A user in your tenant opens Word, loads a confidential document from OneDrive, and asks Copilot to summarize it. The document is only shared with that…

Microsoft 365 Copilot is grounded in your organization's data and operates strictly within the security context of the user making the request. It uses the Microsoft Graph API to access the content that the user already has explicit permission to access, such as their own files in OneDrive, emails, and chats. In this scenario, because the user has access to the confidential document, Copilot, acting on their behalf, can also access it to perform the summarization task. Copilot does not change or circumvent existing permissions.

A: Copilot does not create a shared index of data across different customer tenants. All data processing and access are contained within the specific tenant's security boundary, respecting data sovereignty and privacy.

C: Copilot for Microsoft 365 uses the Microsoft Graph to access internal organizational data. It does not upload private files to Bing or use public snapshots for processing internal content.

D: Copilot is a cloud-native service. While it can interact with content from local applications like Word, its core processing and data access (via Microsoft Graph) occur in the Microsoft Cloud, not exclusively on the local device.

1. Microsoft Learn. "Data

Privacy

and Security for Microsoft 365 Copilot." Microsoft 365 Copilot documentation. In the section "How Microsoft 365 Copilot uses your data

" it states

"Copilot accesses content and context through Microsoft Graph... Copilot only surfaces data to which individual users have access."

2. Microsoft. "Microsoft 365 Copilot Architecture" (often presented in technical diagrams and blog posts). The official architecture diagram shows that a user's prompt is sent to the Copilot service

which then calls the Microsoft Graph to retrieve the user's business data

respecting all existing permissions and security policies. This confirms that access is predicated on the user's permissions via Microsoft Graph.