Copilot guides

Microsoft 365 Copilot PDF guides

Full Markdown conversions of the two supplied PDFs, reviewed on 7 September 2026.

Each guide follows the PDF’s page order and retains its guidance, examples, outcomes, tables, diagram labels, and resource links. The blueprint includes the full E3 and E5 deployment checklists and their source entitlement markers. The architecture guide includes four Mermaid diagrams, detailed diagram transcriptions, the E3/E5 protection table, and the staged deployment table.

These are conversions of the supplied versions. Product names, licensing statements, indexing behavior, and other dated claims remain as the PDFs state them. Interpretation and source anomalies are recorded separately in Editorial notes.

Sources and link register · Verification and page coverage

The source PDFs, deployment-model collection, and earlier summaries are preserved.

Microsoft Copilot for Microsoft 365 architecture & deployment

Full Markdown conversion of the supplied PDF, reviewed on 7 September 2026. Source version: November 2023 (printed footer); PDF metadata dated March 14, 2024.

Original PDF · Conversion notes · Sources and links · Verification

This document preserves the source’s guidance as published. Page numbers correspond to the supplied PDF. Diagram descriptions and conversion notes are identified explicitly.

Contents

• Page 1 — Microsoft Copilot for Microsoft 365 architecture & deployment
• Page 2 — Microsoft Copilot for Microsoft 365 service and tenant logical architecture
• Page 3 — Semantic Index for Microsoft Copilot for Microsoft 365
• Page 4 — Microsoft Copilot for Microsoft 365 query flow
• Page 5 — Prepare your environment for Microsoft Copilot for Microsoft 365
• Page 6 — Set up secure file sharing and collaboration with Microsoft Teams
• Page 7 — Pilot and deploy Microsoft Copilot for Microsoft 365

Page 1 — Microsoft Copilot for Microsoft 365 architecture & deployment

Source: PDF page 1

Source topic marker: This topic is 1 of 7.

Copilot combines the power of large language models (LLMs) with your data in the Microsoft Graph — your calendar, emails, chats, documents, meetings, and more — and the Microsoft 365 apps to provide a powerful productivity tool.

Microsoft Copilot for Microsoft 365 logical architecture

Microsoft Copilot for Microsoft 365 or Copilot introduces several components to help users make use of content and data they already have access to. Note that only data a user has access to is returned in query responses (as illustrated).

Diagram transcription — layers and labels

Diagram transcription — relationships. A purple path connects the user through an app and Copilot to Microsoft Graph, with a branch to Semantic Index for Copilot. It continues to selected organization-data objects. Purple outlines select one OneDrive file and its Recordings folder, a column containing two SharePoint team-site tiles, two group mailboxes, one user mailbox, and one conversation/group icon. Other objects remain unselected. These selections illustrate the permission-limited response described above; they are examples, not quotas.

flowchart TB
  U["Users and devices"] --- Apps["Microsoft 365 apps: Teams, Word, PowerPoint, Excel, Outlook"]
  Apps --- C["Copilot for Microsoft 365"]
  C --- G["Microsoft Graph"]
  G --- S["Semantic Index for Copilot"]
  G --- O["Organization data — selected accessible examples"]
  O --- OD["OneDrive: user folders and files; recordings"]
  O --- SP["SharePoint: communication sites; team sites"]
  O --- EX["Exchange Online: group and user mailboxes"]
  O --- TC["Teams Chat box: Viva Engage groups"]

Conversion note: the Mermaid diagram reproduces the layer relationships. The table and paragraph retain the labels and selection detail from the embedded illustrations.

Source footer: November 2023. © 2023 Microsoft Corporation. All rights reserved. To send feedback about this documentation, please write to us at CloudAdopt@microsoft.com.

Page 2 — Microsoft Copilot for Microsoft 365 service and tenant logical architecture

Source: PDF page 2

Source topic marker: This topic is 2 of 7.

Diagram transcription — containment, not a query sequence

The table preserves the full source labels. The Mermaid diagram shortens the Azure Open AI subscription label to keep the boundary readable.

flowchart TB
  U["Devices and users"]
  Apps["Apps on devices: Teams, Word, Outlook, PowerPoint, Excel"]
  subgraph Service["Microsoft 365 service — Microsoft 365 service boundary"]
    subgraph Tenant["Your Microsoft 365 tenant"]
      Graph["Microsoft Graph"]
      Index["Semantic Index for Copilot"]
      Data["Your customer data: Exchange mailboxes, OneDrive files, Microsoft Teams data, SharePoint files and lists"]
    end
    subgraph Components["Components of Copilot for Microsoft 365"]
      Copilot["Copilot for Microsoft 365"]
      subgraph Azure["Azure Open AI subscription"]
        LLM["Large Language Model (LLM)"]
      end
    end
  end

Your customer data stays within the Microsoft 365 service boundary. Your prompts, responses, and data in the Microsoft Graph is not used to train foundation LLMs that Copilot leverages. Your data is secured based on existing security, compliance, and privacy policies already deployed by your organization.

