No Ticket Needed

Appearance

Quick Answer

Microsoft 365 Copilot can only access data you already have permission to view — your emails, chats, and files. It does not access other people's data, your personal browsing, or files outside Microsoft 365. Copilot responses are not stored or used to train AI models.

Understanding What Copilot Can See — Privacy and Data Access ​

Applies to: Microsoft 365 Copilot (all apps)
Article Type: Informational
Last Updated: 2026-07-16

Summary ​

Microsoft 365 Copilot is a powerful AI assistant — but it raises a natural question: what can it see? This guide explains exactly what data Copilot can access, what it can't, and how your organization's existing permissions keep your information safe.

Prerequisites ​

  • A Microsoft 365 account (Copilot license not required to read this guide).

Instructions ​

The Short Answer ​

Copilot can only see what you can already see. It uses your existing Microsoft 365 permissions — the same files, emails, and chats you have access to. It cannot see data you don't have permission to view, and it cannot access other people's private content.

What Copilot Can Access ​

Data SourceWhat Copilot Can SeeExample
Your emails (Outlook)Emails in your mailbox that you can readSummarizing your inbox, drafting replies
Your files (OneDrive)Files in your personal OneDriveGenerating a presentation from a Word doc you own
Shared files (SharePoint)Files in SharePoint sites you have access toSummarizing a team report shared with your department
Your chats (Teams)Teams conversations you're a participant inSummarizing a meeting chat or catching up on a channel
Your calendar (Outlook)Meetings and events you're invited toPreparing for an upcoming meeting based on the agenda
Your meeting transcriptsTranscripts from meetings you attendedGenerating action items from a recorded meeting

What Copilot Cannot Access ​

Data SourceWhy Not
Other people's private emailsYou don't have permission to read them
Files you're not shared onSharePoint and OneDrive permissions block access
Private chats you're not part ofTeams enforces conversation membership
HR, payroll, or confidential systemsThese are separate systems not connected to Copilot
Data from personal Microsoft accountsCopilot only works with your work account
Data from outside Microsoft 365Copilot doesn't access Salesforce, SAP, or other third-party tools (unless your org has configured connectors)

How Permissions Work with Copilot ​

Copilot respects the same permission model as Microsoft 365:

  1. If you can open a file, Copilot can reference it.
  2. If you can't open a file, Copilot can't see it — even if it knows the file exists.
  3. If a file is shared with "Everyone in the organization," Copilot can access it for anyone in the organization.

WARNING

This is the key privacy consideration: If your organization has broadly shared files (like a SharePoint site shared with "Everyone"), Copilot can surface that data in its responses to anyone. This isn't a Copilot-specific risk — it's an existing permissions issue that Copilot makes more visible. Talk to IT if you're concerned about oversharing.

What Copilot Does with Your Data ​

QuestionAnswer
Does Microsoft use my data to train its AI models?No. Microsoft has committed that your organizational data is not used to train the foundation models.
Are my prompts stored by Microsoft?Prompts and responses are processed in real-time and subject to your organization's data retention policies. Microsoft does not retain them for model training.
Can my IT admin see my Copilot prompts?By default, no. IT admins can enable audit logging that records Copilot activity, similar to how they can audit email and file access.
Does Copilot share data between users?No. Copilot respects individual permissions. User A's prompts and results are not visible to User B.
Can Copilot access my personal (non-work) Microsoft account?No. Copilot only operates within your work or school Microsoft 365 tenant.

Common Privacy Concerns ​

"Will Copilot accidentally reveal sensitive information?" ​

Copilot only surfaces information you already have access to. If you ask it to summarize a confidential document, it will — because you have permission to read that document. The risk isn't Copilot exposing data; it's that the data was already accessible to you.

"Does Windows Recall record what I do, the way Copilot reads my files?" ​

No — they are separate features with separate data. Copilot reads Microsoft 365 content you already have permission to open. Windows Recall takes periodic snapshots of your screen and keeps them on the PC itself, and it runs only on Copilot+ PCs where someone has turned it on. See Understanding Windows Recall — What It Records and Your Privacy for how to check whether it is enabled on your machine.

"Can Copilot see my private Teams chats?" ​

Only if you're asking Copilot about your own chats. Copilot cannot access chats between other people, even if they're in the same organization.

"Can my boss use Copilot to read my emails?" ​

No. Copilot respects mailbox permissions. Your boss can only see your emails if they already have delegate access to your mailbox — and that's an Outlook feature, not a Copilot feature.

"What if I share a file and then remove access?" ​

Once you remove someone's access to a file, Copilot can no longer reference that file for them. Permissions are enforced in real-time.

Best Practices for Using Copilot Safely ​

  1. Don't paste sensitive data into Copilot prompts unnecessarily. While your prompts are protected, it's good practice to reference files by name rather than copying their contents.
  2. Review Copilot's output before sharing. Copilot may surface information from documents you didn't intend to include. Check the sources it cites.
  3. Be mindful of broadly shared files. If you have files shared with "Everyone," consider tightening permissions. See How to Share Files and Folders in OneDrive.
  4. Don't enter confidential information in prompts (like passwords, SSNs, or financial account numbers). Copilot doesn't need this data and shouldn't have it.

TIP

Think of Copilot as a very fast assistant who has read all the documents you have access to. It won't go rifling through other people's desks — but it will surface everything on your desk, even files you forgot about.

Troubleshooting ​

WARNING

If Copilot surfaces a file or email you didn't expect, it means you already have access to it — even if you didn't know. This can happen with SharePoint sites that use broad sharing settings. If you believe you can reach files you shouldn't, ask IT to check the sharing settings on that site and tighten them — send them the file's link and the name of the site it came from.

Symptom / ErrorPotential CauseSolution
Copilot references a file I didn't know I had access toFile is shared with "Everyone" or a broad groupThis is a permissions issue, not a Copilot issue. Contact IT to review the sharing settings.
Copilot can't find a file I know existsYou don't have permission to access itAsk the file owner to share it with you, then try again.
Copilot gives outdated informationIt's referencing an old version of a fileOpen the file, verify it's the latest version, and re-ask the question.
Copilot includes information I don't want sharedIt pulled from accessible but sensitive filesReview the response before sharing. Edit out sensitive content or rephrase your prompt to exclude specific data sources.