Can't find what you're looking for? Access our previous PDF-based library.
8 min read
️ Updated Jul 24, 20261. Introduction
Microsoft Copilot is an advanced AI tool that can help with a variety of tasks to increase productivity. One of these tasks is its ability to assist in generating content. While this can be a major advantage, Copilot may amplify existing data governance issues if not deployed correctly. It is crucial, therefore, that there is a clear understanding of what the drawbacks are for any potential users and organizations before, during and after the implementation of Copilot. This will ensure that informed decisions can be made to minimize the threat surface and avoid the unintentional exposing of sensitive information, therefore keeping organizational data secure while using Copilot.
2. Why is there a Need to Monitor Copilot?
Microsoft 365 Copilot processes organizational data based on existing user permissions and Microsoft 365 security controls to generate insights and responses. Because Copilot can surface information that users already have access to, it is important for organizations to review and validate user permissions, data classification, and sensitivity labels before and during implementation. Applying the principle of least privilege helps ensure that users only have access to the information required to perform their roles, reducing the risk of unintended data exposure.
The Lepide Data Security Platform provides a comprehensive yet straightforward way to monitor Copilot usage using a range of pre-defined reports. These reports provide information including who has access to Copilot, any changes to Copilot access, inactive users with Copilot access, searches made using Copilot, sensitive data accessed by Copilot and changes to sensitivity labels.
These reports are explained in detail in Section 4 below.
3. The Lepide Copilot Reports
The Copilot reports within the Lepide Solution are in the Lepide Trust and Lepide Auditor sections and are as follows: The Lepide Trust Copilot Reports:
Copilot Access
Copilot Access Changed
Inactive Users with Copilot Access
All Copilot Searches
The Lepide Auditor Copilot Reports:
Sensitive Data Accessed by Copilot
Sensitivity Label Changes
Copilot Usage Comparison Report
The steps on how to run these reports are given below.
4. How to Configure Lepide to Run the Copilot Reports
4.1 Prerequisites
To configure and run the Copilot Reports, you need to have the Lepide Web Console installed and Copilot component configured which is found within the Microsoft 365 component. For details on how to add this please refer to the Web Console User Guide.
4.2 The Lepide Trust Copilot Reports
Once the Copilot component has been configured, you can generate the Copilot reports and the steps to do this are as follows:
The Copilot reports available within Lepide Trust are:
Copilot Access
Copilot Access Changed
Inactive Users with Copilot Access
All Copilot Searches
From the web console home screen, choose Lepide Trust
The Lepide Trust Reports screen is displayed:
From the tree structure to the left side of the screen, expand Copilot to see the Copilot reports:
4.2.1 Generating the Copilot Access Report
This report shows users who have accessed Copilot within the last specified number of days. It includes information about the user name, license type, when the license was granted, the date it was last accessed and how many times the user accessed Copilot. The default number of days is 30 but this can be changed by adding a filter.
To generate the report:
Click on the Copilot Access Report from the tree structure
The empty Copilot Access Report is displayed:
The number of days can be changed by adding a filter:
Click the Filter icon
Modify Filters
The Modify Filters dialog box is displayed:
Click the Edit icon
Copilot Access Report Enter the number of days required in the Filter by Accessed Count in Days dialog box
Click Apply
Click Apply
Click Generate Report to generate the report
The report is generated and can be filtered, sorted and exported to CSV and PDF formats using the Export button
4.2.2 Copilot Access Changed Report
This report shows users for which Copilot access has been changed. It is important to have visibility over these changes to ensure that they are authorized. The report includes the username, the current and previous license type and the date when the access was changed.
To show the Lepide Trust Copilot reports, follow the steps in this section: https://www.lepide.com/knowledgebase/?page_id=4065460226&slug=how-to-secure-copilot-using-lepide
From here, select the Copilot Access Changed Report
The empty Copilot Access Changed Report will be displayed
Click on the Date drop-down menu to add a time frame if required:
Add a filter if required (see the following section https://www.lepide.com/knowledgebase/?page_id=4065460226&slug=how-to-secure-copilot-using-lepide for the steps on how to add a filter)
Click Generate Report
The Copilot Access Changed Report will generate
The report is generated and can be filtered, sorted and exported to CSV and PDF formats using the Export button
4.2.3 Inactive Users with Copilot Access
Inactive users who have Copilot access are a significant security threat as these accounts could have their credentials compromised and Copilot could then be used to gain access to sensitive information without anyone being aware that this is happening.
