How can I restrict the Graph to prevent sensitive emails from being leaked through Copilot?

Copilot operates within user context boundaries. Users cannot access other people's emails, meetings, or Teams chats through Copilot unless they already have explicit access (like being included in conversations or having delegated permissions). Copilot only accesses data the user already has permission to see within their own mailbox and shared resources. Our Microsoft Graph security controls ensure proper access boundaries.