Your tenant sits inside the Microsoft 365 service boundary, where Microsoft’s commitment to security, compliance, data location, and privacy are upheld.

Copilot is a shared service just like many other services in Microsoft 365. Communication between your tenant and Copilot components is encrypted.

For more information, see Data, Privacy, and Security for Copilot for Microsoft 365.

Source footer: November 2023. © 2023 Microsoft Corporation. All rights reserved. To send feedback about this documentation, please write to us at CloudAdopt@microsoft.com.

Page 3 — Semantic Index for Microsoft Copilot for Microsoft 365

Source: PDF page 3

Source topic marker: This topic is 3 of 7.

The Semantic Index for Copilot is a separate index or map of your user and company data — identifying relationships and connections. It works with Copilot and the Microsoft Graph to create a sophisticated map of all data and content in your organization to enable Copilot to deliver personalized, relevant, and actionable responses. The Semantic Index is part of the Microsoft 365 service and is created automatically.

Semantic indexing vs keyword indexing

Semantic Index builds upon keyword matching, personalization, and social matching capabilities within Microsoft 365 by creating vectorized indices to enable conceptual understanding, which helps determine your intent and helps you find what organizational content you need.

Unlike a standard keyword index, vectors are stored multi-dimensional spaces where semantically similar data points are clustered together in the vector space, enabling Microsoft 365 to handle a much broader set of search queries beyond “exact match.”

Each dimension of a vector captures an aspect of semantic meaning of the data point being represented. This provides for fast and accurate search and retrieval of data based on vector distance or similarity. This means that instead of using traditional methods for querying based on exact matches or predefined criteria, the Semantic Index finds the most similar or relevant data based on the semantic or contextual meaning.

Diagram transcription. The Microsoft 365 service boundary contains Your Microsoft 365 tenant. The tenant contains Microsoft Graph, Semantic Index for Copilot, and Customer data (Files, mailboxes, chat data, videos, etc.). The data box lists SharePoint files, lists, . . .; Exchange mailboxes; and OneDrive files. Purple arrowheads connect Semantic Index in both directions with Microsoft Graph and with each of these three data sources; the Exchange and OneDrive paths share a branch.

flowchart TB
  subgraph Service["Microsoft 365 service — Microsoft 365 service boundary"]
    subgraph Tenant["Your Microsoft 365 tenant"]
      G["Microsoft Graph"] <--> S["Semantic Index for Copilot"]
      subgraph D["Customer data — Files, mailboxes, chat data, videos, etc."]
        SP["SharePoint files, lists, . . ."]
        EX["Exchange mailboxes"]
        OD["OneDrive files"]
      end
      S <--> SP
      S <--> EX
      S <--> OD
    end
  end

What is currently indexed

• Semantic Index indexes text-based files in SharePoint that are shared with two or more people.
• At the user level, Semantic Index indexes all email. It also indexes all text-based files in a user’s OneDrive that have been shared, interacted with (even just by the user), or commented on.
• Current supported file types include:
  • Word documents (doc/docx)
  • PowerPoint (pptx)
  • PDF
  • Web pages (html/aspx)
  • OneNote (one)
• Semantic Index leverages the Microsoft Graph to better correlate relationships and understand permissions.

Excluding SharePoint Online sites

You can exclude a SharePoint Online site from being indexed by both Microsoft Search and the Semantic Index (such as payroll data or financial information). Site administrators select this option within the Site Settings page.

Additional resources

• Video — Semantic Index for Copilot: Explained by Microsoft
• Training article — Examine how Copilot uses the Semantic Index (MS-012 Prepare your organization for Copilot for Microsoft 365)

Source footer: November 2023. © 2023 Microsoft Corporation. All rights reserved. To send feedback about this documentation, please write to us at CloudAdopt@microsoft.com.

Page 4 — Microsoft Copilot for Microsoft 365 query flow

Source: PDF page 4

Source topic marker: This topic is 4 of 7.

• User issues a prompt through an app.
• Copilot references the Microsoft Graph and the Semantic Index to perform grounding (providing additional content or context).

Copilot:

• References the LLM to produce the best response for the user.
• References the Microsoft Graph and the Semantic Index to perform grounding on this response.
• Returns this optimized response to the app using only data the user has access to.

Your prompts, responses, and data in the Microsoft Graph are not used for training the foundation LLM that Copilot uses.

