Prevent oversharing with Co Pilot

Thanks for the question—this is a thoughtful one, and I can see why it’s top of mind.

For the licensed version of Microsoft 365 Copilot, Copilot is designed to respect existing file permissions. According to Microsoft documentation, Copilot "inherits permissions from Microsoft 365 services and only surfaces data that users are authorized to access" (source). So if content shows up in a Copilot response, it’s because the user already has access to that file through established Microsoft 365 permissions—it doesn’t change or override those settings.

You can read more about how this is handled here:
📄 Microsoft 365 Copilot Privacy, Security, and Data Residency
📄 Data Protection and Auditing in Microsoft 365 Copilot

If you're looking to reduce the risk of oversharing more broadly, Microsoft 365 offers tools that can support that effort, including:

• Sensitivity labels to help classify and protect files
• Data Loss Prevention (DLP) to help detect and prevent accidental sharing
• Access reviews and audit logs via Microsoft Purview for increased visibility

These tools don’t currently provide a way to notify a file owner when their content appears in a Copilot result, but they can help define and reinforce your organization’s information protection policies overall.

The ability to notify owners—without granting access—isn’t a current feature of Copilot. If it’s something you’d find helpful, you’re welcome to submit it to the product team via the Microsoft Feedback Portal. While there's no commitment to specific feature development, this is the best channel to share suggestions directly with the engineering team.

Let me know if you’d like help navigating any of the tools or docs mentioned above.

—Sarah (Community Manager)

Assuming you have an M365 Copilot license, it is an addon to the M365 subscription. It integrates with Security settings in M365 Copilot, and responses are based on the MS Graph within your security boundary. User information is returned according to their access permissions. I hope this helps.