Only one of the two Copilots is inside your tenant

M365 Copilot answers from content the signed-in user already has access to. It does not grant new access, which means it does not create an exposure so much as reveal one that was already there.

The practical consequence is that a site shared with the whole organisation three years ago, which nobody browsed to, is now one question away from being summarised. Fixing that is permissions and labelling work, and Microsoft's own controls are the right tools for it.

The consumer Copilot, reached in a browser with a personal account, is not inside your tenant and not covered by your agreements. Neither is a personal ChatGPT or Claude session on the same laptop.

This is the same account-versus-domain problem that makes sanctioning by hostname unreliable: the domain looks familiar, the terms are not yours, and only the signed-in account distinguishes them.

Purview and the Microsoft 365 controls sit close to data inside the tenant, and they are the better answer there. Declining to compete with them is the honest position, and it is ours.

What they do not see is a prompt typed into a different product in a browser tab, or into a desktop AI app, on a device you manage. That is the gap a device-based control exists to close, and the two are complementary rather than alternatives.

Most guidance on this subject describes the chat box, and that stopped being the whole product some time ago.

Copilot now appears inside individual applications, as agents built in Copilot Studio that act on data with their own permissions, and through connectors that reach systems outside the tenant entirely. Each of those is a different data path with a different answer to the question of what it can read and on whose authority. An agent configured by somebody in finance, with access to a data source they can reach, is a decision made outside the security team by a person who did not think of it as one.

The practical step is to find out who can create agents and connectors in your tenant before deciding anything else, because that setting determines whether this is a governance question or an inventory problem. It is frequently more permissive than people expect.

Microsoft Purview is a capable tool and it is usually the first answer offered to this question, so it is worth being precise about its edges.

Purview classifies and labels content at rest and in transit inside the tenant, and Copilot honours those labels: a document a user cannot open is a document Copilot will not answer from, and a label can restrict what happens to the output. That covers the tenant. It does not cover the sentence a person types into the composer, because that sentence is not a labelled artefact and never was. Somebody pasting a block of patient notes copied out of a clinical system into a Copilot prompt is pasting unlabelled text that originated outside the tenant entirely.

The second edge is the one that catches people. Purview governs your tenant, and an employee signed into a personal Microsoft account, or into ChatGPT in the next browser tab, is outside it. The control boundary is the tenant, and the behaviour you are worried about does not respect that boundary. We do not replace Purview and would not suggest running without it; the two are pointed at different things.

Copilot makes existing permissions legible, and legible is the part organisations are not ready for. The work that prevents the embarrassing week is ordinary tenant hygiene, done before the licence count goes up.

The specific things worth checking are the sites shared with "Everyone except external users", which is the default that turned a decade of internal sites into an open shelf; OneDrive folders shared with organisation-wide links; mailboxes and shared mailboxes with delegated access nobody remembers granting; and SharePoint sites whose owners have left. Microsoft ships reporting for most of this, and the output is usually larger than expected.

Pilot with a group whose data is not sensitive, and read what Copilot surfaces rather than only whether people liked it. The useful question after two weeks is not "did it save time" but "did it cite anything it should not have been able to reach". That is a finding you want from twenty people rather than from two thousand.