Diagram transcription — flow and boundaries. Users/devices and app icons (Teams, Word, Outlook, PowerPoint, Excel) sit outside the Microsoft 365 service. The user-to-app arrow points toward the app; the app exchanges information with Copilot for Microsoft 365 inside the service. Copilot exchanges information with Microsoft Graph and Semantic Index for Copilot inside Your Microsoft 365 tenant, and with the Large Language Model (LLM) inside the Azure Open AI service subscription for Microsoft 365. The tenant’s Customer data box is labeled “Files, mailboxes, chat data, videos, etc.” and contains Exchange, OneDrive, Microsoft Teams, and SharePoint. Copilot and the Azure Open AI subscription are within the service boundary, alongside the tenant.

flowchart LR
  U["User and devices"] --> Apps["App: Teams, Word, Outlook, PowerPoint, Excel"]
  subgraph Service["Microsoft 365 service"]
    C["Copilot for Microsoft 365"]
    subgraph Tenant["Your Microsoft 365 tenant"]
      G["Microsoft Graph"]
      S["Semantic Index for Copilot"]
      D["Customer data: Exchange, OneDrive, Microsoft Teams, SharePoint — files, mailboxes, chat data, videos, etc."]
    end
    subgraph Azure["Azure Open AI subscription"]
      L["Large Language Model (LLM)"]
    end
    C <--> G
    C <--> S
    C <--> L
  end
  Apps <--> C

Conversion note: arrow paths are simplified; both grounding stages remain explicit in the source text above. The diagram’s shortened Azure Open AI subscription label refers to the full source label “Azure Open AI service subscription for Microsoft 365”.

Source footer: November 2023. © 2023 Microsoft Corporation. All rights reserved. To send feedback about this documentation, please write to us at CloudAdopt@microsoft.com.

Page 5 — Prepare your environment for Microsoft Copilot for Microsoft 365

Source: PDF page 5

Source topic marker: This topic is 5 of 7.

Security and information protection recommendations

Microsoft recommends building a foundation of secure productivity to get AI-ready, including Microsoft Copilot for Microsoft 365 or Copilot.

Diagram/icon transcription: the area column uses a user icon for Identity and access; Teams, Word, PowerPoint, Excel and Outlook icons for Microsoft 365 Apps; computer/mobile icons for Devices; a shield for Threat protection; and OneDrive, Exchange, SharePoint, file, mail and site icons for Organization data. These icons add no further policy settings.

Source footer: November 2023. © 2023 Microsoft Corporation. All rights reserved. To send feedback about this documentation, please write to us at CloudAdopt@microsoft.com.

Page 6 — Set up secure file sharing and collaboration with Microsoft Teams

Source: PDF page 6

Source topic marker: This topic is 6 of 7.

Configure Microsoft Teams with appropriate protection

Microsoft provides guidance for protecting your Teams at three different levels – baseline, sensitive, and highly sensitive. Guidance includes sensitivity labels and site sharing settings. Introducing Copilot is a good time to review your environment and ensure that appropriate protection is configured.

Diagram transcription — protection distribution

The original uses three adjacent bars of increasing width. It supplies no percentages.

1. First, identify Teams or projects that warrant highly sensitive protection. Configure protections for this level. Many organizations don’t have data that requires this level of protection.
2. Next, identify Teams or projects that warrant sensitive protection and apply this protection.
3. Finally, ensure all Teams and projects are configured for baseline protection, at a minimum.

Resources

• Set up secure file sharing and collaboration with Microsoft Teams
• Compare levels of protection
• Configure Teams with three tiers of protection

Configure external sharing with appropriate security

Introducing Copilot is a good time to review your policies for sharing files with people outside your organization and for allowing external contributors. Note that guest accounts are not licensed to use Copilot.

Sharing with people outside your organization

You may need to share information of any sensitivity with people outside your organization. Use these resources:

• Apply best practices for sharing files and folders with unauthenticated users
• Limit accidental exposure to files when sharing with people outside your organization
• Create a secure guest sharing environment

Collaborating with people outside your organization

Use these resources for setting up your environment for collaborating with people outside your organization:

• Collaborate on documents — share individual files or folders
• Collaborate on a site — collaborate with guests in a SharePoint site
• Collaborate as a team — collaborate with guests in a team
• Collaborate with external participants in a channel — collaborate with people outside the organization in a shared channel

Source footer: November 2023. © 2023 Microsoft Corporation. All rights reserved. To send feedback about this documentation, please write to us at CloudAdopt@microsoft.com.

Page 7 — Pilot and deploy Microsoft Copilot for Microsoft 365

Source: PDF page 7

Source topic marker: This topic is 7 of 7.

Onboard users to Microsoft Copilot for Microsoft 365

Microsoft recommends deploying Copilot as you phase in protections for access, devices, and data. Whether you’re starting with Microsoft 365 E3 or you’re taking next steps with Microsoft 365 E5, use the following sequence:

1. Apply identity and access protection.
2. Apply device protection.
3. Assign Copilot licenses to users with these protections.

Ongoing — Continue your deployment of information protection capabilities.

Begin by building a plan and then testing the plan. Then roll out new configurations and capabilities incrementally. This provides the opportunity to improve on the plan while lessons are learned.

