When Copilot fetches data from SharePoint and OneDrive through Microsoft Graph, can other users’ emails or files be leaked?
No, Copilot maintains user context boundaries. Users cannot see other users' emails, OneDrive files, or private content through Copilot unless they already have explicit permissions. Users can only reference content from their own inbox, sent items, or shared resources where they've been granted access through normal Microsoft 365 permission structures. Our Microsoft security architecture maintains strict data isolation.
