30 Days Gen AI Risk Trial -Start Now
Skip to main content
Aona
Book a demo
AI security guides
Microsoft Copilot

Your Copilot rollout.
Six security checks.

Aona’s FDSE service checks access, data protection and audit trails.

Discuss a pilot

Aona AI

Inside an Aona review

Test with two roles.
Keep the evidence.

For Microsoft 365 work accounts, Aona agrees the test roles, data and expected results with your team. A typical setup pairs Finance, with access to a private folder, and Employee, without it, using authorised non-admin accounts and fictional test documents. These six checks show how our forward deployed security review turns Microsoft’s guidance into evidence.

  1. 01

    Prove the allowed path works

    Record the account, app, licence and policy scope. An unavailable feature is not evidence that a security control worked.

    KeepAccount, app, licence and successful control result

    How to verify
    Test
    Sign in as each pilot role. Run an allowed task supported by each approved app, such as summarising the public test document where supported. Record the tenant, app version and available capabilities.
    Expect
    The authorised task succeeds; document-retrieval tests use the intended source. Microsoft documents different requirements for Copilot Chat and licensed Copilot capabilities.
    If it fails
    Resolve entitlement, configuration or source availability before interpreting the remaining tests. Do not substitute an administrator account for an employee.
    Microsoft: experience and licensing requirements
  2. 02

    Challenge the access boundary

    Copilot can expose content an employee was already permitted to read. A successful permission check still needs a business justification for that access.

    KeepBoth accounts’ file access, prompts and responses

    How to verify
    Test
    Put a synthetic finance fact in a restricted test document. As Finance, open its link and ask Copilot to summarise it. Repeat both actions as Employee, who should have no access.
    Expect
    Finance can use the content; Employee cannot open it or recover its unique fact. Ask the data owner to confirm the intended audience.
    If it fails
    Pause expansion to that source. Review broad groups, sharing links and inherited permissions, correct access, then rerun both accounts. A missing search result alone does not prove access is restricted.
    Microsoft: remediate oversharing before scale
  3. 03

    Test the labelled document

    A label is not automatically a Copilot exclusion. Verify the applicable DLP policy and user scope.

    KeepLabel, policy, account, prompt and response

    How to verify
    Test
    As Finance, ask Copilot to summarise a labelled test document containing a unique fictional fact. Compare with an allowed document.
    Expect
    The excluded fact is not used. Microsoft says an excluded item can still appear as a citation.
    If it fails
    Check policy activation, supported content and propagation before retesting. Hold that data class out of scope.
    Microsoft: labelled content exclusions
  4. 04

    Separate paste from upload

    Prompt-content blocking is in preview. This Copilot DLP location does not inspect the contents of files uploaded directly into prompts.

    KeepSeparate text and file outcomes

    How to verify
    Test
    As an in-scope employee, paste a validated synthetic sensitive-information sample. Repeat with that sample inside an uploaded file.
    Expect
    Compare each outcome with its specified control. Blocking web searches alone still permits an internally grounded response.
    If it fails
    Confirm preview availability and the configured action. Restrict the unprotected path or verify a separate upload control before expansion.
    Microsoft: prompt actions and upload limits
  5. 05

    Verify the connector audience

    A connector can respect source permissions or make indexed content visible to everyone. Check the setting and prove the resulting access.

    KeepConnector setting, source ACL and paired results

    How to verify
    Test
    In the admin centre, open Copilot → Connectors → Your Connections. Record Permissions. Index a private test item, then request its unique fact as an allowed source user and as Employee.
    Expect
    The allowed account retrieves it; Employee cannot. Repeat after a controlled source-access removal and the connector’s documented synchronisation process.
    If it fails
    Exclude the source and investigate identity mapping and ACLs. Microsoft currently requires recreating a connection to change its access-permission mode; plan that change with its owner.
    Microsoft: connector permissions and changes
  6. 06

    Reconstruct one interaction

    Before scaling, prove that the team receiving an incident can trace a test interaction and its accessed resources.

    KeepAudit record, evidence owner and retest decision

    How to verify
    Test
    Note the employee account, UTC time and app for one successful test. Have the authorised reviewer find its CopilotInteraction event in Microsoft Purview Audit and inspect the available resource references.
    Expect
    The reviewer can connect the event to the test and identify its app and sources. Confirm audit availability, permissions and retention for your tenant.
    If it fails
    Fix the evidence gap before expansion. Assign every unresolved finding an owner and due date, retest the changed control, and record who accepts any remaining risk.
    Microsoft: Copilot audit events and resource fields

Six reviewed boxes are a reading aid. The deliverable is a dated decision: expand, restrict or pause, backed by results and named owners. The customer owns that decision. Use your tenant’s available controls and licences; custom agents and write actions need their own scope. For the wider risk picture, see our Copilot security guide.