The following diagram illustrates the recommendation to start a project with a small group to evaluate the changes. This small group can be members of your IT team or a partner team. Then, pilot the changes with a larger group. Full deployment is accomplished by gradually increasing the scope of the deployment until your whole organization is covered.

Diagram transcription — deployment ring. A ring shows Evaluate as its smallest segment, Pilot as a larger segment, and Full deployment as its largest segment. No numeric percentages are supplied. The sequence is Evaluate → Pilot → Full deployment.

Applying protections and deploying Copilot in parallel

Copilot — spans all three stages: Assign Copilot licenses to users AFTER their account and devices are protected.

Technical adoption of information protection

The source shows six staggered, overlapping bars beneath the Evaluate / Pilot / Full deployment columns. The bars progress downward and to the right; they do not specify dates, durations, or a hard gate requiring information protection to finish before Copilot deployment.

1. Discover and identify sensitive business data
2. Develop a classification and protection schema
3. Test and pilot the schema with data in Microsoft 365
4. Deploy the classification and protection schema to data across Microsoft 365
5. Extend the schema to data in other SaaS apps
6. Continue to discover and protect data in other repositories based on your priorities

Source footer: November 2023. © 2023 Microsoft Corporation. All rights reserved. To send feedback about this documentation, please write to us at CloudAdopt@microsoft.com.

Secure and Govern Microsoft 365 Copilot

Full Markdown conversion of the supplied PDF, reviewed on 7 September 2026. Source version: printed “Last updated March 6, 2026”.

Original PDF · Conversion notes · Sources and links · Verification

This document preserves the source’s guidance as published. Page numbers correspond to the supplied PDF. Diagram descriptions and conversion notes are identified explicitly.

Contents

• Page 1 — Secure and Govern Microsoft 365 Copilot
• Page 2 — Microsoft 365 Copilot is built on trust
• Page 3 — Microsoft 365 Copilot is built on trust
• Page 4 — Security & Governance
• Page 5 — Tools to secure and govern Microsoft 365 Copilot
• Page 6 — Problem summary
• Page 7 — Secure and Govern Microsoft 365 Copilot
• Page 8 — Remediate Oversharing
• Page 9 — Identify high-risk sites and content
• Page 10 — Apply interim Copilot protections
• Page 11 — Fix access and permissions
• Page 12 — Set up Guardrails
• Page 13 — Establish secure defaults
• Page 14 — Establish secure Guardrails
• Page 15 — Continuously Enforce & Optimize Guardrails
• Page 16 — Meet Regulations
• Page 17 — Identify and address gaps against AI Regulations
• Page 18 — Define regulatory requirements
• Page 19 — Improve data hygiene
• Page 20 — Secure & Governed Foundation for Microsoft 365 Copilot
• Page 21 — Secure & Governed Foundation for Microsoft 365 Copilot
• Page 22 — Thank you

Page 1 — Secure and Govern Microsoft 365 Copilot

Source: PDF page 1

Remediate Oversharing, enforce Guardrails, and meet AI Regulations

A Foundational Deployment Guidance

Page 2 — Microsoft 365 Copilot is built on trust

Source: PDF page 2

The central trust statement is flanked by these two panels:

Page 3 — Microsoft 365 Copilot is built on trust

Source: PDF page 3

Microsoft commitments and controls

• We secure your data at rest and in transit
• You control your data
• Your data is not used to train or enrich foundation models
• You’re protected against AI security and copyright risks

Read more at aka.ms/EDPLearn.

Page 4 — Security & Governance

Source: PDF page 4

Microsoft 365 Copilot + Microsoft Purview

A complete solution for enterprise-ready AI

Page 5 — Tools to secure and govern Microsoft 365 Copilot

Source: PDF page 5

Page 6 — Problem summary

Source: PDF page 6

Microsoft 365 Copilot builds on the data already in Microsoft 365, prompting organizations to strengthen oversharing, data loss, and insider risks practices to support safe, confident adoption.

If grounding data and Copilot interactions are not secured, it could lead to:

• Access to information beyond what the user needs for their role
• Unauthorized disclosure of confidential information
• Out of date or irrelevant responses

By addressing these risks, organizations can ensure that Microsoft 365 Copilot is secured end to end

Page 7 — Secure and Govern Microsoft 365 Copilot

Source: PDF page 7

Last updated March 6, 2026

Page 8 — Remediate Oversharing

Source: PDF page 8

Section divider in the source.

