Outlook Data Grounding
Has anyone else been fighting with Microsoft Copilot and data grounding recently?
We've been looking at this pretty heavily from an enterprise/GDPR perspective, and one thing that has surprised me is how difficult it is to separate "allow users to use Copilot" from "allow Copilot to access organisational data."
Our requirement seemed pretty straightforward:
Users can use Copilot Chat, but Copilot should NOT be able to access or ground responses using Outlook, SharePoint or OneDrive data.
In particular, Outlook was the concern. Once Copilot has access to the Microsoft 365/Graph side of the environment, it can use organisational context rather than behaving like a standalone AI chatbot.
What we expected to find was a simple tenant-wide admin control along the lines of:
«Allow Copilot Chat: YES
Allow Outlook grounding: NO
Allow SharePoint grounding: NO
Allow OneDrive grounding: NO»
Instead, we've ended up having to disable Copilot across the Microsoft 365 applications themselves.
We've now used Integrated Apps in the Microsoft 365 Admin Center to disable Copilot in Outlook, Word, Excel and Teams across web/desktop, and this also appears to have disabled it in Outlook mobile. Copilot.com is blocked as well.
We've left the basic Copilot experience in Edge available, where it can be used without access to our Outlook/SharePoint/OneDrive organisational data.
We've also tested Purview/DLP controls, but that's a very different approach — you're controlling what protected/classified content Copilot can process rather than simply saying "Copilot cannot access Outlook."
It feels like there should be a much cleaner administrative boundary between Copilot as an AI assistant and Copilot with access to Microsoft 365 organisational data.
Maybe I'm missing something obvious.
Has anyone found a supported way to centrally allow Copilot Chat while completely disabling Outlook/SharePoint/OneDrive grounding for the entire tenant?
Especially interested in hearing from anyone dealing with this in an EU/GDPR environment.