Essential Steps to Update Your Copilot Settings Following the Recent Email Bug

Microsoft has recently raised a significant concern regarding its Microsoft 365 Copilot feature, particularly within its chat functionality. On January 21, the tech giant discovered that Copilot Chat had been summarizing confidential emails, unintentionally pulling sensitive information from Sent Items and Drafts—materials that should have been protected by their established sensitivity labels and data loss prevention (DLP) protocols. This revelation has sent ripples of concern throughout organizations that rely on these security measures.

As this issue unfolds, many are left wondering: has your organization received the necessary fixes, and is there still a potential risk that Copilot might retrieve information from inappropriate locations?

Understanding the DLP Bypass

A recent report by BleepingComputer highlighted the internal coding error at the heart of this issue. According to Microsoft, its Copilot “work tab” chat was erroneously accessing items stored in Sent Items and Drafts folders, subsequently summarizing them despite the presence of sensitivity labels and DLP policies.

These folders often contain sensitive content, including negotiation language or preliminary figures that were never intended for broader distribution. The emails located in Sent Items may include final drafts intended for customers, partners, or regulatory bodies. The potential for summaries to include sensitive text not only raises privacy concerns but also facilitates the unintended spread of confidential information within everyday chat interactions.

It’s crucial to note for IT administrators that this isn’t merely a case of someone copying and pasting an email into Copilot.

What Remains Unanswered by Microsoft

Microsoft has been proactive in deploying fixes since early February and assures users that they are monitoring the situation to confirm effectiveness. However, two vital pieces of information remain elusive: the number of tenants affected by this issue and the duration of this vulnerability before its detection on January 21.

Without this clarity, organizations are left grappling with whether they should conduct a detailed review or take a broader approach to assess potential risks.

Next Steps for Administrators

For IT administrators, it’s essential to conduct tests to determine if Copilot’s “work tab” chat can still summarize labeled emails in your specific environment. Document your findings meticulously, and retain this information with your audit notes for future reference, should your security team require it.

For all users, it’s advisable to treat Copilot summaries with caution. Until your IT department confirms that the behavior has been resolved, it’s wise to validate these summaries instead of accepting them at face value. If your role involves handling regulated or contract-bound information, raise this issue now and ensure that the necessary controls are actively reviewed and not merely assumed.

In a landscape where sensitive information is paramount, staying informed and agile is essential for any organization. Keep the conversation going with your IT team and secure the integrity of your data.

Let’s navigate these challenges together—after all, maintaining the trust of your clients and partners hinges on your commitment to safeguarding sensitive information.