Copilot Governance
Why You Need a Zero Trust Strategy with Åsne Holtklimpen [Microsoft MVP & MCT]
The rapid integration of Artificial Intelligence into our daily workflows has ushered in a new era of productivity. At the forefront of this revolution is Microsoft Copilot, a tool designed to enhance creativity and efficiency across the M365 ecosystem. However, as the excitement builds, many organizations are rushing to “jump aboard the AI train” without realizing that their tracks might be unfinished.
In a recent discussion with Åsne Holtklimpen, a Microsoft MVP and MCT with over two decades of experience in SharePoint and security, we explored the intersection of innovation and governance. The core message is clear: while Copilot is a transformative tool, its success depends entirely on the strength of your data security foundation. By leveraging Microsoft Purview, organizations can move from a state of vulnerability to one of empowered, secure productivity.
The Evolution of Data Security: From Silos to Holistic Governance
For many years, IT security was managed in silos. You had your identity management in one corner, your file permissions in another, and your endpoint protection somewhere else entirely. Åsne notes that in the early days of SharePoint, managing the flow of information security was a heavy, manual task. However, the landscape has shifted toward a holistic approach.
Today, tools like Microsoft Entra, Defender, and Purview work in unison. This integration allows for a Zero Trust model where security follows the data, regardless of where it lives or who is trying to access it. As Åsne explains, it is no longer just about locking the front door of your “digital house”; it is about ensuring that even if someone gets inside, the most sensitive files remain locked in a secure safe.
The “Bright Yellow Light”: Why Copilot Risks Are Not New
One of the most profound insights from our discussion is that Copilot does not create new security problems. Instead, it “shines a bright yellow light” on the problems that already exist within your environment. If your organization has overexposed data, outdated files, or messy permissions, Copilot will find them, and potentially present them to users who shouldn’t see them.
The risks typically stem from three areas:
Overexposed Data: Files that were shared too broadly during the “lift and shift” migration to Teams and SharePoint during the pandemic.
Legacy Permissions: Outdated access rights that were never cleaned up, allowing users access to sensitive folders they no longer need.
Outdated Information: Copilot may pull data from old versions of documents, leading to inaccurate or misleading AI-generated outputs.
To safely roll out Copilot, organizations must stop viewing it as a simple “on/off” switch and start viewing it as a destination that requires a well-packed bag and a valid ticket.
How Microsoft Purview Secures Your Copilot Rollout
Microsoft Purview is the primary engine for governing the data that Copilot interacts with. By setting up the right guardrails, you can ensure that the AI only “sees” and “uses” what it is supposed to. Åsne recommends a bare minimum starting point for any organization looking to secure their rollout.
1. Identifying Sensitive Info Types
The first step is recognizing what data you actually have. Purview allows you to identify Sensitive Info Types (SITs), such as credit card numbers, social security numbers, or proprietary project codes, across your entire tenant. Once identified, you can begin the process of classification.
2. Implementing Sensitivity Labels
Sensitivity labels are perhaps the most powerful tool in your governance arsenal. By labeling a document as “Highly Confidential,” you can explicitly instruct Copilot to ignore that file. This prevents the AI from extracting information from or summarizing documents that contain the company’s most “crown jewel” data. You can also apply these labels at the SharePoint site level, effectively “blacklisting” entire sites from being indexed by Copilot.
3. Data Loss Prevention (DLP) Policies
DLP policies act as the enforcement layer. For instance, if a document is labeled “Highly Confidential,” a DLP policy can ensure that the document cannot be sent outside the organization or accessed on unmanaged devices. This creates a multi-layered defense that protects data even if a user’s identity is compromised.
The Role of Zero Trust in AI Success
The concept of Zero Trust, never trust, always verify, is essential when deploying AI. Åsne highlights that many organizations still struggle with the basics, such as Multi-Factor Authentication (MFA). Without strong identity governance, the risks of AI are magnified.
Furthermore, security must be consistent. A common mistake is restricting AI tools like ChatGPT or Gemini on one browser (like Edge) while leaving them wide open on others (like Chrome). A true Zero Trust approach ensures that security policies are applied universally, regardless of the application or endpoint being used. When you have Conditional Access tied to your Purview labels, you can even restrict data access based on geography, for example, allowing a user to access sensitive data while in their home country but blocking it if they travel to a high-risk region.
Key Takeaways for a Secure Rollout
To ensure your Copilot implementation is both inspiring and secure, consider these actionable insights:
Perform a Data Audit: Use Purview to find where your sensitive data lives and who has access to it before turning on Copilot.
Start Small: Don’t roll out Copilot to the entire organization at once. Start with a pilot group while you refine your sensitivity labels and permissions.
Label Your “Crown Jewels”: Ensure that your most sensitive documents are labeled “Highly Confidential” to automatically exclude them from AI processing.
Clean Up “Lift and Shift” Messes: Address the legacy permissions created during past migrations to prevent Copilot from surfacing “dark data.”
Educate the C-Suite: Help leadership understand that AI is not just a productivity tool, but a governance project that requires investment in security foundations.
Conclusion: Preparing for the AI Journey
The “AI train” is indeed leaving the station, but there is no need to panic-jump aboard. The most successful organizations will be those that take the time to lay the tracks of security and governance first. By using Microsoft Purview to classify, label, and protect your data, you can turn Copilot from a potential liability into a secure, creative powerhouse.
Security doesn’t have to be a barrier to innovation; rather, it is the enabler that allows your team to explore the possibilities of AI with confidence. As Åsne Holtklimpen suggests, when you have the right controls in place, you don’t just protect your data, you gain the freedom to create something truly brilliant.