Your Copilot data is being kept, but it may not be recoverable. Every prompt your staff types is stored in a hidden mailbox folder, and one booby-trapped email has already been shown to make Copilot leak data without a single click.
If that data is stolen or poisoned, retention policies will not restore it. This guide shows where the gaps are and the five steps that close them.
Executive Summery
- Hidden by default: Copilot prompts, responses and memories sit in hidden folders in each user’s mailbox, kept indefinitely unless a Purview policy limits them.
- Proven attacks: EchoLeak and ShareLeak showed Copilot and its agents can leak data through ordinary emails and forms. Both are patched; the pattern is not.
- Retained is not recoverable: Retention preserves evidence for lawyers. It cannot roll a poisoned SharePoint library back to a clean state.
- The fix: Map, assess, put DLP on prompts, test eDiscovery and drill restores of grounding data.
- Check your licence: Since 1 July 2026, Copilot Studio agent security requires Microsoft Agent 365.
Copilot Has Created a Data Estate Nobody Has Classified
Before Copilot, a sensitive question asked at work left no trace. Now every prompt and every answer is saved. Microsoft’s own eDiscovery guidance treats prompts, responses, memories and Copilot Pages as distinct data types, each with its own storage and rules.
To an attacker, this archive reads like a briefing pack:
- Prompt history reveals what executives are worried about, which deals are live and which documents matter most.
- Memories record the preferences and context Copilot infers about each user over time.
- Agent knowledge sources hold curated company information, chosen precisely because it is accurate and useful.
Most organisations have never classified this archive, sized it or tested whether they can get it back.
What “Training Data” Really Means in Microsoft 365
The common fear: Copilot learns from your company’s data and could leak it to other customers.
The reality: Microsoft states that Copilot interaction data is encrypted at rest and is not used to train its foundation models.
The exposure is one layer down, in grounding data. These are the SharePoint sites, OneDrive files, connectors and agent knowledge sources Copilot reads before it answers. Change that content, and you change what Copilot tells every user who asks. In Microsoft 365, protecting AI “training data” means protecting that grounding layer.
Where Microsoft 365 Copilot Stores Prompts, Responses and Memories
Copilot data does not reside in a single place. Where each type sits decides which controls protect it and which backup questions you need to ask.
| Data Type | Where It Lives | Main Control |
| Prompts and responses | Hidden folder in each user’s Exchange mailbox | Purview retention, eDiscovery |
| Copilot memories | Hidden CopilotMemory subfolder in the mailbox | Purview retention (from late September 2026) |
| Copilot Pages | Outside Exchange mailboxes | Its own location and policy |
| Copilot Studio agent knowledge | SharePoint, connectors and Dataverse | Permissions, DLP, backup |
Two planning traps hide in this table:
- Hidden means easy to miss. Prompts and responses are stored as individual messages, so mailbox tools can find them. They only do so if they reach hidden folders.
- Dataverse is outside the usual scope. Copilot Studio indexes external connector content into Dataverse. That data falls outside the Exchange, SharePoint and OneDrive coverage most backup plans assume.
Four Ways Attackers Reach Copilot Prompts and Grounding Data
None of these attacks needs stolen passwords. Each one turns Copilot’s normal behaviour against you.
Oversharing Through Inherited Permissions
Copilot shows users what they can reach and not what they should see.
Years of broad sharing links and drifted permissions become searchable in plain English. Nothing is breached, yet salary files or board papers can appear in a routine answer. Copilot does not create this risk. It removes the obscurity that used to hide it.
Watch for: “Anyone with the link” shares on sites that hold HR, finance or legal content.
Zero-Click Prompt Injection
A single email containing hidden instructions was enough to make Copilot leak data.
Aim Security disclosed EchoLeak (CVE-2025-32711) in June 2025. Hidden instructions in an email led Copilot to pull data from OneDrive, SharePoint and Teams. The data then left via image links that Copilot fetched automatically, without any user click. Microsoft patched the flaw, but the lesson stands: any untrusted content Copilot reads can carry instructions.
Watch for: Copilot responses containing external links or images nobody asked for.
Agent Knowledge Exfiltration
Agents that read, know, and act are the highest-value target in the tenant.
Capsule Security showed how with ShareLeak (CVE-2026-21520), which Microsoft patched in January 2026. Untrusted SharePoint form fields flowed straight into a Copilot Studio agent’s prompt without sanitisation. An attacker could then make the agent query SharePoint and email the results out through Outlook.
Watch for: Agents that accept public form input and can also send email.
Knowledge Base Poisoning
The hardest attack to spot rewrites the facts Copilot relies on.
