copilot-for-m365-readiness

Name: copilot-for-m365-readiness
Author: vinayaklatthe

161stars34forks

How to install copilot-for-m365-readiness?

vinayaklatthe/microsoft-security-skills/copilot-for-m365-readiness

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill copilot-for-m365-readiness

Installs into the current project.

Summary

Guidance for safely deploying Microsoft 365 Copilot — end-to-end readiness covering oversharing remediation, SharePoint Advanced Management (SAM) restricted sites and content discovery, sensitivity label coverage, Purview DLP for Copilot, Restricted SharePoint Search (RSS) interi

Files · 1

View on GitHub

SKILL.md

1	# Microsoft 365 Copilot — Safe Readiness
2
3	Microsoft 365 Copilot is only as safe as your SharePoint, OneDrive, and Teams permission
4	hygiene. The #1 incident pattern is "Copilot surfaced HR/board/legal content because the
5	underlying site was over-permissioned." This skill is the end-to-end readiness playbook —
6	identify oversharing, contain via SAM and labels, then enable Copilot in waves.
7
8	## When to use
9	Preparing to deploy Microsoft 365 Copilot. Use for the pre-launch security workstream:
10	oversharing detection, containment controls, label/DLP coverage, audit, and phased
11	rollout.
12
13	Do not use this skill for the broader oversharing program (`m365-oversharing`),
14	Purview DSPM for AI in isolation (`purview-dspm-ai`), or agent-specific security
15	(`microsoft-agent-365`).
16
17	## Readiness gates — don't skip
18
19	\| Gate \| Why \|
20	\|---\|---\|
21	\| Sensitivity labels published and adopted \| Copilot honors label encryption + usage rights \|
22	\| Auto-labeling for known sensitive content classes \| Catches the long tail users won't label \|
23	\| DLP for Copilot policies \| Prevents sensitive content surfacing in chat answers \|
24	\| SAM (SharePoint Advanced Management) provisioned \| Required for restricted access + data access governance \|
25	\| Site ownership confirmed \| Orphaned sites with permissive ACLs are the #1 incident path \|
26	\| Audit on \| Copilot interactions are auditable; off = no investigation possible \|
27
28	## Approach
29
30	1. Inventory and triage oversharing. Run SAM Data Access Governance reports:
31	- Sites shared with Everyone except external users (EEEU).
32	- Sites with anonymous links.
33	- Sites with high external sharing volume.
34	- Sites with sensitive content but permissive ACLs.
35	Prioritize the top 5% by volume and sensitivity.
36
37	2. Apply Restricted SharePoint Search (RSS) as an interim safeguard. RSS limits
38	Copilot grounding (and SharePoint search) to a curated allowlist of sites + the user's
39	own OneDrive. Buys 90 days while you fix the long tail.
40	*Verify: in test tenant, Copilot prompt "summarize HR salary data" returns no
41	grounded content from non-allowlisted sites.*
42
43	3. Roll out sensitivity labels with mandatory labeling for the pilot population, plus
44	auto-labeling for known sensitive info types. Labels with encryption restrict Copilot
45	from showing content to users without usage rights.
46
47	4. Author DLP for Copilot policies. Specifically the Microsoft 365 Copilot
48	location:
49	- Block Copilot from using sensitive-labeled content in chat responses.
50	- Block credit-card / SSN / financial data from appearing in Copilot output.
51	- Audit-mode first, block after 2 weeks of tuning.
52
53	5. Site lifecycle controls via SAM:
54	- Restricted Access Control — explicitly cap who can access a site even if
55	other policies would grant access; useful for HR, finance, board.
56	- Site lifecycle policies — archive/inactive sites are excluded from Copilot
57	grounding.
58	- Block download for specific sensitivity labels.
59
60	6. Audit and monitoring.
61	- Enable Purview Audit Premium for long retention.
62	- Stream Copilot interaction logs to Sentinel; alert on prompts with sensitive
63	terms or attempts to access restricted content.
64	- Copilot incidents now show in Defender XDR — wire to SOC queue.
65
66	7. Phased rollout.
67	- Wave 0 (50 users): IT + Security; validate auditing and DLP.
68	- Wave 1 (500): low-sensitivity department (Marketing).
69	- Wave 2: broader workforce after oversharing top-5% remediated.
70	- Wave 3: regulated departments (Finance, Legal, HR) only after deep label
71	coverage.
72	Measure prompts blocked, sensitive content surfaced, and user satisfaction at each
73	wave.
74
75	8. Licensing prerequisites checklist: Microsoft 365 Copilot license + Microsoft
76	365 E3/E5, SharePoint Advanced Management add-on for SAM features, Purview E5 for
77	advanced DLP and Audit Premium.
78
79	##

