Practical response guide. Use this to prepare decisions and evidence requests. Collection and containment must follow your organisation’s authority and secure handling arrangements.
Start with the reported disclosure, not the whole tenant
A colleague sees a confidential document mentioned in an assistant answer. That observation matters, but it does not establish that an external party received the document. Record the account, application, approximate time and exact unexpected result. Ask whether the person was already entitled to the source material and whether the answer was subsequently shared. Keep the original report intact; do not ask staff to reproduce sensitive prompts in a public chat.
Define the first decision: stop ongoing exposure, identify recipients or establish whether a policy was breached. Those questions require overlapping but different evidence. A tenant-wide export can create a second sensitive dataset while delaying the answer you actually need.
Preserve the interaction and its surrounding context
Microsoft documents Copilot interaction audit records containing the user, time and references to resources accessed. Availability of additional content and investigation features depends on the workload, configuration, permissions and licensing. Verify these conditions before promising that an investigator can reconstruct every prompt and response.
| Request | Purpose | Caution |
|---|---|---|
| Interaction identifiers and time range | Anchor the reported event | Record timezone and clock differences |
| Available audit export | Identify activity and resource references | Preserve the original export and query scope |
| Source item and access history | Understand the access boundary | Current permissions may differ from incident-time permissions |
| Sharing or delivery records | Identify possible recipients | An accessible link does not prove it was opened |
Separate access, retrieval, output and receipt
Treat these as four separate findings. A broad permission shows potential access. A resource reference can help connect an interaction to a source. Retained content may establish what appeared in an answer. Delivery or recipient-side evidence is needed to assess onward disclosure. Avoid collapsing these stages into “all documents were leaked”.
Equally, missing content does not prove that nothing happened. Record what was searched, the retention window and any unavailable workload. An evidence gap should produce a bounded uncertainty statement and a specific follow-up request, not a reassuring guess.
Contain the boundary that enabled the exposure
If the issue is excessive source sharing, review that source with its business owner. If it involves a compromised identity or connector, assess the account and integration independently. Disabling a user-facing assistant may leave the underlying data permission or credential usable elsewhere. Match the action to the path supported by evidence.
- Name the approver and affected business process.
- Preserve relevant records before changes where operationally safe.
- Record the exact permission, identity or integration change.
- Check whether existing links, sessions or downstream copies remain relevant.
Build a defensible impact statement
Describe the data categories, affected items, known audience and incident window. Keep confirmed recipients separate from potential recipients. Give privacy and legal colleagues the facts they need for their assessment without assigning a legal conclusion from an incomplete technical record. Store sensitive excerpts in the controlled evidence location rather than the general incident chat.
An executive update can be short: what is confirmed, what remains unknown, what has been contained and when the next evidence-backed update is due. Name an owner for each unresolved question so that uncertainty becomes work rather than a permanent disclaimer.
Validate recovery using the intended access rule
A different answer to the same question is not enough. Check that the affected identity cannot obtain the prohibited source through the relevant access path, while authorised work still succeeds. Review sharing and connector configuration with the service owner, and define observation after restoration. Use approved test data where possible.
The final record should include the exposure timeline, evidence references, changes, residual uncertainty and accepted recovery conditions. For collection preparation, use our incident evidence checklist. For broader readiness, review the AI response plan.
Get help with the investigation
Atlant Security provides support for this response workstream as part of our AI incident response services. Start with the affected system, observed behaviour, business impact and urgency. We confirm availability, scope and a secure evidence channel before work begins.
Sources and review
Microsoft: audit logs for Copilot and AI applications; Microsoft: Copilot security and governance controls.
Reviewed 24 October 2026. The decision tables are Atlant Security planning guidance. Images are conceptual illustrations, not screenshots or evidence from a customer incident.
