M365 Copilot has broad agentic access to email, calendar, Teams meetings, SharePoint documents, OneDrive, and other Microsoft 365 services. Copilot Agents can take autonomous actions across these surfaces. Scope of data access is the widest of any enterprise AI tool — essentially the full Microsoft 365 estate.

Review and configure Microsoft Purview sensitivity labels and DLP policies before deployment. Scope Copilot access using Microsoft 365 Groups and SharePoint permissions — Copilot can only access what the user already has access to. Enable Copilot audit logs in the Microsoft Purview compliance portal. Use Communication Compliance policies to monitor Copilot interactions for regulated industries. Review the Copyright Commitment scope and confirm it covers your use case.