Microsoft Copilot safety depends on tenant governance, not platform defaults

At a glance

What this is: NHI Mgmt Group's analysis, drawing on WitnessAI's blog post: Microsoft 365 Copilot risk is governed primarily by tenant state, not platform defaults, and overshared data plus delegated access create the main exposure path.

Why it matters: IAM, PAM, and AI security teams need to treat Copilot as a governance problem because its reach is bounded by permissions, labels, and runtime controls already in the tenant.

Context

Microsoft 365 Copilot changes the risk profile of enterprise search because it can retrieve content that users are already authorised to see, even when that content should not be easy to rediscover through natural language prompts. The security problem is not model failure alone, but the combination of inherited permissions, stale access, and AI retrieval across files, mail, chats, and agents.

For identity and governance teams, this creates a control boundary that sits between tenant configuration and AI runtime enforcement. Enterprise responsibility shifts from approving a tool to managing who and what can reach sensitive content, how that access is reviewed, and how delegated actions are constrained at scale.

Key questions

Q: What breaks when Microsoft 365 Copilot is enabled over overshared tenant data?

A: Over-shared content becomes searchable in ways the original permission model never anticipated. Copilot can surface files, chats, and mail that users were technically allowed to reach but never meant to rediscover at scale, which increases exposure, accelerates insider misuse, and turns old governance mistakes into active risk.

Q: Why do AI assistants need tenant governance before enterprise rollout?

A: Because the assistant inherits access from the tenant, not from a separate security universe. If the tenant has weak permission hygiene, missing labels, or unmanaged sharing, the assistant will faithfully reproduce that exposure through conversational search and delegated actions, which makes governance the primary control point.

Q: What are the signs that prompt injection controls are failing?

A: Warning signs include unexpected model behavior, responses that ignore system instructions, retrieval of irrelevant or sensitive data, and actions taken outside the intended workflow. If teams cannot trace which prompts, documents, or integrations influenced an output, they effectively lack visibility into the attack surface. That gap makes it hard to detect malicious instruction flow before it affects production systems.

Q: How should security teams govern AI agents that business users can create and customize across Microsoft 365?

A: Security teams should treat AI agents as a governed runtime, not just another user convenience. Start with visibility into creation, usage, and behavior, then apply controls based on risk, especially for agents that touch sensitive or regulated data. Regularly review permissions, content, and changes so agent sprawl does not become an unmanaged access path.

Technical breakdown

Why tenant permissions shape Copilot exposure

Microsoft 365 Copilot uses Microsoft Graph and tenant data to answer user prompts from content the user can already access. That means the assistant does not invent access, it operationalises whatever permission model already exists. If SharePoint inheritance is broken, group membership is too broad, or sensitivity labels are missing, Copilot can surface content that was technically authorised but operationally overexposed. The architectural issue is that retrieval systems amplify governance defects by making latent access discoverable in conversational form. This is especially important in large tenants where permissions have accumulated over years. Practical implication: reduce the reachable content set before broad Copilot rollout.

Practical implication: reduce the reachable content set before broad Copilot rollout.

How indirect prompt injection works in RAG-based assistants

Indirect prompt injection places malicious instructions inside content the assistant retrieves, such as emails, documents, or web pages. In a retrieval-augmented generation workflow, the assistant is designed to ingest context and respond to it, so the attack does not need code execution or a user click. The control failure is trust in retrieved content without strong separation between instruction, data, and policy. When the assistant can follow embedded directions, it may expose data, alter output behaviour, or relay information outside the tenant boundary. Practical implication: inspect retrieved content at runtime and constrain what context the model is allowed to treat as instruction.

Practical implication: inspect retrieved content at runtime and constrain what context the model is allowed to treat as instruction.

Why agent sprawl becomes an identity governance problem

Copilot Studio and similar tooling turn low-code automation into a population of semi-independent agents with delegated access to enterprise resources. Those agents are not just apps, and they are not fully autonomous either. They act through permissions, tools, and data scopes that often sit outside normal human joiner-mover-leaver processes. The architectural problem is inventory and lifecycle control: without a complete view of which agents exist, who owns them, and what they can touch, governance breaks down before security teams can review risk. Practical implication: govern agents as managed identities with lifecycle, ownership, and privilege boundaries.

Practical implication: govern agents as managed identities with lifecycle, ownership, and privilege boundaries.

Threat narrative

Attacker objective: The attacker wants Copilot to disclose authorised enterprise content from chats and files without needing phishing interaction or malware delivery.

1. Entry occurs when a crafted Markdown email is ingested by Microsoft 365 Copilot through normal content retrieval, without the user clicking anything.
2. Credential or context abuse follows when the assistant processes the malicious instructions and exposes prior chats and files it is already authorised to read.
3. Impact occurs when stolen content is forwarded to an attacker-controlled server, turning the assistant into a data exfiltration path.

