Not a cloud: an authorization graph
It's easy to think of Microsoft 365 as a set of applications. Architecturally it's better described as many workloads sharing three planes: one identity plane (Entra ID), one data-access plane (Microsoft Graph) and one compliance plane (Purview). Copilot, agents and third-party apps all sit on top of those three and inherit whatever state they hold.
Entra holds the users, groups, apps, agents and Conditional Access. Exchange, SharePoint and OneDrive, Teams, Intune and Defender, and Power Platform sit on it. Microsoft Graph is the one API and permission model across them. Purview carries labels, DLP, retention, audit and DSPM for AI. Copilot, agents and third-party apps come last, and inherit everything above.
That inheritance is the point. AI over Microsoft 365 is an authorization-inheritance problem. It shows each user everything they can technically open, and years of oversharing become instantly searchable.
The question to ask of any AI design over Microsoft 365 is: what permission state does the AI inherit, and which second decision says it may process it?
| Workload | Its role | Why it matters for AI |
|---|---|---|
| Exchange | Mail and calendar | Email and invitations are injection vectors (ASI01) |
| SharePoint and OneDrive | Storage, with permission inheritance | The main oversharing surface |
| Teams | Chat and meetings; files live in SharePoint | Meeting transcripts become grounding |
| Intune | Device compliance, fed into Conditional Access | Lets you require a compliant device |
| Defender | XDR and app governance | Detects risky consent and anomalous Graph use |
| Power Platform | Connectors and Copilot Studio | Every connector is an egress path |
Oversharing, and the tools that hide it
SharePoint permissions inherit by default. Breaking inheritance creates item-level ACLs. Sharing links grant access to whoever holds them. Group membership grows. And grants to "Everyone except external users" quietly make a site readable by the whole company. For years, obscurity hid most of that permission debt: nobody found the budget spreadsheet because nobody knew where to look. Semantic search removes the obscurity.
Microsoft offers two controls that limit what search and Copilot surface. Neither changes permissions.
- Restricted Content Discovery (RCD) is a site-level setting. It affects only tenant-wide search and Microsoft 365 Copilot, it doesn't change who can open anything, and overusing it can degrade performance.
- Restricted SharePoint Search (RSS) is retiring. New enablement is blocked from 31 July 2026[1], and Microsoft points to RCD instead. Microsoft's page no longer gives a final retirement date (a date of 31 January 2027 was reported earlier and is now unverified), and nothing migrates automatically. Content that RSS was keeping out of results may become discoverable once it goes, unless it's restricted another way or its permissions are fixed. Microsoft's own page describes RSS as a temporary measure that "isn't a security boundary".
The root fix is permission remediation: data security posture assessments, access reviews, and site sensitivity labels that enforce privacy and sharing settings.
The two-decision model
The two decisions behind every answer Microsoft 365 Copilot gives
User
Asks Copilot a question
Microsoft Entra ID
Identity, groups, Conditional Access
Decision 1: can the user open it?
The item's ACL, inheritance and sharing links
Decision 2: may the AI process it?
Purview DLP on the Copilot location, by sensitivity label
Answer
With citations to what it used
Decision 2 is a Purview DLP policy on the Microsoft 365 Copilot and Copilot Chat location. With the condition Content contains > Sensitivity labels, it stops Copilot using labelled files and emails in its responses. The items can still appear in citations, but their content isn't processed. In Word, Excel and PowerPoint, Copilot's skills are disabled for a file with a covered label. Prompts that contain sensitive information types can be blocked from processing and from web search.
Four details from Microsoft's documentation shape how you use it:
- The location is only available in the Custom policy template[2].
- Selecting it disables every other location in that policy, so Copilot DLP becomes a separate policy estate, and drift between it and your workload DLP is a risk.
- Policy updates can take up to four hours to reach Copilot[2].
- In the Office apps, the policy is evaluated when a file is opened, so a label applied mid-session takes effect the next time the file opens.
Graph permissions and consent
| Type | What the app can reach | The risk |
|---|---|---|
| Delegated | The intersection of the app's scopes and the signed-in user's access | Consent phishing; broad *.All scopes |
| Application | The app's own access, across the whole tenant | Sites.Read.All means every site |
Selected (Sites.Selected, and Lists, ListItems and Files.SelectedOperations.Selected) | Nothing until an explicit grant is made on each resource[3] | Making that grant requires Sites.FullControl.All, so the identity that grants is privileged |
Sites.Selected is generally available for Microsoft Graph and the legacy SharePoint APIs, in both delegated and application forms.
The pattern for an AI connector: use Selected scopes with per-site or per-list grants, under a workload identity with a federated credential, so the connector reads only what you have decided it may.
Entra Agent ID
An agent identity in Microsoft Entra is a special kind of service principal created from an agent identity blueprint. The blueprint is a template and also an identity in its own right, one that can do exactly one thing in the tenant: create and remove agent identities.
Three facts shape how you design with it:
- Credentials live on the blueprint. Agent identities authenticate using credentials configured on their blueprint[4]. The blueprint may hold client secrets and certificates as well as federated identity credentials, and Microsoft advises against secrets in production. So "credential-less agents" is not true of the system as a whole: one blueprint credential can mint tokens for every agent made from it.
- Policy applies at the blueprint. Conditional Access policies can target a blueprint and so every agent identity created from it, and disabling a blueprint stops all of its agents authenticating.
- Permissions can be inherited, by design. Microsoft's documentation describes inheritable permissions: when an administrator grants permissions on the blueprint principal from a resource app marked as inheritable, every agent identity created from that blueprint receives them[5]. The declarations don't grant anything on their own; an administrator still has to consent. This edition of the atlas originally recorded inheritance as an open question; the current documentation resolves it, and you should still test the behaviour in your own tenant.
The design consequence: the blueprint is the blast-radius unit for agents. Scope one blueprint per agent type and data domain, back its credential with a managed identity's federated credential rather than a secret, and monitor token issuance from it as a Tier-0 signal. Copilot Studio can assign agent identities automatically, and Agent 365 gives each agent an Entra Agent ID.
How Microsoft 365 couples to everything else
| Coupled with | Through | Why it matters |
|---|---|---|
| Azure | The same tenant; a Global Administrator can elevate to the Azure root | Microsoft 365 administration is Tier-0 for Azure too |
| Other SaaS | Single sign-on and SCIM; Graph connectors import external content | Map the external ACLs, or the import overshares |
| Data platforms | Bulk export, Fabric | Bypasses per-request DLP |
| Automation | Power Automate, Logic Apps | Needs connector DLP of its own |
| Security | Defender, Purview audit, Sentinel | Copilot interactions are audited events |
How it fails
Unlabelled sensitive content passes Decision 2. The four-hour lag leaves a window after every policy change. Policy drifts between the Copilot DLP estate and the workload DLP estate. The identity holding Sites.FullControl.All is compromised. And RSS retires, taking its restrictions with it.
Questions to ask in a review
What's the permission debt, measured? What fraction of sensitive content is labelled? Who holds the granting permission? What happens in the four hours after a policy change? Which sites does RSS currently hide, and what will hide them after January 2027?