Skip to content

There’s no doubt that Copilot is a game-changer. This innovative AI assistant can help you work smarter, not harder, in Microsoft 365. But with any powerful tool, there are also some things to consider. Let’s dive into both the benefits and potential drawbacks of Copilot, so you can make the most of this exciting technology.

The most common concerns about Copilot

The following four points are the most common concerns.

1. Insider Threat:

A user may be able to access data that they shouldn’t be accessing. For example, a HR team with a folder full of payslips. If the security is not set up properly, an employee may be granted unauthorised access. It is essential that access rights are set up correctly, as Copilot can only access data that the user also has access to.

2. Data Exfiltration

Copilot might identify data a user doesn’t necessarily need to see. How can you stop this data from being stored or shared locally? This is a concern for the entire Microsoft 365 platform, not just Copilot. Organisations need to be aware of where their data is stored and who has access to it.

3. Threat Actors

While less likely, a hacked Copilot account could make it easier for attackers to steal your data.

4. Transcription

Copilot can transcribe meetings, which can be very helpful for meeting minutes and action items. However, this also means that everything that is said is stored and searchable. You can choose to turn off transcription, but you’ll miss out on the benefits of Copilot. It is therefore important for an organisation to develop a policy on this.

How do you address these concerns?

Here are some steps you can take to mitigate the risks of using Copilot:

  • Define sensitive data: Identify the crown jewels of your organisation’s data. Where is this sensitive data stored?
  • Data Sharing Policy: Craft a clear policy that governs how data is shared. Who can share what, with whom, and when?
  • Data Flow: Take control! Ensure you have oversight over how data moves within your organisation and beyond. Leverage Microsoft’s solutions to streamline this process.
  • Access to Data: Review data access permissions regularly. Make sure they are assigned appropriately based on job roles. Prevent new hires from inheriting permissions automatically; conduct a thorough evaluation before granting access.

Addressing Security Concerns

Microsoft understands that security is a top priority, and they’ve proactively addressed these concerns with a feature called “Restricted SharePoint Search“. This feature lets you keep certain confidential sites out of Copilot’s search results. It’s a great solution for organisations that are still finalising their data security measures or want to exclude specific sites, like HR, from Copilot’s search function.

In fact, this feature was inspired by feedback from large organisations that were early adopters of Copilot. They expressed hesitation about deploying Copilot due to concerns around user access to everything. While Restricted SharePoint Search isn’t a Copilot solution itself, it’s a SharePoint solution that speeds up Copilot adoption.

It’s important to remember that Copilot doesn’t create new data security issues; it exposes existing ones. Organisations might already have data access issues that Copilot simply brings to light.

Let’s Get Started Securely

The best approach to Copilot security is a two-pronged one that focuses on policy and user adoption. User adoption is key not just for Copilot, but for all Microsoft 365 tools. Equipping your employees with the knowledge to use these tools effectively is essential. The same goes for Copilot. You can start small with a pilot group and then rotate licenses throughout your organisation throughout the year to get a well-rounded view of how different departments find it useful.

We can also help you organise or attend Copilot workshops that specifically address security and governance concerns.

Adoption & Policy

Start with a focus on policy and user adoption.

  • Training: Provide your employees with comprehensive training on how to use Copilot’s features and functionalities effectively. This training should include information on how to access Copilot, how to use its various features, and best practices for getting the most out of the tool.
  • Start Small: Consider starting with a pilot program to gauge user interest and gather feedback before deploying Copilot to your entire organisation. This will allow you to identify any potential issues or challenges early on and make adjustments to your training and policy accordingly. Also, by rotating licenses throughout the organisation, you can get a wider range of perspectives and ensure that Copilot meets the needs of your diverse workforce.
  • Security and Governance Workshops: Attend or organise workshops specifically focused on the security and governance implications of using Copilot. These workshops can help your IT team understand how to configure Copilot to meet your organisation’s security requirements and data governance policies. Ekco can offer support with this if necessary, please reach out to your account manager if you wish to attend a copilot workshop.

By following these tips, you can help ensure a smooth and successful adoption of Microsoft Copilot for Microsoft 365 within your organisation.

Question?
Our specialists have the answer

Talk to us