Security Architecture: How Microsoft 365 Copilot Protects Your Client Data

For legal professionals, data security is not merely a technical concern — it is a professional obligation. The duty of confidentiality under ABA Model Rule 1.6 requires attorneys to make reasonable efforts to prevent the inadvertent or unauthorized disclosure of information relating to the representation of a client. When adopting any new technology tool, attorneys must understand how that tool handles client data and whether its security architecture is consistent with their professional obligations.

Microsoft 365 Copilot is designed from the ground up with enterprise security requirements in mind. Its architecture includes three distinct layers of protection that work together to ensure that client data remains confidential, that access is appropriately controlled, and that all AI interactions are subject to the same compliance controls that govern the rest of your Microsoft 365 environment.

Layer 1: Tenant Isolation

The first and most fundamental layer of security is tenant isolation. Your firm’s Microsoft 365 tenant is a logically isolated environment that contains all of your organization’s data — emails, documents, Teams conversations, SharePoint files, and calendar entries. When you use Copilot Work, all processing occurs within your tenant. Your prompts are not sent to a shared AI infrastructure that other organizations can access. Your documents are not used to train Microsoft’s AI models. Your client data does not leave your controlled environment.

This is a critical distinction from consumer AI tools. When you type a prompt into ChatGPT or Claude, that prompt is processed on OpenAI’s or Anthropic’s shared infrastructure. Depending on the service’s terms of use, your input may be used to train future versions of the model. There is no guarantee that your data is isolated from other users’ data. For legal professionals handling confidential client information, this creates an unacceptable risk of inadvertent disclosure.

With Copilot Work, none of these concerns apply. Your data stays in your tenant, processed under your firm’s security policies, subject to your compliance controls.

Layer 2: Permission Enforcement via Microsoft Graph

The second layer of security is permission enforcement through Microsoft Graph. When Copilot accesses your content to generate a response, it does so through Microsoft Graph, which enforces your existing Microsoft 365 permissions. This means that Copilot can only access content that you are already authorized to see — it cannot circumvent your firm’s access controls, ethical walls, or matter-specific permissions.

The permission flow works as follows: when you make a request to Copilot, Copilot queries Microsoft Graph for relevant content. Microsoft Graph checks your permissions in Azure Active Directory. If you are authorized to access the content, it is retrieved and used to inform Copilot’s response. If you are not authorized, the content is not accessible to Copilot — it will not appear in summaries, it will not be referenced in drafts, and Copilot will not acknowledge its existence.

This permission-aware architecture means that Copilot inherently respects your firm’s ethical walls. If you have configured SharePoint permissions to prevent certain attorneys from accessing certain matter files — for example, to manage conflicts of interest — Copilot will respect those restrictions automatically. You do not need to configure Copilot separately; it inherits your existing permission structure.

Layer 3: Compliance Integration

The third layer of security is integration with Microsoft’s compliance tools, including Microsoft Purview, Data Loss Prevention (DLP) policies, and sensitivity labels. These tools allow your firm to define and enforce information governance policies that apply to all content in your Microsoft 365 environment, including content generated by Copilot.

Sensitivity Labels are classifications applied to documents that control how they can be shared, copied, and accessed. Common sensitivity labels for law firms include “Confidential — Attorney-Client Privilege,” “Confidential — Work Product,” “Internal Use Only,” and “Public.” When Copilot generates content based on a labeled document, it automatically applies the same label to the generated content, ensuring that the confidentiality classification is maintained throughout the document lifecycle.

Data Loss Prevention (DLP) Policies prevent the unauthorized sharing of sensitive information. For example, a DLP policy might prevent any document labeled “Confidential — Attorney-Client Privilege” from being emailed to an external address, or block the copying of privileged content to a personal device. Copilot respects all DLP policies — it cannot suggest actions that would violate your firm’s DLP rules, and it cannot generate content that bypasses these controls.

Audit Logs record all Copilot interactions, creating a complete record of how AI was used in your firm. This audit trail is valuable for compliance purposes, for responding to e-discovery requests, and for identifying potential policy violations. Administrators can review Copilot usage logs through Microsoft Purview’s compliance portal.

Implementing Security for Your Firm

For small law firms implementing Copilot, the following security configuration steps are recommended as a baseline. Work with your IT administrator or Microsoft partner to implement these controls before rolling out Copilot to your team.

First, define your sensitivity label taxonomy based on your practice areas and confidentiality requirements. At minimum, create labels for attorney-client privileged communications, attorney work product, internal firm communications, and public content. Apply these labels consistently to all new documents and retroactively to existing documents where practical.

Second, configure DLP policies to prevent the unauthorized sharing of labeled content. At minimum, prevent external sharing of privileged and work product documents, and alert administrators when sensitive content is accessed in unusual patterns.

Third, establish ethical walls for any matters where conflicts of interest require restricting access. Configure SharePoint permissions to enforce these restrictions, and verify that Copilot respects them by testing with a test account that has restricted access.

Fourth, enable audit logging for Copilot interactions and establish a regular review process. Review logs at least monthly to identify any unusual usage patterns or potential policy violations.

Fifth, document your AI usage policies in your firm’s employee handbook and engagement letters. Clients should be informed when AI tools are used in their matters, consistent with your duty of communication under Rule 1.4.