Course Content
Day 1 – Stocktaking and Oversharing
- How Copilot accesses data: Microsoft Graph, the semantic index, permission boundaries
- Why Copilot doesn’t create a security problem but makes an existing one visible
- Finding oversharing sites: broken permission inheritance, company-wide groups, “everyone” links
- Data risk assessment with Purview DSPM
- Excluding sites from Copilot discovery
- Planning sensitivity labels and enforcing them at provisioning
Day 2 – Guardrails and Operations
- DLP policies for Copilot: excluding content from processing
- Access control for business-critical sites
- Retention and logging of Copilot interactions
- eDiscovery and subject access requests: what you must be able to produce
- Data residency for Switzerland: EU Data Boundary, Advanced Data Residency, local processing
- The documented exception for third-party models
- Licensing and requirements: qualifying base plan, Exchange Online, network
- Planning the rollout: pilot group, training, success measurement