What data can Microsoft 365 Copilot access?

Last updated: 27 September 2026

Microsoft 365 Copilot can access the same work data that the signed-in user already has permission to see in Microsoft 365. That includes their emails, calendar, chats, meetings and the files they can open in OneDrive, SharePoint and Teams. It cannot see anything the user is not allowed to access.

How does Copilot find your data?

Copilot uses Microsoft Graph, the service that connects your Microsoft 365 content, to search for relevant information when you ask a question. It respects your existing permissions, sensitivity labels and retention policies. Data stays within your Microsoft 365 tenant and service boundary.

Why permissions matter

Copilot does not create new access, but it makes existing access much easier to use. If a SharePoint site or folder has been overshared, for example shared with “Everyone”, Copilot can surface that content to anyone in the organisation. Before rolling out Copilot, review:

• Who has access to sensitive SharePoint sites, Teams and shared folders
• Links shared with “anyone” or the whole organisation
• Whether sensitive files have sensitivity labels applied

Does Copilot use my data to train AI?

No. Microsoft states that prompts, responses and data accessed through Microsoft Graph are not used to train the foundation AI models. See does Copilot train on your company data?

Our AI Readiness Sprint reviews permissions, labelling and governance so you can roll out Copilot safely.