A malicious or simply wrong document in an indexed SharePoint library shapes every related answer across the organisation. Unlike ransomware, poisoning never announces itself. Users trust the output because it comes from an approved internal source. Reversing it means pinpointing when the content changed, then restoring the version from before that moment.
Watch for: Recent edits to policy or reference documents by accounts that rarely touch them.
Retention Keeps Records. It Will Not Restore Your Copilot Data.
Retention is built for lawyers and auditors. Backup is built for the morning after an incident.
Most Microsoft 365 governance plans treat the two as interchangeable. With Copilot, three gaps show why they are not.
Gap one: Data that outstays its welcome. Purview moves expired Copilot items to a hidden SubstrateHolds folder before deleting them. Any Litigation Hold, delay hold or eDiscovery hold on the mailbox suspends that deletion entirely. Legal teams welcome this. It also means prompts can persist far longer than intended, which raises data minimisation questions under UK GDPR.
Gap two: Features that arrive before the controls. Purview retention did not cover Copilot memory at all until the update rolled out in late September 2026. Expect the same lag with every new AI feature Microsoft ships.
Gap three: Changes that cannot be undone. The Dataverse recycle bin restores deleted records, but it cannot reverse updates. If a flow or compromised agent overwrites fields across thousands of rows, no native tool brings the old values back.
All three sit squarely within the Microsoft Shared Responsibility Model. Microsoft keeps the service running. Returning your data to a clean state is your job.
The Five-Step CTO Runbook for Copilot Data Security
Each step below fits inside a single quarter and ends with a clear test of done.
Step 1. Map Every AI Data Asset
List each Copilot data type, where it lives and who owns it: interaction folders, memories, Pages, agent knowledge sources and Dataverse tables. Microsoft’s Copilot Agent Kit includes an Agent Inventory that shows every custom agent in the tenant, with its authentication mode and knowledge sources. Expect to find agents nobody in IT knew existed.
Done when: Every agent has a named owner and a documented list of knowledge sources.
Step 2. Run an Oversharing Assessment Before Wider Rollout
Purview Data Security Posture Management (DSPM) flags overshared sites that hold sensitive data, as well as risky sharing links. Two tools buy time while permissions are fixed:
- Restricted Content Discovery hides your riskiest sites from Copilot and organisation-wide search.
- Bulk link remediation in DSPM removes overshared links in one operation and not one at a time.
Done when: High-risk sites are either remediated or hidden from Copilot.
Step 3. Put DLP on the Prompt Channel
Purview DLP can stop Copilot and Copilot Chat from processing prompts that contain sensitive information. It can also block content with selected sensitivity labels from grounding answers. Start with personal data, financial records and legal files, then widen coverage once false positives settle.
Done when: A test prompt containing a sample sensitive value is blocked.
Step 4. Prove Retention With a Test eDiscovery Search
A policy on paper is not proof. Ask legal or compliance to search one named user’s Copilot interactions and memories. Check that results include what the policy promises and exclude what it should have deleted.
Done when: The search matches the policy, and a retest is scheduled after each major Copilot release.
Step 5. Back Up Grounding Data and Drill the Restore
Treat agent knowledge sources and high-value SharePoint libraries as production systems. Protect them with Recoverable’s point-in-time recovery, which restores individual files and folders instead of whole sites. Then rehearse a poisoning scenario: pick a library, choose a known clean timestamp and restore to it.
Time the exercise. If recovery takes days, Copilot serves poisoned answers for days. For what drives that clock, read granular restore vs full-tenant recovery.
Done when: You have a measured restore time you would be comfortable reporting to the board.
Has Your Copilot Agent Security Already Switched Off?
Since 1 July 2026, security features for Copilot Studio and Microsoft Foundry agents have required a Microsoft Agent 365 licence. These features include agent discovery, posture management and threat detection. Tenants without an eligible licence lost them at cutover, and rules set to block risky agent activity stopped enforcing. The agents kept working as normal, so the change is easy to miss.
A five-minute check for your security lead:
- Does the tenant hold an Agent 365-eligible licence?
- Are agent discovery and posture views still populating in the Defender portal?
- Have any agent threat alerts fired since July? If none, confirm that is genuine quiet, not a dead feed.
When a control stops working without warning, the risk goes up, because teams still assume they are protected.
Settle Ownership Before Agents Multiply
Agents are usually built by teams in the business units. Knowledge sources belong to data owners, and backup belongs to IT. When a poisoned agent surfaces at 6pm, three questions need instant answers:
| Question | Owner |
| Who approves a new knowledge source? | Data owner |
| Who reviews its permissions? | Security or IT |
| Who restores it after an incident? | IT operations |
Agree to this now, while the agent count is still small.
