Event details
StephenRice
Microsoft
MicrosoftHi Jade, oversharing is absolutely top of mind for us (in general, and for Copilot). Copilot can only find files that users already have access to (e.g. just creating a "people in my company" link doesn't expose it to people in Copilot unless they possess the link). Are there particular concerns beyond that that I can help with?
Hi, Stephen - thanks for your response. We are concerned about the scenario when:
- Jose conducts a search in OneDrive
- Jose selects a group of files in the search results in OneDrive
- Jose shares that set of search results with three people
- 1+ of those people, by the action of receiving the search results share, is now granted access to files that would not previously have had access to
- Any of those 1+ people can at any time further reshare those files to which they now have access
- StephenRiceThanks for expanding here Jade! Copilot will respect all policies that you've set, including the "Members Can Share" setting which can be used to prevent re-sharing. There's more that we're looking at here too but we're not quite ready to share just yet!
- Thanks for this information, Stephen. This risk will remain a priority for us to consider, and we would appreciate best practices / recommendations for settings in OneDrive at the admin / tenant level, to ensure the onus is not on the individual to know exactly how to share to avoid unintentional oversharing. Please add me to your list of people to notify when there is more information that you are ready to share on this and related security / governance / DLP topics related to OneDrive.