An example of this report is shown below:
This report is run in a similar way to the Copilot Access Changed Report in the following section: https://www.lepide.com/knowledgebase/?page_id=4065460226&slug=how-to-secure-copilot-using-lepide so please follow these steps to generate the report.
Once the report is generated, it can be filtered, sorted and exported to CSV and PDF formats using the Export button
4.2.4 All Copilot Searches
This report will show all Copilot searches which have been carried out within a specified time frame providing organizations with visibility over what their users are using Copilot for. Information includes the user name, email id, the search query and the date of the search.
An example of this report is shown below:
This report is generated in a similar way to the Copilot Access Changed Report in the following section https://www.lepide.com/knowledgebase/?page_id=4065460226&slug=how-to-secure-copilot-using-lepide so please follow these steps to generate the report.
Once the report is generated, it can be filtered, sorted and exported to CSV and PDF formats using the Export button.
4.3 The Lepide Audit Copilot Reports
Once the Copilot component has been configured, you can generate the Copilot reports and the steps to do this are as follows:
The Copilot reports available within Lepide Auditor are:
Sensitive Data Accessed by Copilot
Sensitivity Label Changes
Copilot Usage Comparison Report
From the web console home screen, choose Lepide Auditor
The Lepide Audit Reports screen is displayed:
4.3.1 Sensitive Data Accessed by Copilot
This report gives detailed information on who is searching and what types of sensitive information are being searched for using Copilot.
All sensitive data accessed by Copilot is shown and the report includes the user name, file name, URL, the sensitivity label, the search query and the date of the search.
An example of this report is shown below:
This report is run in a similar way to the Copilot Access Changed Report in the following section: https://www.lepide.com/knowledgebase/?page_id=4065460226&slug=how-to-secure-copilot-using-lepide so please follow these steps to generate the report.
Once the report is generated, it can be filtered, sorted and exported to CSV and PDF formats using the Export button
4.3.2 Chat View for Sensitive Data Access Reports
A chat window is available in this report that opens when a record is selected. This view displays the complete chat history, including both user queries and Copilot responses, providing full visibility into the interaction associated with the selected record.
4.3.3 Sensitivity Label Changes
This report provides visibility over all changes to sensitive data labels. It shows information including the user name, the current and previous sensitivity labels, the operation which was carried out, file name, URL and the date that the change was made.
An example of this report is shown above:
This report is generated in a similar way to the Copilot Access Changed Report which is explained here: How to Secure Copilot using Lepide | Lepide Knowledgebase so please follow these steps to generate the report.
Once the report is generated, it can be filtered, sorted and exported to CSV and PDF formats using the Export button.
4.3.4 Copilot Usage Comparison Report
The Copilot User Comparison Report provides insights into Copilot usage across users. This report enables customers to compare usage patterns and better understand how Copilot is being utilized within the organization.
An example of this report is shown above:
This report is run in a similar way to the Copilot Access Changed Report in the following section: https://www.lepide.com/knowledgebase/?page_id=4065460226&slug=how-to-secure-copilot-using-lepide so please follow these steps to generate the report.
Once the report is generated, it can be filtered, sorted and exported to CSV and PDF formats using the Export button.
5. Copilot Dashboard
The Copilot Dashboard summarizes the predefined Copilot reports to provide an operational overview of Copilot activities featuring intuitive data visualizations for enhanced governance and insight.
To display the dashboard:
Select Dashboards from the menu on the left of the screen or from the home screen
The list of Dashboards will be displayed:
Click on Copilot and the Copilot Dashboard will be displayed:
Click the Refresh button to refresh the data
6. High Risk Query Alert
This Copilot Alert is included in the list of Threat Models. This capability enables users to monitor and identify potentially high-risk search queries by configuring alerts and defining custom high-risk keywords, providing greater oversight and control over query activity within Copilot.