Microsoft Copilot Security: Personal vs Work Copilot
Tell personal Copilot apart from Microsoft 365 Copilot. Log prompts, including desktop Copilot, and stop sensitive data.
- Microsoft Copilot
- ChatGPT
- Google Gemini
- Claude
- Allow & log
- Redact
- Block
- Deny app
Risks of Microsoft Copilot use
Two different Copilots
Microsoft 365 Copilot signed in with an Entra ID work account comes with enterprise data protection. Copilot signed in with a personal Microsoft account does not.
Built into Windows
Copilot ships with Windows. Employees can use it without installing anything.
License confusion
having Microsoft 365 licenses does not mean every Copilot session is a work session.
Recommended AI Control policy
Scope: Windows, macOS and Linux devices with the Moftgate agent. Personal phones without the agent are out of scope.
- 01
Mark Microsoft 365 Copilot as an approved provider: Allow & log.
- 02
Consumer Copilot domain (copilot.microsoft.com) × all apps: Block on sensitive classifications.
- 03
Desktop Copilot uses WebSocket. On this channel, Redact is applied as Block; plan the rule for that.
Allow & log
The prompt is sent and recorded.
Redact
Matched data is masked and the masked prompt is sent.
Block
The prompt is not sent and the event is recorded.
Deny app
The app cannot talk to this provider at all.
Questions about Microsoft Copilot
Details are based on policies published by Microsoft and public reports. Plans and settings can change; check current terms with the vendor.
See your Microsoft Copilot use in one week
AI Control logs prompts and masks or blocks sensitive data. Data stays on your own servers.