Summary of "Microsoft 365 Copilotin tietoturvaa IT ammattilaisille -webinaaritallenne"

Summary of the Video

“Microsoft 365 Copilotin tietoturvaa IT ammattilaisille -webinaaritallenne”

Overview

This webinar recording focuses on the security, data protection, and risk management aspects of Microsoft 365 Copilot from the perspective of IT professionals, especially IT architects and security architects. The presenters discuss the architecture, data handling, compliance, logging, and practical controls available for safely deploying Copilot within organizations.

Key Technological Concepts and Product Features

Different Versions of Copilot
- Microsoft Consumer Copilot: Separate from enterprise, intended for consumer use with different terms and functionality.
- Microsoft 365 Copilot Chat (lighter version): Included in basic Microsoft 365 licenses (E1, E3, E5, Business Premium). It has limited features and is evolving to include some full Copilot features.
- Full Microsoft 365 Copilot: Paid add-on with advanced features like first-party agents, notebooks, Teams integration, and enhanced security functions.
Data Handling & Security Architecture
- Copilot operates within the Microsoft 365 tenant boundary; no new external storage locations are created.
- Uses a semantic index (AI vector search) to index tenant content for efficient retrieval without training language models on organizational data.
- Language models process data on-the-fly using RAG (Retrieval-Augmented Generation) techniques, grounding responses in tenant data without storing it externally or training on it.
- User prompts and responses remain within the tenant; data is protected under Microsoft Enterprise Data Protection commitments.
- Copilot can access all organizational data the user has read access to, including SharePoint, OneDrive, Exchange, Teams, and integrated third-party systems via Microsoft Graph.
Prompt Lifecycle and Logging
- Interaction metadata (prompts and responses) are logged separately:
  - Audit logs: Contain metadata about interactions but do not include the actual prompts and responses.
  - Prompts and responses: Stored in a hidden folder in Exchange Online mailbox for eDiscovery, inaccessible to users.
- Logs contain detailed info such as which apps were used (Teams, Word, etc.), referenced files, and their sensitivity labels.
- Audit logs retention: 6 months standard, extendable to 1 year with E5 license.
- Integration with Microsoft Sentinel and Defender Cloud Apps enables advanced monitoring and alerting.
Data Classification and Protection
- Copilot recognizes Microsoft 365 sensitivity labels and classifications on files and emails.
- Classification affects how Copilot processes data; classified content can trigger Data Loss Prevention (DLP) policies.
- DLP can block Copilot from processing confidential or secret information, providing error messages instead of results.
- Classification can be inherited and automatically elevated when referencing higher-classified content.
- Controls exist to restrict Copilot’s access to certain SharePoint sites or content temporarily (e.g., Restricted Content Discovery).
Risk Management and Overexposure
- Overexposure risks arise from broad sharing settings (e.g., “Everyone except external users”) and legacy permissions in large organizations.
- Tools used to assess and manage risks include:
  - Content Search and eDiscovery for sensitive info locations.
  - SharePoint site reports and Data Security Posture Management (DSPM) tools for oversharing analysis.
  - Access reviews and site owner collaboration for content lifecycle management.
- Emphasis on combining technical controls with organizational processes and people involvement.
Advanced Features and Future Outlook
- Preview of Researcher Agent using a virtual machine to interact with complex web services or internal systems.
- Support for third-party and custom agents, with responsibility on organizations to ensure compliance.
- Emerging capabilities to detect and alert on prompt injection or jailbreak attempts via Defender Cloud Apps and communication compliance.
- Integration with Microsoft Insider Risk Management to correlate risky behaviors involving Copilot usage, aiding investigations.
User and Organizational Considerations
- Users can delete their chat history, but admins can restore via retention policies.
- Organizations must define clear policies on who can access logs and eDiscovery data.
- Monitoring Copilot use is industry- and country-specific due to legal considerations (e.g., communication confidentiality in Finland).
- Encouragement to educate users on sensitive data handling and discourage use of consumer AI services for organizational data.

Guides, Tutorials, and Practical Advice

Practical walkthrough of Copilot’s data flow and security architecture.
Explanation of audit logs, prompt storage, and how to interpret them.
Recommendations for classification and DLP policy setup to control Copilot access.
Use of restricted content discovery to temporarily limit Copilot access during cleanup.
Combining Microsoft tools (content search, DSPM, access reviews) for managing data exposure.
Advice on organizational process integration: involving site owners, defining data lifecycle policies.
Monitoring and alerting using Defender Cloud Apps and communication compliance.
Upcoming webinars and training courses available for deeper learning on Copilot security and management.

Main Speakers / Sources

Arttu (CTO at Sulava): Focus on IT architecture, Copilot security, and technical fundamentals.
Tatu Seppälä (Security Architect): Focus on security architecture, risk management, Microsoft 365 Copilot implementation, and compliance.

Summary

This webinar provides a comprehensive technical and practical overview of Microsoft 365 Copilot’s security and data protection mechanisms tailored for IT professionals. It covers Copilot’s versions, data processing architecture, logging, classification, DLP controls, risk management strategies, and monitoring tools. The presenters emphasize combining technical controls with organizational processes and user education to mitigate risks. They also highlight ongoing developments, such as advanced agent capabilities and integration with Microsoft security tools for risk detection and compliance. Practical advice and upcoming training opportunities are offered for IT professionals seeking to implement Copilot securely in their organizations.