Microsoft CoPilot - Overview - Part 1

brencronin
8 hours ago
3 min read

Updated: 1 hour ago

Brief Overview of How Microsoft 365 Copilot Works

Microsoft Copilot is an AI-powered processing and orchestration engine that combines several Microsoft technologies to deliver contextual productivity assistance. At a high level, Copilot coordinates three key components:

Large Language Models (LLMs) — provide the AI reasoning and natural-language processing capabilities.
Microsoft Graph — provides access to organizational context, including emails, chats, documents, meetings, and other content the user is authorized to access.
Microsoft 365 applications — integrate Copilot into the productivity tools users work with every day, such as Word, PowerPoint, Outlook, and Teams.

Together, these components allow Copilot to understand a user's request, retrieve relevant organizational context, process that information through an LLM, and provide results within the appropriate Microsoft 365 application.

Core architecture, in plain terms:

Identity-bound access - Copilot does not have its own permissions. It inherits the querying user's existing Entra ID identity and Graph permissions (Exchange, SharePoint, OneDrive, Teams, Loop). It can only "see" what that user could already see, but it can see and correlate it far faster than the user could manually.
Retrieval-Augmented Generation (RAG) - When a user asks a question, Copilot performs a semantic search across the tenant's indexed content (email, chat, documents), pulls relevant snippets into the model's context window, and generates a response grounded in that retrieved content. This retrieval step is the single most important architectural fact, it means Copilot routinely ingests content that no human at the organization has reviewed, including attacker-supplied email bodies, shared documents, Teams messages, and Loop components.
Tool / plugin invocation - Copilot can call defined tools (e.g., search_enterprise, office365_* connectors, web search, and, critically, a record_memory tool for persistent personalization) to take actions or retrieve data beyond the immediate chat context.
Persistent memory - Newer Copilot builds retain "memories" about the user across sessions (M365 Copilot's record_memory; Consumer Copilot's memory_durable_fact). This is on by default in many deployments and, per Microsoft's own documentation as of early 2026, memory read/write actions do not generate Purview audit log entries.
Rendering surfaces - Copilot output can render as formatted text, Markdown, clickable citations/links, and, in some hosting contexts, inline HTML previews. Each rendering surface has its own Content Security Policy (CSP), and CSPs vary significantly depending on where Copilot is hosted (BizChat, Word Online, Excel Online, SharePoint, Teams).

The threat-model shift this creates

Historically, breaching a mailbox meant an attacker had to manually search for what mattered. Copilot means an attacker no longer needs mailbox access at all, they only need the ability to get content in front of Copilot (an email, a shared file, a Teams message, a crafted URL) and let Copilot itself perform the search, correlation, summarization, and, in some vulnerability chains, the exfiltration, using the victim's own authenticated session and normal-looking Graph API / HTTPS traffic. This is why Copilot abuse is difficult for traditional DLP, CASB, and EDR tooling to catch: the traffic looks like ordinary Copilot usage.

The Lethal Trifecta and Microsoft 365 Copilot

The various Microsoft 365 Copilot experiences can access user-authorized content such as email, chat conversations, SharePoint documents, OneDrive files, and other Microsoft 365 data. That content can also contain untrusted data, including malicious emails, compromised documents, external content, or attacker-controlled instructions that are incorporated into the model's context.

As a result, Microsoft 365 Copilot inherently possesses two of the three capabilities that comprise the Lethal Trifecta:

Access to private data — Copilot can retrieve and process data the user is authorized to access.
Exposure to untrusted content — Copilot may encounter attacker-controlled or otherwise untrusted content through email, documents, web content, chats, and other data sources.

The third capability, external communication, is therefore particularly important from a security perspective. It is also the capability that can be most directly constrained through security controls, which is why many AI security mitigations focus on restricting or explicitly authorizing an agent's ability to communicate externally or take consequential actions.

Indirect prompt injection exploits the interaction between these capabilities by placing malicious instructions within content the AI is likely to process. The objective is to influence the model into taking actions that were not intended by the user, potentially causing it to access sensitive information and transmit that information externally.

There is no deterministic control that can guarantee an LLM will never be influenced by indirect prompt injection. Consequently, the security strategy should not depend on the model always correctly distinguishing trusted instructions from untrusted content.

Instead, limit what the AI is capable of doing when it is compromised or manipulated. Define and enforce the actions, permissions, data access, and external communication channels available to the agent, and threat-model the worst-case outcome if the agent follows an attacker's instructions.