Microsoft 365 Copilot costs $30/user/month for enterprise customers and is actually an add-on to Microsoft 365. That is pretty expensive, but it can also be very useful for companies that want AI assistance grounded within their own infrastructure. However, it is important to note that Microsoft 365 Copilot does have the ability to search the web, and while that may worry some IT admins, the Redmond tech giant is eager to alleviate those concerns.
In a lengthy blog post, Microsoft has explained the working of Microsoft 365 Copilot, including offering assurances about its layers of protection and transparency. Starting off with web search, the Redmond tech giant has highlighted how important it can be to return results grounded in real-time web data. Meanwhile, if IT admins disable it, the model will rely on its historical training data, which may be outdated.
If IT admins are still unsure about enabling web search, perhaps it is better to understand how it works. When a user queries Microsoft 365 Copilot, the prompt in question stays inside the scope of the Microsoft 365 service boundary while the AI assistant evaluates keywords to determine if a web search would be useful. If that is the case, it crafts a web query and sends it to Bing, without metadata related to the user or the tenant. A secure response is generated, which is then grounded with approved enterprise content and returned to the user. The user also has the ability to view the citations and keywords used for web grounding.
There are four layers of protection and control surrounding this mechanism. Admin controls ensure when and how web search is allowed, with logs related to the prompt, web query, and the result accessible in a traceable format in Microsoft Purview eDiscovery and Data Security Posture Management activity explorer. Secondly, the user can also disable web grounding, while Copilot itself has certain guardrails that enable it to reject terms that pose a certain level of risk.
Next, Copilot does not send the full prompt to the Bing search engine; it strips all user metadata and stores the response securely, too. Finally, Microsoft is contractually obligated in many ways, which restrict it from using query data to train AI models, improve Bing, or create ad personas.
Overall, Microsoft has assured enterprise customers that they have full control from start to end. So if they are considering enabling web search, they should train their users on transparency and control, enable audits, document allowed and restricted scenarios, protect sensitive files through Data Loss Prevention (DLP) for Copilot, and start with a policy that "maximizes value". Redmond is adamant about enterprise customers and IT admins leveraging Microsoft 365 Copilot as much as they can, to the point that it recently endorsed the use of personal Copilot licenses in work environments.