Page 9 — Identify high-risk sites and content

Source: PDF page 9

Workstream: Remediate Oversharing

Source navigation

1. Identify high-risk sites and content
2. Apply interim Copilot protections
3. Fix access and permissions

Actions

• [ ] Review Microsoft Purview Data Security Posture Management (DSPM) Data Risk Assessments to identify overshared sites with sensitive data, risky sharing links, and content that is frequently accessed

• [ ] Run the SharePoint Advanced Management (SAM) Content Management Assessment to identify sites with oversized audiences, EEEU usage, broken inheritance, inappropriate sharing, and those that are inactive or ownerless

Outcome: High-risk sites are prioritized and contained

Page 10 — Apply interim Copilot protections

Source: PDF page 10

Workstream: Remediate Oversharing

Source navigation

1. Identify high-risk sites and content
2. Apply interim Copilot protections
3. Fix access and permissions

Actions

Apply the following interim protections:

• [ ] Enable SAM Restricted Content Discovery (RCD) to exclude sensitive sites from Copilot discovery

• [ ] Configure Purview Data Loss Prevention (DLP) for Copilot to exclude sensitive content from Copilot grounding

Then:

• [ ] Validate via Purview audit and reports that Copilot no longer surfaces restricted content

Outcome: Copilot exposure is reduced immediately, even before full cleanup

Page 11 — Fix access and permissions

Source: PDF page 11

Workstream: Remediate Oversharing

Source navigation

1. Identify high-risk sites and content
2. Apply interim Copilot protections
3. Fix access and permissions

Actions

• [ ] Initiate SAM site access reviews for sites you identified as high-risk so site owners can manage the following down to the file level:

  • Remove excess users, groups, and company-wide sharing links (including EEEU)
  • Correct broken permission inheritance on libraries and folders
  • Assign or confirm site ownership for all remediated sites using SAM site lifecycle management

• [ ] Review Purview DSPM Data Risk Assessment recommendations for sites you flagged as high-risk and take the following actions:

  • [ ] Apply site sensitivity labels to change sites from public to private, enforce allowed sharing links, set default document labels, and more
  • [ ] Remediate sharing links that are too permissive

• [ ] Remove interim Copilot protections once access and permissions are remediated

Outcome: Foundation is set for durable Guardrails

Page 12 — Set up Guardrails

Source: PDF page 12

Section divider in the source.

Page 13 — Establish secure defaults

Source: PDF page 13

Workstream: Set up Guardrails

Source navigation

1. Establish secure defaults
2. Establish secure Guardrails
3. Continuously Enforce & Optimize Guardrails

Actions

• [ ] Enforce Restricted Access Control (RAC) by default for business-critical sites at provisioning time

• [ ] Disable or restrict use of Company-wide sharing groups and Sharing with Anyone link at the tenant level

• [ ] Use Purview Information Protection to Require site sensitivity labels at provisioning to enforce correct site privacy and sharing controls by default

Outcome: Guardrails are enforced by default, not manually remediated

Page 14 — Establish secure Guardrails

Source: PDF page 14

Workstream: Set up Guardrails

Source navigation

1. Establish secure defaults
2. Establish secure Guardrails
3. Continuously Enforce & Optimize Guardrails

Actions

Protect sensitive data and decide how it should be used with Copilot using Microsoft Purview:

• [ ] Configure auto-label and default sensitivity labels to ensure sensitive files and emails are protected

• [ ] Are there files or emails that shouldn’t be used by Copilot for grounding? If yes, setup Purview DLP for Copilot policies to restrict Copilot processing of files and emails with specific sensitivity labels

• [ ] Are there keywords or types of sensitive data that shouldn’t be processed by Copilot? If yes, enable a Purview DLP for Copilot prompts policy to restrict Copilot from responding to prompts containing specified sensitive information

  • [ ] Optionally, allow sensitive data to be used for Work IQ grounding but block from web grounding

• [ ] Enable Purview Insider Risk Management (IRM) policies to detect patterns of inappropriate or non-compliant Copilot usage and automatically add risky users to more restrictive security policies

Outcome: New content and sites are protected at creation

Page 15 — Continuously Enforce & Optimize Guardrails

Source: PDF page 15

Workstream: Set up Guardrails

Source navigation

1. Establish secure defaults
2. Establish secure Guardrails
3. Continuously Enforce & Optimize Guardrails

Actions

Use the following signals to create new or fine tune guardrails as Copilot use evolves:

• [ ] Use Purview DSPM Activity Explorer to review Copilot interactions, prompts and responses, web search keywords, and sensitive data activity

• [ ] Use Purview DSPM insights and Data Risk Assessments to monitor sensitive data use by Copilot and remediate new sources of oversharing

• [ ] Review Purview IRM and DLP alerts to detect and investigate risky AI use

Outcome: Copilot can scale safely without re-introducing Oversharing risk

Page 16 — Meet Regulations

Source: PDF page 16

Section divider in the source.