Make Your Microsoft 365 Backup Provider Prove It, Live
Sales decks all promise full coverage. A 30-minute demo in your own tenant tells the truth. Give the provider three tasks and watch what happens.
Task one: “Find yesterday’s Copilot prompts for this user.”
A strong provider locates the hidden mailbox folders holding prompts, responses and memories, and shows them in its restore view.
Red flag: “We back up the whole mailbox, so it should be in there.”
Task two: “Show me Copilot Pages and the Dataverse tables behind this agent.”
Pages are outside Exchange mailboxes, and Copilot Studio indexes connector content into Dataverse. Coverage of either should be explicit.
Red flag: A pause, followed by a promise to check with the product team.
Task three: “Restore this one library to 09:00 last Tuesday, and time it.”
The restore should touch that library only, leave the rest of the site alone, and produce a log you could hand to an auditor.
Red flag: The restore needs a support ticket, or rolls back the whole site.
A provider that struggles with any of these is protecting yesterday’s Microsoft 365 estate instead of today’s. For the full evaluation beyond Copilot, work through this 10-point Microsoft 365 backup provider checklist.
Make Copilot Data Recoverable, Not Just Retained
One question determines whether your Copilot rollout is safe: if your busiest agent’s knowledge library were poisoned this morning, how long would it take Copilot to start giving accurate answers again?
If you don’t know, find out this week. Start a 30-day free trial of Recoverable, with no credit card required. Back up the library your busiest agent depends on, restore it to a point in time, and time the whole process. You will have a real recovery figure to take to the board.
Microsoft 365 Copilot Data Security: Frequently Asked Questions
Can employees delete their own Microsoft 365 Copilot history?
Yes. Any user can request deletion from the My Account portal, under Settings and Privacy, then Privacy, Data options and Copilot activity history.
The request clears history across all supported Microsoft 365 apps at once, including Word, Outlook, Teams, and Excel. Users cannot choose individual apps, and full deletion can take some time. Two limits matter for IT leaders. Content a user saved into a file stays in that file. The deletion also does not override retention policies or legal holds the organisation has set. The history disappears from the user’s view, yet a compliant copy may still exist for investigators.
Where is Microsoft 365 Copilot data stored for UK organisations?
For tenants signed up in the United Kingdom, Microsoft’s Product Terms include data residency commitments covering Microsoft 365 Copilot and Copilot Chat. These commitments cover the content of interactions: the prompt, the response, and the citations used to ground the response.
Organisations that need a stronger local-region guarantee can buy the Advanced Data Residency add-on. It must cover every user in the tenant, and existing tenants may need a Global Admin to opt in before data moves. Residency governs where data sits at rest. It is one control, not a full sovereignty strategy, so check your tenant’s Data Location Card rather than assuming.
Is the free Copilot Chat as secure as paid Microsoft 365 Copilot?
Both carry the same baseline protection when users sign in with a work account. Microsoft applies enterprise data protection to Copilot Chat at no extra cost and shows a green shield when it is active.
The real difference is reach. Copilot Chat without a paid licence answers from the public web and cannot use organisational data through Microsoft Graph. The paid licence unlocks the emails, files, chats, and meetings a user can access. That wider reach is why oversharing becomes urgent once paid licences roll out. Files users upload to Copilot Chat are stored in their OneDrive.
Does Microsoft 365 Copilot respect sensitivity labels and encryption?
Yes, provided the labels are configured correctly. When a sensitivity label applies encryption, Copilot returns content only if the user holds both the VIEW and EXTRACT usage rights for that item. Remove EXTRACT, and the user can still open the file, but Copilot cannot summarise or quote it.
Content Copilot creates from labelled files inherits the label with the highest priority, along with its protection settings. Copilot agents cannot read files protected with user-defined permissions. This makes labelling one of the quickest ways to keep board papers or HR files out of Copilot answers without moving them.
Can IT administrators read employees’ Copilot prompts?
Yes, if they hold the right permissions. Prompts and responses are stored in each user’s mailbox. Authorised administrators can find them through Content Search or Microsoft Purview eDiscovery, the same way they search email.
Purview auditing can also record AI interactions for investigations. This visibility helps incident response, but it needs governance. Limit eDiscovery roles to named people, log every search, and state in your employee privacy notice that Copilot interactions are retained and may be reviewed. Clear rules also discourage staff from pasting sensitive data into prompts in the first place.