Securing Gen AI and Microsoft Copilot: How Zscaler Data Protection Keeps Sensitive Data Safe Steve Grossenbacher

A Focus on Securing Data from AIAs enterprises rapidly adopt Microsoft Copilot and other Generative AI (Gen AI) applications, ensuring their security is paramount. While these tools enhance productivity and streamline workflows, they also introduce significant security risks. Sensitive data may be inadvertently exposed, and unauthorized AI applications can proliferate within an organization. Businesses must take a proactive approach to prevent security breaches.

Zscaler’s Data Protection provides organizations with the visibility and control necessary to embrace AI and Copilot safely. This blog explores how enterprises can secure Public Gen AI applications while also minimizing risks of data oversharing via Microsoft Copilot.

Understanding data loss to Public AIAI has transformed businesses with powerful new approaches that can boost productivity and drive competitive advantages. However, one of the biggest risks of leveraging public AI is the potential exposure of confidential information.

Customer data, proprietary code, and internal business information can be sent to AI and become part of model training, increasing the risk of unauthorized access and data breaches. These risks can be managed with a strong Data Protection architecture, which enables:

Instant Data Discovery: Identifying all sensitive data and where it is headed.
Powerful Shadow AI Visibility: Detecting risky unsanctioned AI app usage.
Smart Isolation Capabilities: Containing risky interactions with AI applications.

By implementing strong data protection solutions, businesses can maximize AI’s productivity benefits while maintaining strict security controls.

Uncovering Shadow AIBefore organizations can secure AI applications, they must first gain visibility into all instances of AI usage within their environments. Shadow AI—unauthorized AI applications deployed by employees—poses a serious security challenge. Employees using AI tools without IT oversight may unknowingly share sensitive data with external third-party systems, increasing the risk of data leaks.

Identifying and managing Shadow AITo combat Shadow AI, businesses must implement solutions that detect and monitor AI usage across networks:

Application discovery – AI-driven tools scan enterprise environments to detect unauthorized applications in use.
User activity monitoring – