12.1 Impacts to Data, Security, Privacy, and Cost

The AB-731 skill Microsoft names here is Understand potential impacts to data, security, privacy, and cost when an organization adopts Microsoft AI apps. This independent OpenExamPrep chapter is for business decision-makers: you are not expected to write code, but you are expected to stop a rollout that would summarize an overshared personnel folder, send prompts to a consumer chatbot, or surprise finance with Azure meters.

Picture an operations vice president who pins Microsoft Copilot Chat for every Entra ID (formerly Azure Active Directory) user because Microsoft Learn documents that web-grounded Copilot Chat is included with an eligible Microsoft 365 subscription at no extra seat cost. Two weeks later, legal asks why Copilot drafted a project recap that quoted a Human Resources (HR) investigation memo. Security did not “open” that file to the company. A SharePoint site had used Everyone except external users (EEEU) years ago. Copilot honored that existing view permission and made the memo easy to retrieve. That is the data impact in one story: generative AI does not invent access; it amplifies discoverability.

Data impact: oversharing through Microsoft Graph

Microsoft Graph is the API fabric over Microsoft 365 content a signed-in user can already reach: mail, files, calendar, chats, meetings, and contacts. Microsoft’s privacy documentation for Copilot states that Copilot accesses content and context through Graph and only surfaces organizational data to which individual users have at least view permissions. Semantic Index, which helps ground answers in work content, honors the same identity-based access boundary.

The leadership trap is assuming “Copilot security” is a separate lock. It is not. If a file is shared too broadly, Copilot can ground an answer on it for anyone who already had access. Microsoft’s secure-foundation guidance for Copilot therefore starts with remediating oversharing, not with a model switch.

Microsoft Purview Data Security Posture Management (DSPM) for AI is built for this amplification problem. Learn documents that DSPM for AI automatically runs a weekly data risk assessment for the top 100 SharePoint sites based on usage, and that generative AI “amplifies the problem of oversharing” because it can proactively surface over-permissioned content. Leaders should ask compliance to show the latest weekly assessment, not a one-time cleanup slide.

Interim protections while owners fix permissions, from Microsoft’s Copilot foundation article:

• Enable SAM Restricted Content Discovery (RCD) so sensitive sites drop out of Copilot discovery.
• Configure Microsoft Purview data loss prevention (DLP) for Copilot so files and emails with specified sensitivity labels are excluded from Copilot grounding (using tenant data to answer).
• Optionally configure a DLP-for-Copilot prompts policy so Copilot does not respond when a prompt contains specified sensitive information types, and optionally allow Work IQ grounding while blocking web grounding for that data.
• Validate with Purview auditing that restricted content no longer appears in Copilot responses.

Restricted SharePoint Search can temporarily limit what search and Copilot see. Microsoft documents it as a short-term control, not a permanent architecture: after permissions are fixed, turn it off so answers again follow real SharePoint permissions.

Security impact: inherited controls, new blast radius

Microsoft’s Copilot security article describes a defense-in-depth approach on top of Microsoft 365 identity. Copilot is built on Entra authentication and Zero Trust ideas: verify identity, grant least privilege, and keep evaluating access. Copilot honors Microsoft Purview Information Protection usage rights, including encryption from sensitivity labels or Information Rights Management (IRM). If a label denies programmatic access, an agent may be blocked from that content.

Security leaders still own three Copilot-specific jobs:

1. Permission hygiene so Graph is not a megaphone for overshared sites.
2. Policy on what Copilot may ground on, using DLP, labels, Restricted Access Control (RAC) for business-critical sites, and agent allow/block lists in the Microsoft 365 admin center.
3. Visibility of unsanctioned AI, often called shadow AI: staff pasting contracts into consumer ChatGPT, Gemini, or unmanaged agents.

Microsoft now publishes two complementary dashboards. The Copilot security dashboard in the Microsoft 365 admin center (Copilot > Overview > Security) focuses on Copilot data protection, DLP, oversharing, and compliance. Global Reader can view it; AI Administrator can change settings. The Microsoft Security Dashboard for AI (preview, at ai.security.microsoft.com) aggregates Defender, Entra, and Purview signals across Microsoft Copilot, Copilot Studio agents, Microsoft Foundry apps and agents, third-party models (Microsoft names Google Gemini and OpenAI ChatGPT as examples), MCP servers, and unmanaged and shadow AI agents. Eligible Defender, Entra, and Purview customers can open it with existing product permissions; Microsoft documents no extra license for that dashboard access.

Endpoint DLP on onboarded Windows devices can warn or block users from sharing sensitive information with third-party generative AI sites in a browser (Microsoft’s example is pasting credit-card numbers into ChatGPT). That control is how a security lead addresses shadow AI that never appears on an Azure invoice.

Privacy impact: what is stored, where it is processed, what is not trained

Microsoft’s Data, Privacy, and Security article for Copilot is the source leaders should quote in an AI council memo:

• Copilot is documented as meeting existing Microsoft 365 commercial privacy, security, and compliance commitments, including the General Data Protection Regulation (GDPR) and the EU Data Boundary.
• Prompts, responses, and Graph-accessed data are not used to train foundation LLMs.
• Optional customer feedback may improve Copilot the way other Microsoft 365 feedback does; Microsoft says that feedback is not used to train those foundation LLMs, and admins can manage feedback.
• When a user works with Copilot in apps such as Word, PowerPoint, Excel, OneNote, Loop, or Whiteboard, Microsoft stores the content of interactions (prompt, response, citations) as Copilot activity history. That store is encrypted at rest, processed under the same contractual commitments as other Microsoft 365 content, and is not used to train foundation LLMs.
• Users can delete their Copilot activity history from the My Account portal. Admins use Content search, Purview, and (for Teams Copilot chats) Teams Export APIs.

Retention is a privacy and legal impact. Purview retention for Copilot and AI apps is now a separate location from Teams chats. Policies can cover Microsoft Copilot experiences (including Microsoft 365 Copilot, Security Copilot, Copilot in Fabric, and Copilot Studio), enterprise AI apps (including ChatGPT Enterprise and Microsoft Foundry when collection is on), and other AI apps. Behind the scenes, copies of prompts and responses live in a hidden folder in the user’s Exchange mailbox. What the user still sees in the Copilot pane is not proof of what eDiscovery can still find. If an account is deleted, retained Copilot messages can remain in an inactive mailbox.

Data residency is a frequent board question. Microsoft documents that Copilot LLM calls go to the closest data centers in the region but may call other regions when capacity is tight. Extra EU Data Boundary safeguards keep EU traffic inside the EU Data Boundary. Copilot became a covered workload in Product Terms residency commitments on March 1, 2024, including Microsoft Advanced Data Residency (ADR) and Multi-Geo. Customers outside the EU may have queries processed in the United States, the EU, or other regions. Models from Anthropic as a subprocessor are currently excluded from the EU Data Boundary; an AI council that promised “all Copilot processing stays in the EU” must treat Anthropic-powered experiences as an exception until Microsoft’s Anthropic documentation changes.

Web search has a different privacy shape. Copilot may send a generated Bing query when web grounding would improve an answer. Microsoft’s Copilot Chat FAQ states that Health Insurance Portability and Accountability Act (HIPAA) and Family Educational Rights and Privacy Act (FERPA) support for prompts and responses, where claimed, does not apply to web search queries, because those queries are not covered by the Data Protection Addendum (DPA) and Business Associate Agreement (BAA) the same way. A healthcare or education leader who needs those regimes should treat web search as a separate toggle, not as “Copilot is HIPAA so Bing is too.”

Privacy controls for connected experiences in Microsoft 365 Apps can turn Copilot off in Excel, OneNote, Outlook, PowerPoint, and Word on current Windows, Mac, iOS, and Android builds. Turning off optional connected experiences can also remove web search. That is a legitimate privacy mitigation; it is also a capability cut, so product and legal should decide it together.

Cost impact: seats, tokens, meters, and silent hosting

Cost is the fourth named impact, and it shows up even when the data story is clean. Token usage (pieces of text, and for some models image or audio units) drives Foundry and Azure OpenAI bills. Seats drive the monthly Microsoft Copilot add-on. Azure meters drive Copilot PAYG for Chat, SharePoint agents, and the Retrieval API, plus Copilot Studio PAYG in Copilot Credits. Fine-tuned Azure OpenAI deployments add hourly hosting even when unused. Microsoft’s Foundry cost article is explicit that Azure OpenAI does not currently offer OpenAI-style hard spend caps; budgets and alerts notify, they do not always stop the meter. New Microsoft 365 PAYG features are disabled by default until a Global Administrator or subscription owner enables them, which is a control, not a reason to ignore message-center posts about new meters.

A chief financial officer (CFO) should insist on: a billing policy with a budget and percentage alerts before PAYG work grounding; Cost Management Reader plus Foundry User (or the older Azure AI User name during the rename) for finance; tags or the Foundry project tag (preview, Azure-sold models only) for chargeback; and a rule that unused fine-tunes are deleted.

Leader mitigations you should be able to recite

• Fix Graph and SharePoint permissions first; use DSPM risk assessments and SAM, not hope.
• Apply RCD and DLP-for-Copilot as interim shields, then remove excess access.
• Set Purview retention and eDiscovery expectations for Copilot prompts and responses.
• Decide residency, web search, and Anthropic/OpenAI subprocessors in the AI council before pinning Copilot.
• Put Azure budgets on PAYG and Foundry; treat shadow AI with Endpoint DLP and the Security Dashboard for AI.
• Do not confuse “included Copilot Chat” with “safe to reason over every SharePoint site.”