Whether someone getting only AI meeting recaps is worth the cost, of course, is for your organization to decide. I suppose the same could be said for someone who only uses it to write one email a week, or for other limited-use scenarios. It’s important to bring this reporting to the table when having these discussions, though. So, it might be worth keeping this tip around:
The key was, if you had originally set it for both, and hadn’t gone back and changed it, the policy was still being enforced on both. It would, however, require you to split it across two different policies if you made a change to that policy but if you hadn’t, you were fine.
That’s about to change:
Ewelina gives you the full background on what they are putting out for the rest of us trying to keep our M365 environments secure while users start running around with their agents: https://www.linkedin.com/feed/update/urn:li:activity:7507706670333009920/ As organisations accelerate agentic AI adoption, unmanaged agents can retrieve sensitive data, invoke tools, and take action across systems, often without sufficient…
It’s a real issue, and Copilot is great for living inside the tenant, being the safer option, and giving you some control, but most of that benefit goes away if there is SharePoint sprawl, oversharing, a lack of proper governance and retention policies, or plain neglect.
In fact, Copilot will shine a light on that before you can even get approval for your first label to be published.
You might not be ready for Copilot, or any enterprise AI tool, if your environment lacks proper governance. Sorry.
We can publicly measure the cost of someone using AI against the output of their work. If the user can’t tell the total cost of their AI work, we can create a dashboard of costs and let the workforce judge themselves openly. Since users can’t tell themselves how much compute they’re using, we make it public and make them prove the value.
That seems significant. As someone who works in the legal industry, this is concerning. Some of our clients will not look kindly on us using any third-party tool that can’t provide SOC reports, and I know anyone working with the federal government is looking at that first bullet point about FedRAMP and wondering if they should make sure this isn’t enabled in their environment.
Most are just trying to get through the overwhelming amount of work they need to do. Learning a new tool isn’t on their radar unless it can help them get that work done right this very moment. Meanwhile, we’ve got a bunch of IT leaders spending a ton of time learning these tools or testing the compliance issues involved in using them, which we should do. How much is enough, though? How much time do we dedicate to tools that are going to be used by less than 10% of the workforce?
The surprising part is that someone put the word in a memo. They wrote it down. (Or maybe Copilot wrote it and they didn’t catch it?)
What’s not surprising is that this is the market strategy for an AI tool. Microsoft has a ton of money invested in AI. In many ways, they bet the company on the success of AI generally, and Copilot in particular, and the market just hasn’t developed the way they expected. So, what’s the next step?
When I saw the headline, I immediately thought about how Business Copilot uses a number of Compliance rules that would make that data available to employers. Employers should not be trusted with that. So, good for Microsoft for remembering that before they pushed out this new agent.
You may read that and think that means your employer can see every prompt you enter in Copilot. To some extent, that is true; in the same way, they can see every email message or Teams chat you type with your work account. It is a work account after all. The key piece missing from that simple statement is that it’s not easy to do, and, by design, there are usually very few people who can collect and review that data. Usually, the effort required to do that isn’t worth it. So, if it has happened to you, it’s likely because someone or something has raised a suspicion that warranted an investigation. Most users never reach this level of scrutiny.