People who liked this also viewed

6 picks

Type

copilot-for-m365-readiness

161stars34forks

View on GitHub

How to install copilot-for-m365-readiness?

vinayaklatthe/microsoft-security-skills/copilot-for-m365-readiness

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill copilot-for-m365-readiness

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Microsoft 365 Copilot — Safe Readiness
2
3	Microsoft 365 Copilot is only as safe as your SharePoint, OneDrive, and Teams permission
4	hygiene. The #1 incident pattern is "Copilot surfaced HR/board/legal content because the
5	underlying site was over-permissioned." This skill is the end-to-end readiness playbook —
6	identify oversharing, contain via SAM and labels, then enable Copilot in waves.
7
8	## When to use
9	Preparing to deploy Microsoft 365 Copilot. Use for the pre-launch security workstream:
10	oversharing detection, containment controls, label/DLP coverage, audit, and phased
11	rollout.
12
13	Do not use this skill for the broader oversharing program (`m365-oversharing`),
14	Purview DSPM for AI in isolation (`purview-dspm-ai`), or agent-specific security
15	(`microsoft-agent-365`).
16
17	## Readiness gates — don't skip
18
19	\| Gate \| Why \|
20	\|---\|---\|
21	\| Sensitivity labels published and adopted \| Copilot honors label encryption + usage rights \|
22	\| Auto-labeling for known sensitive content classes \| Catches the long tail users won't label \|
23	\| DLP for Copilot policies \| Prevents sensitive content surfacing in chat answers \|
24	\| SAM (SharePoint Advanced Management) provisioned \| Required for restricted access + data access governance \|
25	\| Site ownership confirmed \| Orphaned sites with permissive ACLs are the #1 incident path \|
26	\| Audit on \| Copilot interactions are auditable; off = no investigation possible \|
27
28	## Approach
29
30	1. Inventory and triage oversharing. Run SAM Data Access Governance reports:
31	- Sites shared with Everyone except external users (EEEU).
32	- Sites with anonymous links.
33	- Sites with high external sharing volume.
34	- Sites with sensitive content but permissive ACLs.
35	Prioritize the top 5% by volume and sensitivity.
36
37	2. Apply Restricted SharePoint Search (RSS) as an interim safeguard. RSS limits
38	Copilot grounding (and SharePoint search) to a curated allowlist of sites + the user's
39	own OneDrive. Buys 90 days while you fix the long tail.
40	*Verify: in test tenant, Copilot prompt "summarize HR salary data" returns no
41	grounded content from non-allowlisted sites.*
42
43	3. Roll out sensitivity labels with mandatory labeling for the pilot population, plus
44	auto-labeling for known sensitive info types. Labels with encryption restrict Copilot
45	from showing content to users without usage rights.
46
47	4. Author DLP for Copilot policies. Specifically the Microsoft 365 Copilot
48	location:
49	- Block Copilot from using sensitive-labeled content in chat responses.
50	- Block credit-card / SSN / financial data from appearing in Copilot output.
51	- Audit-mode first, block after 2 weeks of tuning.
52
53	5. Site lifecycle controls via SAM:
54	- Restricted Access Control — explicitly cap who can access a site even if
55	other policies would grant access; useful for HR, finance, board.
56	- Site lifecycle policies — archive/inactive sites are excluded from Copilot
57	grounding.
58	- Block download for specific sensitivity labels.
59
60	6. Audit and monitoring.
61	- Enable Purview Audit Premium for long retention.
62	- Stream Copilot interaction logs to Sentinel; alert on prompts with sensitive
63	terms or attempts to access restricted content.
64	- Copilot incidents now show in Defender XDR — wire to SOC queue.
65
66	7. Phased rollout.
67	- Wave 0 (50 users): IT + Security; validate auditing and DLP.
68	- Wave 1 (500): low-sensitivity department (Marketing).
69	- Wave 2: broader workforce after oversharing top-5% remediated.
70	- Wave 3: regulated departments (Finance, Legal, HR) only after deep label
71	coverage.
72	Measure prompts blocked, sensitive content surfaced, and user satisfaction at each
73	wave.
74
75	8. Licensing prerequisites checklist: Microsoft 365 Copilot license + Microsoft
76	365 E3/E5, SharePoint Advanced Management add-on for SAM features, Purview E5 for
77	advanced DLP and Audit Premium.
78
79	##

People who liked this also viewed

6 picks

Type