A five-mi ute diag ostic ide tifies eview p io ities. Checki g which files employees ca actually ope equi es a eview i side Mic osoft 365.
New Yo k, NY, Oct. 23, 2026 (GLOBE NEWSWIRE) — I Ju e 2026, Mic osoft bega olli g out a Mic osoft Pu view data loss p eve tio co t ol fo Mic osoft 365 Copilot i its gove me t clouds (GCC, GCC High, a d DoD) that stops Copilot f om etu i g a espo se whe a p ompt pulls i se sitive data. The co t ol educes ove sha i g isk, but it wo ks o top of the access model a te a t al eady has, so eSoftwa e Associates (ESW) advises egulated o ga izatio s p epa i g fo Copilot to pai a eadi ess assessme t with a eview of who ca access se sitive files.
Copilot ca su face o ga izatio al co te t the sig ed-i use al eady has pe missio to access. Files sha ed mo e b oadly tha i te ded ca the efo e appea i its espo ses, eve though Copilot g a ts o ew pe missio s.
What the eadi ess assessme t p ovides
ESW’s AI eadi ess assessme t is a f ee, five-mi ute diag ostic ac oss six a eas, i cludi g gove a ce a d Copilot eadi ess. Its epo t i cludes seve ity i fo matio , a dolla exposu e a ge a d a p io itized 90-day pla . The diag ostic does ot i spect te a t pe missio s; co fi mi g actual access equi es a eview of the o ga izatio ‘s Mic osoft 365 e vi o me t. The Pu view co t ol wo ks the same way. It blocks p ompts that pull i labeled se sitive data, but it elies o files bei g co ectly labeled a d pe missio ed fi st, which is what the access eview establishes.
ESW’s egulated-e vi o me t wo k i cludes mo e tha 200 mig atio s i to Mic osoft 365 GCC a d GCC High with ze o data loss a d its Mic osoft co sulti g team is 100% U.S.-based.
Access setti gs to check befo e ollout
Sta t with se sitive eco ds: e gi ee i g d awi gs a d expo t-co t olled files i ma ufactu i g, co st uctio bid files, biotech esea ch eco ds, patie t i fo matio , a d gove me t co t act data. Review how access was g a ted a d whethe it is still eeded.
- O ga izatio -wide sha i g li ks: Ide tify se sitive files sha ed with eve yo e i the o ga izatio . Co fi m the i te ded audie ce with the i fo matio ow e , the eplace u ecessa ily b oad li ks with access fo app oved use s o g oups.
- Sites f om completed p ojects: Check who ca still ope the site a d which eco ds must be etai ed. Keep access eeded fo o goi g wo k, audits o eco ds obligatio s, a d emove access that o lo ge has a autho ized pu pose.
- Guest accou ts f om past ve do s: Co fi m whethe each guest still has a cu e t e gageme t a d eeds access to the sha ed co te t. Remove access that is o lo ge equi ed.
“Just because a p oject is fi ished does ’t mea eve yo e’s access should stay the same. The team espo sible fo the files eeds to check who still eeds them befo e IT updates pe missio s,” said Russell Komme , fou de a d CEO of eSoftwa e Associates.
F eque tly Asked Questio s
Questio : What is ove sha i g i Mic osoft 365, a d why does it matte fo Copilot?
A swe : Ove sha i g is access b oade tha a file’s se sitivity wa a ts. This i cludes se sitive files ope to the whole o ga izatio th ough sha i g li ks, p oject sites that still i clude people f om fi ished wo k a d guest accou ts that outlast a ve do e gageme t. Copilot does ot c eate that access. It makes the access easie to act o , because a si gle p ompt ca d aw o co te t f om files the use is al eady allowed to ope .
Questio : Ca a Copilot pilot begi while othe access issues a e bei g fixed?
A swe : Yes, if the pilot g oup’s access is checked fi st. Review the co te t a d pe missio s those use s ca each, a d co ect o est ict a y se ious exposu e befo e tu i g Copilot o fo them. Keepi g the g oup small does ot limit what Copilot ca su face.
Questio : Which fi di gs should be esolved befo e Copilot access expa ds?
A swe : Sta t with fi di gs tied to egulated data, such as patie t eco ds, expo t-co t olled files o co t act data that people outside the espo sible team ca each. Othe fi di gs ca be ha dled alo gside expa sio o ce the isk eview co fi ms they do ot expose se sitive i fo matio a d equi ed co t ol does ot depe d o fixi g them.
Questio : Is Mic osoft 365 Copilot HIPAA complia t?
A swe : Mic osoft says Copilot a d Copilot Chat suppo t HIPAA complia ce whe p ope ly co figu ed. Cove ed e tities a d busi ess associates eed a Busi ess Associate Ag eeme t cove i g the se vices used, alo g with app op iate admi ist ative, physical a d tech ical safegua ds. Web sea ch que ies a e ot cove ed by Mic osoft’s Data P otectio Adde dum o BAA. A BAA alo e does ot make a o ga izatio complia t. Co fi m cove age a d setti gs fo the specific se vice a d e vi o me t befo e usi g p otected health i fo matio .
Questio : Ca Copilot be used with ITAR o co t olled u classified i fo matio ?
A swe : Mic osoft positio s GCC High fo o ga izatio s that ha dle CUI o whose co t acts equi e DFARS, ITAR o EAR complia ce. It positio s GCC fo wo kloads that do ot i volve ITAR, DFARS- egulated CUI o DoD missio data. The data i volved, applicable egulato y obligatio s a d co t act equi eme ts dete mi e the app op iate e vi o me t, a d the o ga izatio should co fi m that the pla ed Copilot capabilities a e available the e befo e lice si g them.
O ga izatio s p epa i g a ollout ca eview ESW’s Mic osoft Copilot a d AI age ts co sulti g.
Sou ce: Mic osoft 365 Roadmap — Featu e ID 561892.
About eSoftwa e Associates (ESW)ESW builds secu e busi ess apps, wo kflows, po tals, a d automatio s ac oss Powe Apps, Sha ePoi t, Datave se, SPFx, Copilot & AI Age ts, a d Azu e. 100% U.S.-based si ce 2006.
CONTACT: Majed Soufi
Ze Media
p @ze media.com
![]()