Page 17 — Identify and address gaps against AI Regulations

Source: PDF page 17

Workstream: Meet Regulations

Source navigation

1. Identify and address gaps against AI Regulations
2. Define regulatory requirements
3. Improve data hygiene

Actions

• [ ] Use Purview Compliance Manager to assess your tenant against checklists for 300+ continuously updated regulations, including AI regulatory requirements

• [ ] Review regulation specific improvement actions including those completed by Microsoft as the SaaS provider and actions your organization needs to complete as the data owner

• [ ] Assign and track your progress toward regulatory compliance using Compliance Score

Outcome: AI risks and regulatory gaps are identified and tracked

Page 18 — Define regulatory requirements

Source: PDF page 18

Workstream: Meet Regulations

Source navigation

1. Identify and address gaps against AI Regulations
2. Define regulatory requirements
3. Improve data hygiene

Actions

• [ ] Decide how long to keep Purview audit log activities in accordance with regulatory and internal requirements

• [ ] Decide how long to keep or when to delete Copilot interactions based on legal risk or regulatory requirements with Purview Data Lifecycle Management

• [ ] Use Purview eDiscovery to search, preserve, and produce Copilot-related content for audits or legal requests

Outcome: Copilot usage is auditable, enforceable, and defensible

Page 19 — Improve data hygiene

Source: PDF page 19

Workstream: Meet Regulations

Source navigation

1. Identify and address gaps against AI Regulations
2. Define regulatory requirements
3. Improve data hygiene

Actions

For Sites

• [ ] Maintain site lifecycle hygiene by identifying and addressing inactive or obsolete sites using SAM policies and reports

• [ ] Use Microsoft 365 Archive to store inactive but high-value content at a lower cost while preventing Copilot from processing or reasoning over it

For Files

• [ ] Apply Purview retention and deletion policies to remove inactive or obsolete files to improve the quality of Copilot responses

• [ ] Use Purview retention labels + Microsoft 365 Archive to exclude files from Copilot use while preserving them for recordkeeping obligations or discovery

Outcome: Higher-quality Copilot responses and a reduced Oversharing data surface

Page 20 — Secure & Governed Foundation for Microsoft 365 Copilot

Source: PDF page 20

Customers with E5 — Optimized

Realize value quickly with Copilot by remediating Oversharing, enforcing Guardrails, and meeting AI Regulations

Select deployment services are included in your FastTrack benefit. Other critical services are available thru Microsoft Unified or our Partner Ecosystem

Legend

The source uses superscript markers; these remain attached to each action below. “consumption” is retained where printed.

Deployment checklist

Remediate Oversharing

1. Identify high-risk sites and content

• Run SAM Content Management Assessment to identify sites with oversized audiences, EEEU usage, broken inheritance, inappropriate sharing, as well as sensitive content, identify sites that are inactive or ownerless¹
• Review Purview Data Security Posture Management (DSPM) Data Risk Assessments to identify sites with sensitive data and risky/sharing links accessible to Copilot³
• Prioritize remediation for sites and content that are high risk

2. Apply interim Copilot protections

• Enable SAM Restricted Content Discovery (RCD) to exclude sensitive sites from Copilot discovery¹
• Configure Purview Data Loss Prevention (DLP) for Copilot to exclude sensitive content from Copilot grounding³
• Validate via audit and reports that Copilot no longer surfaces restricted content

3. Fix access and permissions

• Initiate SAM site access reviews for sites flagged as high-risk so site owners can remediate down to the file level¹
• Review Purview DSPM Data Risk Assessment recommendations for sites flagged as high-risk and take remediation actions³
• Remove interim Copilot restrictions once site access and permissions are fully remediated.

Setup Guardrails

1. Establish secure defaults

• Enforce Restricted Access Control (RAC) by default for business-critical sites at provisioning time¹
• Disable or restrict use of Company-wide sharing groups and Sharing with Anyone link at the tenant level²
• Require site sensitivity labels at provisioning to enforce correct site privacy and sharing controls by default²

2. Establish secure Guardrails

• Configure default sensitivity labels to ensure new content is protected³
• Setup Purview DLP for Copilot policy to restrict Copilot processing of labeled sensitive contentc³
• Enable Purview DLP for Copilot prompt policy to restrict Copilot from responding to prompts containing sensitive information¹
• Enable Purview Insider Risk Management (IRM) policies to detect potentially inappropriate or non-compliant AI usage³

3. Continuously Enforce & Optimize Guardrails

• Use DSPM Activity Explorer to review Copilot interactions, prompts and responses, web search keywords, and sensitive data activity³
• Use DSPM Data Risk Assessments to continuously validate that sensitive data remains protected from Copilot access³
• Review Purview IRM and DLP alerts to detect and investigate risky AI usage or potential data loss³

Meet Regulations

1. Identify and address gaps against AI Regulations

• Use Purview Compliance Manager to assess your tenant against AI-related regulatory requirements and Microsoft recommended actions³
• Review improvement actions related to data protection, auditability, and AI usage controls³
• Assign and track remediation actions to close identified compliance gaps³
• Validate improvements using Purview DSPM reports³

