Secure Microsoft Copilot for Microsoft 365 in Microsoft 365 Business Standard and Microsoft 365 Business Premium

This article explains the differences in security and compliance controls between Copilot for Microsoft 365 in Microsoft 365 Business Standard and Microsoft 365 Business Premium. This article doesn't attempt to describe the full capabilities of Copilot for Microsoft 365, or the full security and compliance features in Business Standard and Business Premium.

The following sections contain scenarios to help you better understand how security features in Business Standard and Business Premium can help protect you when you're using Copilot for Microsoft 365.

Enable new levels of employee productivity while safeguarding company data and resources

How can companies enable new levels of employee productivity with tools like Microsoft Copilot for Microsoft 365 while safeguarding company data and resources?

• Use the following capabilities in Business Standard to make sure that unauthorized employees can't use Copilot for Microsoft 365 to gain access to information or confidential data in files that they don't have access to:

  • Sign in without a password using multifactor authentication and help ensure only authorized users have access to data.
  • Ensure only enrolled, compliant devices can access Microsoft 365 resources with device-based conditional access.
  • Wipe all work content, including content generated by Copilot if a device is lost, stolen, or compromised.
  • Revoke work access on noncompliant devices except Windows devices

• Business Premium extends protection in the following scenarios:

  • Further prevent external bad actors from getting access to Microsoft 365 resources.
  • Protect against employee misuse of Copilot for Microsoft 365 by creating conditions to grant internal access.
  • Reduce the ability for employees or external parties from inappropriately saving or leaking data outside the organization.

  The following capabilities in Business Premium lead to results in those scenarios:

  • Use biometrics to sign in to your Microsoft 365 account using Windows Hello for Business (enabled through Windows 11 Pro, which is available to Business Premium licenses).
  • Only grant access to Microsoft 365 resources when specific conditions (identity, device, and location) are met using user-based conditional access.
  • Require employees or guests to accept the terms of use policy before getting access to resources.
  • Restrict the use of the Microsoft 365 apps and Teams (and Copilot in these apps) on personal devices.
  • Prevent saving files to unprotected apps.
  • Restrict the ability to copy and forward confidential business information with data loss prevention for emails and files.

Keep sensitive or personal data from being exposed

How can companies ensure that sensitive or personal data isn't exposed when using Copilot for Microsoft 365?

• Use the following capabilities in Business Standard to make sure that unauthorized employees can't use Copilot for Microsoft 365 to gain access to information or confidential data in files that they don't have access to:

  • Change default sharing options in SharePoint and OneDrive.
  • Prohibit Copilot for Microsoft 365 from including sensitive data that users don't have permissions to view in generated responses.
  • Exclude sensitive files that users don't have permissions to view from being processed by Copilot.

• Business Premium further extends the protection of sensitive data by requiring sensitivity labels for Microsoft 365 content. These labels help ensure that only employees with specific permissions can use Copilot for Microsoft 365 to access, generate, or share sensitive data. Matching sensitivity labels are automatically applied to any content generated by Copilot for Microsoft 365.

  The following capabilities in Business Premium lead to those protections:

  • Protect Microsoft 365 data from being accessed by unauthorized users by implementing manual, default, and mandatory content labeling.
  • Copilot for Microsoft 365 automatically inherits and applies sensitivity labels that match any queried material or references.

Support regulatory compliance and eDiscovery requests

How can companies monitor interactions with Copilot for Microsoft 365 and support related regulatory compliance or eDiscovery requests?

• In Business Standard, companies can achieve the following results:

  • Monitor, search, and export employee interactions with Copilot for Microsoft 365, and any content generated by Copilot for Microsoft 365.
  • Define how long content generated by Copilot for Microsoft 365 should be retained within Microsoft 365.

  The following capabilities in Business Standard lead to these results:

  • Search for and export Copilot interactions by content and keyword search.
  • Maintain a log of all Copilot for Microsoft 365 interactions within the organization.
  • Apply retention or deletion policies for Copilot interactions and any generated content.

• Business Premium further extends the support for investigations or other legal processes by asserting a legal hold on material associated with Copilot for Microsoft 365.

  In Business Premium, use eDiscovery (Standard) to search for Copilot interactions by content, keyword search, create cases, assign managers, apply legal hold, and export the search results to investigate incidents and respond to litigation.

Appendix

The available security and compliance features related to Copilot for Microsoft 365 in Business Standard and Business Premium is summarized in the following tables:

• Identity and Access Management (Microsoft Entra ID):

  Scenario	Business Standard	Business Premium
  Sign in to Copilot for Microsoft 365 with a single identity	✔	✔
  Enforce MFA when accessing Microsoft 365 to use Copilot	✔	✔
  Enable end-user password reset, change, and unlock when accessing Microsoft 365	Cloud users	✔
  Implement Conditional Access policies based on identity, device, and location when accessing Microsoft 365 to use Copilot		✔
  Enable near real-time access policies enforcement, evaluate critical events, and immediately revoke access to Microsoft 365		✔
  Require employees or guests to accept terms of use policy before getting access		✔

• Endpoint Management (Basic Mobility and Security or Intune):

  Scenario	Business Standard	Business Premium
  Push/deploy Microsoft 365 apps to devices and grant access to Copilot in those apps		✔
  Manage Microsoft 365 app updates		✔
  Restrict the use of Microsoft 365 apps and Teams (and Copilot in those apps) on personal devices		✔
  Prevent saving files (including files generated by Copilot) to unprotected apps		✔
  Wipe all work content (including content generated by Copilot) if a device is lost, stolen, or compromised	✔	✔
  Revoke work access on noncompliant devices	iOS, Android	✔

• Data Security and Compliance (Information Protection):

  Scenario	Business Standard	Business Premium
  Search for Copilot generated data and interactions with eDiscovery capabilities	Search and export results	+ Case management and legal hold
  Audit logs for Copilot interactions	Audit (Standard)	Audit (Standard)
  Apply a manual retention policy for Copilot interactions	✔	✔
  Data loss prevention (DLP) policies to protect sensitive data generated by Copilot and saved in Microsoft 365 locations from exfiltration		Files and email
  Manually label and protect Microsoft 365 content used by Copilot		Files and email
  Inherit sensitivity labels and cite sensitivity labels in output and references in Copilot		✔
  Prohibit Copilot from including sensitive data that users have no extract permissions for	✔	✔
  Exclude sensitive files that users have no permission to view from being processed by Copilot	✔	✔