Microsoft 365 Copilot Security: What Entra ID, Sensitivity Labels, and XPIA Classifiers Cover

Microsoft's own framing of Copilot security is a permission-inheritance argument. The documentation states that "Microsoft Copilot presents only data that each individual can access using the same underlying controls for data access used in other Microsoft 365 services," and that the Semantic Index honors the user identity-based access boundary so grounding only reaches content the current user is authorized to see. I want to walk through the three mechanisms doing the work, then the class of request none of them evaluates.

TL;DR

• Copilot grounds only in content the requesting user already has at least view permission on, enforced through Entra authorization and the existing SharePoint, Exchange, and Teams permission models.
• Purview Information Protection encryption is honored at the usage-rights level, applied through sensitivity labels or Information Rights Management, and can exclude programmatic access to specific content.
• Jailbreak and cross-prompt injection (XPIA) classifiers analyze inputs and block high-risk prompts before model execution, though Microsoft notes these "may not be available in all Microsoft Copilot scenarios."
• Every one of those checks asks what the data is and who owns it. None asks whether this user should send this content to a model right now.

Permission inheritance is the whole security model

Copilot reaches organizational content through Microsoft Graph, and Microsoft is direct about the consequence: "Microsoft Copilot only surfaces organizational data to which individual users have at least view permissions. It's important that you're using the permission models available in Microsoft 365 services, such as SharePoint, to help ensure the right users or groups have the right access to the right content within your organization."

That sentence is the security model stated as a customer obligation. Logical isolation between tenants runs on Entra authorization and role-based access control. Inside a tenant, Copilot's blast radius equals the requesting user's existing effective permissions, computed across SharePoint sites, OneDrive, Exchange, Teams chats, and any shared channels extended to users outside the organization.

A SharePoint site that a 2019 migration left with a broad "everyone except external users" grant was, for six years, a folder nobody clicked into. Copilot turns it into a summarizable answer to a natural-language question. The permission was always wrong, and what Copilot changed is the discovery cost, from high to zero.

Microsoft Graph connectors extend the same rule outward: "data from Graph connectors can be returned in Microsoft Copilot responses if the user has permission to access that information."

What sensitivity labels enforce

Purview Information Protection sits underneath as the second layer. Microsoft states that "when you have data that's encrypted by Microsoft Purview Information Protection, Microsoft Copilot honors the usage rights granted to the user," with encryption applied either through sensitivity labels or through restricted permissions in Microsoft 365 apps using Information Rights Management.

One control is worth calling out specifically because it is the sharpest tool in this set. For content accessed through agents in Microsoft 365, encryption can exclude programmatic access, which limits the agent from accessing the content at all. Configuring usage rights to withhold programmatic access is the closest thing Copilot offers to an agent-scoped deny rule on a document class.

Sensitivity labels also flow into the audit record. Every entry in AccessedResources carries a SensitivityLabelId, which is what makes the Copilot audit trail useful for reconstructing whether a response was grounded in labeled material.

The injection classifiers and their stated limits

Microsoft runs jailbreak and cross-prompt injection classifiers that "analyze inputs to the Copilot service and help block high-risk prompts prior to model execution," alongside content harm filters for hate and fairness, sexual content, violence, and self-harm, plus protected-material detection for copyrighted text and licensed code. Copilot services have opted out of the Azure OpenAI abuse-monitoring human review.

Two qualifiers in Microsoft's own text deserve a line in any threat model. The classifiers "may not be available in all Microsoft Copilot scenarios," and protected-material detection carries the same caveat. Coverage varies by surface, so a control verified in BizChat is not automatically present in a Copilot Studio agent embedded in Teams.

The XPIA work is real and shows up in telemetry through the XPIADetected boolean per accessed resource. Indirect injection through grounding documents remains the attack shape to plan around, which is the subject of indirect prompt injection defense and visible in the self-propagating prompt injection found in Word documents.

The request Copilot never evaluates

Take a compliance analyst with legitimate access to a labeled folder of customer contracts. They ask Copilot to summarize five of them and paste the summary into a message to an external partner. Entra authorized the user. The Semantic Index confirmed view permission on each file. Sensitivity labels granted the usage rights their role holds. The XPIA classifier found no injected instruction. The audit record notes five files, five label IDs, one model provider.

Every control fired correctly and the outcome is a data-handling incident. The missing evaluation is not about the user's identity or the file's classification in isolation, but about the combination: this role, this data class, this destination, right now. No component on that path holds a policy that expresses the combination, so nothing blocks.

The second uncovered case is simpler and larger, because Copilot's controls govern Copilot and stop there. The same analyst opening a browser tab to an unmanaged consumer chatbot and pasting the same contract text is outside every mechanism above, which is why Microsoft prices that traffic as pay-as-you-go AIAppInteraction auditing dependent on network or browser DLP. Part of that gap is organizational, covered in building an employee Copilot usage policy, and part of it is technical, which policy alone leaves open.

What closing it requires

Enforcement has to happen on the request path, at the moment the prompt is assembled and before it reaches a model, and it has to evaluate the authenticated identity together with the classification of the content in the prompt against a versioned policy. That evaluation point also has to cover non-Microsoft endpoints, because the same user, the same data, and the same risk exist on every LLM the enterprise touches. The permission model and the label taxonomy are inputs to that decision rather than substitutes for it. The equivalent data-side controls are covered in Microsoft 365 Copilot DLP.

DeepInspect

This is exactly what DeepInspect does. DeepInspect is a stateless proxy that sits inline on HTTP AI traffic between authenticated users or agents and LLM endpoints, evaluating identity, role, and data classification on every request before the model sees it, whether the endpoint is Microsoft-hosted or something an engineering team stood up last month.

Entra ID keeps deciding who a person is and what they may open. Purview keeps labeling and encrypting content and keeps recording which labeled resources Copilot touched. DeepInspect adds the decision Microsoft's stack does not make, a per-request, identity-bound allow or block against a versioned policy, with a signed record of the decision that holds up in an audit. Book a technical deep dive at deepinspect.ai.