Join me exploring Microsoft Copilot through each letter of the alphabet. (Well, we’ve got to start somewhere!) 

D is for Data. What data can Copilot actually ‘see’? And how does that work? 

(To clarify, I’m talking about the paid Microsoft Copilot licence here, not the free M365 Copilot Chat.) 

If you have a paid Microsoft Copilot licence, Copilot can do some really handy things like extract information from transcripts of meetings you’ve attended, and work with you on documents while you are creating them. It’s the most useful AI in a work context exactly because it has all your work context! 

Have you ever wondered just how much information Copilot can ‘see’? And what is happening behind the scenes when Copilot is accessing all this data?  

Come learn with me! 

What data can Microsoft Copilot ‘see’? 

In a nutshell – Copilot can ‘see’ everything you can. It’s basically an extension of you having access to all your own data, just all at the same time. That means: 

• Transcripts of meetings you attend (as long as you transcribed them!) 
• Documents that you have access to 
• Emails you send and receive 
• Your calendar information 

By the same token, Copilot can’t see anything you can’t. If you can see that there is a document sitting in a folder, but you don’t have access to the file, Copilot can’t read it either. 

You can see Microsoft’s in-depth explanations here: https://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-privacy 

How does Microsoft Copilot access all this data? 

Copilot uses Microsoft Graph to connect the dots on all your work ‘stuff’; it threads together your emails, files, meetings, Teams chats and more to help Copilot generate very specific and personalised responses to your prompts. 

For example, one of my favourite Copilot prompts that I use is: “Summarise my week in the style of a comedy roast.”

Microsoft Graph can connect together all my email, Teams chat, meeting, and document activity to give me a really specific, highly personalised, and so-true-it-hurts response: 

Here’s the risk with Microsoft Graph being able to connect all these dots; if you have access to a folder you shouldn’t (perhaps because of an old link or an over-shared Team), Copilot will find it. And if your sensitive data is sitting in a spot with loose permissions? It’s now just one prompt away from being seen by a colleague who didn’t even know it existed.

I decided to put this to the test. 

I have access to the company’s budget spreadsheet. It has people’s salary information in it. (I’m supposed to have this access as part of my role, this isn’t me exposing a data loophole in my own company.) 

The document itself lives in ‘Shared’ in a private Teams Channel that is access-restricted to senior leadership. 

First of all, I asked Microsoft Copilot if it could give me salary information on a colleague. (Essentially asking for data that I know I already have). It looks as though Copilot has some built-in compliance blockers for this kind of question: 

I’m really glad you asked, Lyndsay — budgeting details can be tricky to navigate.
However, I can’t look up or share an individual colleague’s salary, even if it’s mentioned in a file. Salary information is considered confidential, and sharing it without proper authorization could create privacy or workplace‑trust issues.

So even though I have access to the file, Copilot wouldn’t give me this answer. Interesting. (And comforting!)

An experiment

Our marketing analyst has a Microsoft Copilot licence. I borrowed it to see if I would be able to ‘see’ the budget file via Copilot, and get answers to questions about the file, like how much money was allocated in the Marketing budget.

First, we asked Copilot to look at the Budget 2026 document and tell us how much money was allocated to Advertising and Marketing. We used the exact file name. We also told it the exact name of the Team and Channel that the file lived in. But Copilot had no luck finding it. (Excuse the dark mode screen shots here…) 

So far so good.

Next, I created a link to the folder that the file was in. Bear in mind that the folder was in a Private Teams channel that only myself and a couple of other people had access to. 

As soon as we gave Copilot the link to the folder, it was able to find and summarise the information about the monthly and yearly budget allocation figures to marketing spend. 

Naively I had expected the access settings on the Teams channel to override any folder sharing, but this was not the case.  Even though the folder lived in a private Teams channel, because I’d used a sharing link to the folder, my marketing colleague now had access to the file and her Copilot could look at the contents. 

It’s not that easy to see who has access to what unless you know where to look. You have to hit the good old 3 dots and choose ‘manage’ access:

Then you can see exactly who’s got what access; 

You can also rescind access from any links you’ve previously sent so that they stop working. 

The moral of this story is; document access is really important! 

The ‘magic’ of Copilot doesn’t bypass security; it just highlights where your security might be a bit… ‘leaky’ because of old sharing links.

Another note on data… 

It’s pretty obvious to think of chats, emails and documents as data, but let’s not forget that the prompts you put into Copilot are also ‘data’. It’s not only you who has access to this… 

Admins in your organisation can see a record of your prompts. Admins have to admin, so they need access to pretty much everything for compliance and troubleshooting.

I mentioned this in my previous ‘be careful’ blog, but it’s a good idea to be mindful of what you’re putting into Copilot as well as being mindful of what you get out of it. Just saying… 

Next time, let’s see what E is for…