2. Define Regulatory Requirements

• Decide how long to keep audit logs in accordance with regulatory and internal requirements^2,3
• Decide how to keep or when to delete Copilot interactions based on legal risk or regulatory requirements with Purview Data Lifecycle Management^2,3
• Use Purview eDiscovery to search, preserve, and produce Copilot-related content for audits or legal requests^2,3

3. Improve data hygiene

• For Sites
  • Maintain lifecycle hygiene by identifying and addressing inactive or obsolete sites using SAM policies and reports¹
  • Use Microsoft 365 Archive to store inactive but high-value content at a lower cost while preventing Copilot from processing or reasoning over it ^consumption
• For Files
  • Apply Purview retention and deletion policies to reduce data exposure while meeting record-keeping obligations^2,3
  • Use Purview retention labels + Microsoft 365 Archive to exclude files from Copilot use while preserving them for recordkeeping obligations or discovery ^{2, consumption}

Guidance assumes Copilot technical prerequisites in place: Technical enablement of core services (Teams, SharePoint, Exchange), Office Applications deployed (modern Outlook recommended) and on current or monthly update channel

Last updated March 6, 2026

Page 21 — Secure & Governed Foundation for Microsoft 365 Copilot

Source: PDF page 21

Customers with E3 — Foundational

Realize value quickly with Copilot by remediating Oversharing, enforcing Guardrails, and meeting Regulations

Select deployment services are included in your FastTrack benefit. Other critical services are available thru Microsoft Unified or our Partner Ecosystem

Legend

The source uses superscript markers; these remain attached to each action below. “consumption” is retained where printed.

Deployment checklist

Remediate Oversharing

1. Identify high-risk sites and content

• Run SAM Content Management Assessment to identify sites with oversized audiences, EEEU usage, broken inheritance, inappropriate sharing, as well as sensitive content, identify sites that are inactive or ownerless¹
• Use Purview Content Explorer to view which sites and files contain sensitive information types (SITs)²
• Prioritize remediation for sites and content that are high risk

3. Apply interim Copilot protections

• Enable SAM Restricted Content Discovery (RCD) to exclude sensitive sites from Copilot discovery¹
• Enable a Purview DLP for Copilot prompts policy to restrict Copilot from responding to prompts containing sensitive information¹
• Validate via audit and reports that Copilot no longer surfaces restricted content

2. Fix access and permissions

• Initiate SAM site access reviews for sites flagged as high-risk so site owners can remediate down to the file level:¹
• Remove interim Copilot restrictions once site access and permissions are fully remediated.

Setup Guardrails

1. Establish secure defaults

• Enforce Restricted Access Control (RAC) by default for business-critical sites at provisioning time¹
• Disable or restrict use of Company-wide sharing groups and Sharing with Anyone link at the tenant level²
• Require site sensitivity labels at provisioning to enforce correct site privacy and sharing controls by default²

2. Establish secure Guardrails

• Use site labels to limit access to org-wide sharing by marking sites as ’Private’ and giving access only to site members²
• Enable Purview DLP for Copilot prompt policy to restrict Copilot from responding to prompts containing sensitive information¹

3. Continuously Enforce & Optimize Guardrails

• Use DSPM Activity Explorer to review Copilot interactions and sensitive data activity²
• Review Purview DLP alerts to detect and investigate potential data loss²

Meet Regulations

1. Identify and address gaps against Regulations

• Use Purview Compliance Manager to assess your tenant against regulatory requirements and Microsoft recommended actions²
• Review improvement actions related to data protection, auditability, and AI usage controls²
• Assign and track remediation actions to close identified compliance gaps²

2. Define Regulatory Requirements

• Decide how long to keep audit logs in accordance with regulatory and internal requirements²
• Decide how to keep or when to delete Copilot interactions based on legal risk or regulatory requirements with Purview Data Lifecycle Management²
• Use Purview eDiscovery to search, preserve, and produce Copilot-related content for audits or legal requests²

3. Improve data hygiene

• For Sites
  • Maintain lifecycle hygiene by identifying and addressing inactive or obsolete sites using SAM policies and reports¹
  • Use Microsoft 365 Archive to store inactive but high-value content at a lower cost while preventing Copilot from processing or reasoning over it ^consumption
• For Files
  • Apply Purview retention and deletion policies to reduce data exposure while meeting record-keeping obligations²
  • Use Purview retention labels + Microsoft 365 Archive to exclude files from Copilot use while preserving them for recordkeeping obligations or discovery ^{2, consumption}

Guidance assumes Copilot technical prerequisites in place: Technical enablement of core services (Teams, SharePoint, Exchange), Office Applications deployed (modern Outlook recommended) and on current or monthly update channel

Last updated March 6, 2026

Page 22 — Thank you

Source: PDF page 22

Download this deployment guide at aka.ms/Copilot/SecureGovern.

Editorial notes

These notes describe the conversion and source anomalies. They are not part of Microsoft’s published guidance.