Breaches seen in the wild

• EchoLeak (Microsoft 365 Copilot) 2025: A crafted email could make Microsoft 365 Copilot leak data from its context with no click, a zero-click prompt injection fixed as CVE-2025-32711.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Tenant governance is the real control plane for enterprise Copilot risk. Platform guarantees matter, but they do not neutralise stale permissions, broad sharing, or forgotten access paths inside the customer tenant. The practical boundary is no longer just model safety, it is whether enterprise data governance can keep pace with AI retrieval and delegation. Practitioners should treat tenant state as the first security dependency for Copilot deployment.

Overshared content becomes materially more dangerous once an AI assistant can search across it. Content that was merely hard to find in a traditional file model becomes trivially retrievable through conversational access, which changes the blast radius of historic misconfiguration. This is a governance failure mode, not a prompt engineering issue. The named concept here is retrieval amplification risk, where existing access defects become much easier to exploit through AI search.

AI agents widen the identity perimeter faster than most enterprises can inventory it. A growing agent population creates a lifecycle problem similar to machine identity sprawl, but with more variable behaviour and faster creation rates. Once agents can act on behalf of users, security teams need ownership, least privilege, and revocation paths that work at the same cadence as the agents themselves. The practitioner conclusion is simple: treat agent governance as an identity programme, not an AI pilot add-on.

Runtime enforcement is now part of the governance model, not an optional optimisation. Written policy cannot intercept prompt injection, redact sensitive content in context, or route a request to an approved model at the moment of action. That makes runtime visibility and control a prerequisite for defensible Copilot scale. The implication for identity and security leaders is to align access governance, content controls, and AI runtime inspection as one operating model.

The control gap is not simply privilege excess, but privilege that is invisible to the AI layer. Copilot can only respect the permissions it can see and enforce, which means shadowed data entitlements and unmanaged agents create hidden exposure even when the platform is correctly configured. This is where IAM, PAM, and AI governance intersect. Practitioners should focus on making effective access legible to both humans and machines.

What this signals

Retrieval amplification risk: enterprise copilots do not create bad permissions, but they make bad permissions much easier to exploit at scale. That changes the programme priority from simple enablement to permission hygiene, runtime inspection, and evidence-based rollout.

The most defensible deployment pattern is to align IAM, data governance, and AI monitoring before broad user access is granted. Without that alignment, the assistant becomes a discovery layer over decades of accumulated entitlement debt.

Copilot governance should be measured by what the assistant can actually reach, what it can be induced to reveal, and how quickly risky access can be revoked. Those are operational controls, not model claims.

For practitioners

• Remediate overshared tenant content first Run permission reviews on SharePoint, mail, and chat data before expanding Copilot usage, with special attention to broken inheritance and broad group access.
• Add runtime inspection for retrieved content Inspect prompts and retrieved context in real time so indirect prompt injection can be detected before the model acts on malicious instructions.
• Inventory and own all AI agents Create a complete agent register that records owner, permissions, connected tools, and revocation path for every Copilot Studio or similar agent.
• Separate policy, enforcement, and audit evidence Document which team sets AI usage policy, which team enforces runtime controls, and which team retains audit evidence for reviews and regulatory challenge.

Key takeaways

• Microsoft 365 Copilot risk is driven mainly by tenant permissions and data governance, not by platform defaults alone.
• Zero-click prompt injection shows that an AI assistant can become a data exposure path even when no user clicks and no malware is involved.
• The practical control response is staged permission remediation, runtime inspection, and explicit ownership of AI agents and audit evidence.

Key terms

• Retrieval-augmented Generation: Retrieval-augmented generation is a pattern where an AI model pulls external information before generating output. The security challenge is that access rules can weaken when data is chunked, embedded, cached, or reused, so source permissions may not automatically follow the content into the model's context.
• Prompt Injection (Agentic): An attack where malicious instructions are embedded in content that an AI agent reads, causing the agent to execute unintended actions using its own legitimate credentials. A primary vector for agent goal hijacking and identity abuse.
• Delegated Access: Delegated access is permission granted to one identity to act on behalf of another user, service, or system. In NHI environments, this usually appears in OAuth-connected apps and automation tooling. It is powerful, but it must be tightly scoped and reviewed because it can persist long after the original business need ends.
• Tenant Governance: The control set that determines how identities, permissions, labels, policies, and oversight operate inside a cloud tenant. For AI assistants, tenant governance defines the practical security boundary because the model can only operate within the access structure the organisation has already created.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, and workload identity in operational terms. It helps security and identity teams build the governance discipline needed for assistants, agents, and other non-human identities at scale.