance, and privacy policies still apply. If your org has data loss prevention policies, retention rules, or compliance requirements, those don't disappear when you use Copilot. Those guardrails you already have still work. Sensitivity labels and access controls are still honored. If a document is labeled confidential or has restricted permissions, Copilot respects that. It won't suddenly expose sensitive content to people who shouldn't see it. Lastly, Copilot interactions can be logged for admin audit. Your IT admin can enable audit logging for Copilot usage. This means there's accountability. Prompts and responses can be retrieved, if needed, for compliance or investigation. Pro tip, Woodgrove Bank's compliance team reviewed Copilot's data handling before rollout and confirmed it met the regulatory requirements. The key? Copilot works within your existing security framework, not around it. Microsoft built the guardrails, but you're still the driver. Safe Copilot usage means knowing the boundaries and staying inside them. Know your organization's AI usage policy before diving in. Many organizations now have AI acceptable use policies. These define what's okay to use Copilot for and what's off-limits. Read yours, study it. If one doesn't exist, ask. You might help create it. Avoid pasting highly sensitive data like passwords, social security numbers, and regulated PII – personally identifiable information. Just because you can paste something into Copilot doesn't mean you should. passwords, SSNs, credit card numbers, health info. Keep these out of prompts unless your policy explicitly allows it. Web Search sends queries to Bing. Know when it's enabled. Copilot Chat can optionally search the web for current information. When this is on, search queries, not your documents. Go to Bing. Those queries are stripped of identifiers, but know when you're using web-grounded versus work-grounded features. Verify any copilot output before sharing externally. Before that e-mail goes to a client, before that report goes to the board, before that presentation goes to partners, verify. Check facts, confirm numbers, validate citations. Your reputation is on the line. When in doubt, check with IT or compliance. If you're unsure whether something is okay to use copilot for, ask. Your IT and compliance teams would rather answer questions than clean up incidents.

Contents