When I saw the headline, I immediately thought about how Business Copilot uses a number of Compliance rules that would make that data available to employers. Employers should not be trusted with that. So, good for Microsoft for remembering that before they pushed out this new agent.
You may read that and think that means your employer can see every prompt you enter in Copilot. To some extent, that is true; in the same way, they can see every email message or Teams chat you type with your work account. It is a work account after all. The key piece missing from that simple statement is that it’s not easy to do, and, by design, there are usually very few people who can collect and review that data. Usually, the effort required to do that isn’t worth it. So, if it has happened to you, it’s likely because someone or something has raised a suspicion that warranted an investigation. Most users never reach this level of scrutiny.
I do appreciate that the water between the two tools is less muddy. It’s still not clear. There is still confusion among the average users, but it’s a little less murky. That’s a good thing.
How many organizations have a tenant and have simply left a lot of the default settings from when they bought their first licenses? What would that look like now?
Will that ever be enough revenue to offset the massive investments they’ve made in AI? Time will tell. Right now, these are some early warning signs, but also small enough that I can’t imagine they’ll move the needle one way or the other. I’m not jumping to any conclusions based on them, but I do have my eyes open.
If we can’t trust Microsoft’s own tools to work, people will look for other tools. The advantage of being the built-in tool disappears when we can’t trust it.
Microsoft has made efforts to make it clearer when a call is from outside the tenant, and I think that helps. Still, it might now be a good idea to review the proper procedures with your users, and for larger organizations where users may not recognize the support team, an identity verification step might also be worth considering.
If you can get Copilot to drop a link into the auto-summary, it would be less suspicious than an email sent from outside with a link. That’s probably true. After all, if you trust your AI Summarization tool to summarize the email instead of reading it, why wouldn’t you trust any links it included?
It just isn’t clear to them that they would need to pay for that when they’re already using Copilot to help them write emails and summarize log documents. They are using AI for free on their work PC, their home PC, everywhere. Microsoft has done a really good job of explaining the difference to people who follow Microsoft blogs, but an extremely poor job of explaining it to the average M365 user.
It doesn’t help that they keep changing what is included in the free version, either.