Version boundaries

• Blueprint: pages 7, 20 and 21 print “Last updated March 6, 2026.” Its filename ends in vMar24, but its PDF creation/modification metadata is March 19, 2026. The conversion identifies the printed date and retains the filename; it does not infer a March 2024 content version.
• Architecture: all seven pages print November 2023. PDF creation/modification metadata is March 14, 2024. Pages 2–4 are landscape, while pages 1 and 5–7 are portrait.
• This pass checks fidelity to these supplied PDFs. It does not refresh their licensing, availability, product terminology, indexing behavior, or regulatory claims against current documentation. “Current” within the architecture guide refers to the source version.

Blueprint details retained

The E3 and E5 checklists are separate full transcriptions. Details unique to either checklist remain in that checklist, including Content Explorer versus DSPM Data Risk Assessments, prompts policies versus labeled-content policies, the E5 validation action using DSPM reports, and the source’s technical prerequisites.

Architecture details retained

Representation choices

• Source page order, page/topic markers, visible titles and recurring architecture footers are retained. Extraction-only duplicate title text, overprinted glyph copies, and the hidden slide placeholder do not become duplicate reader-facing prose.
• Physical line wrapping is reflowed. Bullets/check boxes become Markdown lists; column and row associations become tables or labeled sections. The rotated “Deployment checklist” text on blueprint pages 20–21 becomes a normal heading.
• Brand marks are named where they carry meaning. Decorative slide backgrounds, shadows, colors, and repeated app artwork are not recreated. Original PDFs remain directly linked at every page.
• Mermaid diagrams express logical containment and connections. Prose/table transcriptions retain image labels, selected-object examples, shared branches, and rollout/protection proportions. The Graph’s illustrative network is described as a relationship map; its decorative mesh is not promoted into additional product architecture claims.
• Paragraphs explicitly labeled “Diagram transcription”, “Conversion note”, and “Source topic marker” explain the representation. They are editorial text, not quotations from Microsoft.

Sources and embedded links

Source files supplied by the user; conversion review date: 7 September 2026. The original PDFs are the authority for this conversion. No web content has been substituted for them.

Blueprint

Original PDF · Full Markdown guide

• Pages: 22
• SHA-256: 3338f24bc893715ac8e4448375794df88115943f492e4001ef9f0d80f2848109
• Extraction and raw annotation manifest
• Raw URI annotations: 4; distinct page/destination pairs: 2. Repeated annotations and multiple linked blocks can share one destination.

The guide places these destinations beside the relevant source text. External destinations are preserved, including their original query strings; network reachability and current article contents were not revalidated.

Architecture

Original PDF · Full Markdown guide

• Pages: 7
• SHA-256: 52a9d71352232bab96afb0399e99a35a7ed9af1be7193c0d46ca84989095d0a8
• Extraction and raw annotation manifest
• Raw URI annotations: 78; distinct page/destination pairs: 32. Repeated annotations and multiple linked blocks can share one destination.

The guide places these destinations beside the relevant source text. External destinations are preserved, including their original query strings; network reachability and current article contents were not revalidated.

Conversion verification

Reviewed on 7 September 2026 against the two supplied PDFs. The review covers 29 source pages, including title/divider pages, both blueprint checklists, all architecture diagrams, and all resource sections.

Results

The text comparisons remove punctuation, whitespace and case and compare the remaining letter/digit sequence. They detect missing or reordered words and entitlement digits in the specified regions; they do not prove punctuation fidelity, list nesting, or diagram meaning. Those were reviewed separately against the rendered PDFs. A whole-page token coverage check supplements the region comparisons; its explicitly excluded extraction artifacts are documented below.

Blueprint page coverage

Architecture page coverage

Each architecture page retains its topic marker and November 2023 copyright/feedback footer.

Extraction artifacts and review limits

• Overprinted duplicate glyphs in the Visio PDF were deduplicated before extraction comparisons.
• The extraction-only duplicate trust title on blueprint page 3 and hidden “Slide Title” placeholder on page 4 are excluded from reader-facing text. The visible trust title is retained.
• Rotated “Deployment checklist” lettering on blueprint pages 20–21 extracts as scattered single letters. It is retained as an ordinary heading instead.
• Text embedded in pictures, graphical containment, arrow directions, shared branches, selected objects, list nesting and qualitative proportions were checked visually. Their Markdown equivalents are described in the guides and editorial notes.
• This is a source-conversion review. Current product behavior, licensing and linked-webpage contents were not independently refreshed.

Evidence and reproducibility

Initial source manifests and rendered-page evidence retain per-page extracted text, word positions, PDF metadata, SHA-256 hashes, and raw URI annotation rectangles.

• Guide construction script
• Region and embedded-link verification
• Whole-page token coverage
• Markdown/Mermaid render results
• Local-link validation
• Delivered Markdown hashes