Governance Traps for Copilot Data

Quick Answer: The costliest AB-900 mistakes confuse adoption dashboards with compliance tools, assume Copilot creates new access, or deploy AI before fixing SharePoint oversharing. Successful governance combines permissions, labels, DLP, audit, retention, and acceptable-use policies.

Why a Traps Section Belongs on AB-900

The Data Protection and Governance domain is not only about naming Purview features — it tests whether you can pick the right control for the scenario. Microsoft writes distractors that sound authoritative: "Copilot uses a privileged indexer", "disable audit to save costs", "Viva Insights catches DLP violations." This section consolidates the wrong-turn patterns that appear across practice questions and the official skills outline.

Trap 1: Copilot Creates New Access

Myth: Deploying Copilot gives the AI a super-user account that can read any SharePoint site.

Reality: Copilot operates in the signed-in user's context via Microsoft Graph. If a user cannot open a file in SharePoint, Copilot cannot summarize it. The danger is the opposite — users already have excessive access through oversharing, and Copilot makes confidential content easier to find through natural language.

Exam-safe response: Remediate permissions and apply sensitivity labels before rollout.

Trap 2: Viva Insights vs Purview Compliance Tools

When a question asks where compliance officers investigate policy violations in prompts, AI Hub or Communication Compliance — never Viva Insights.

Trap 3: Web Grounding vs Internal Grounding

The web grounding toggle in Copilot admin settings controls whether Copilot may query Bing and public web content to supplement answers. Regulated industries often disable web grounding so responses stay within governed organizational data.

Trap answers confuse web grounding with:

• SharePoint semantic indexing (internal).
• Third-party plugins (Integrated apps).
• On-premises file server access (Graph connectors).

Know the specific toggle's scope: public web enrichment, not internal permission model.

Trap 4: Audit Logging Disabled for "Privacy"

Some scenarios suggest turning off audit to reduce storage costs or "protect employee privacy." AB-900 aligns with compliance-first administration:

• Disabling audit blinds investigators during incidents.
• Prompt logging in Purview Audit is how organizations meet regulatory evidence requirements.
• Privacy is handled through role-based access to audit data and data minimization — not by skipping logging entirely.

Prefer Audit (Premium) when Copilot forensic events and one-year retention are required.

Trap 5: Restricted SharePoint Search as Permanent Fix

Restricted SharePoint Search limits Copilot and org-wide search to an allow list of sites. It is a short-term bridge during permission cleanup — not a mature governance program. Permanent reliance is a trap; the correct long-term fix is Data Access Governance remediation plus labels and DLP.

Trap 6: Single-Tool Governance

No single Purview feature secures Copilot. High-performing tenants layer:

AB-900 readiness checklist items explicitly include Entra configuration, SharePoint oversharing remediation, licensing, and governance policy setup — not licensing alone.

Trap 7: Training Data and Tenant Boundaries

Myth: Customer Copilot prompts train the public GPT model for other companies.

Reality: Microsoft documents that customer data stays within the Microsoft 365 service boundary and is not used to train foundation models for other tenants. Copilot may use tenant data to ground responses for that tenant's users via the semantic index — not to improve global models.

This distinction supports privacy reviews and Responsible AI talking points leadership expects administrators to know.

Trap 8: Confusing Admin Roles

Assign Copilot Administrator for feature toggles; assign Compliance Administrator (or specialist roles) for Purview policies. Using Global Admin for everything violates least privilege — a tested Zero Trust principle.

Worked Scenario: Tool Selection Drill

Match each need to the tool:

1. "Leadership wants Copilot adoption rates by department." → Copilot Dashboard / Copilot Usage Report.
2. "Compliance must investigate harassing Copilot prompts." → Communication Compliance + AI Hub.
3. "Security needs forensic logs of prompts from a terminated employee." → Purview Audit (Premium) + eDiscovery.
4. "Admin wants to know which AI apps touch PCI data." → DSPM for AI.
5. "HR needs seven-year retention of Copilot chats." → Retention labels/policies.

If you can score five of five quickly, you are ready for the mixed-tool questions that close the AB-900 governance domain.

Pre-Deployment Readiness Checklist

Before broad Copilot enablement, AB-900 expects familiarity with this sequence:

1. Complete Microsoft 365 cloud migration for core workloads.
2. Remediate SharePoint oversharing using Data Access Governance reports.
3. Publish sensitivity labels and targeted auto-labeling.
4. Deploy DLP including the Microsoft 365 Copilot location.
5. Enable Audit (Premium) and configure retention for interaction data.
6. Establish acceptable use and prompt governance guidelines.
7. Assign Copilot licenses and pilot with a controlled group.
8. Monitor with DSPM for AI and AI Hub.

Skipping governance steps is the wrong answer every time.

Study Checklist

• Refute the "Copilot super-user access" myth with Graph permissions.
• Map adoption vs compliance tools to the correct admin question.
• Explain web grounding scope.
• Articulate customer data boundary and training claims.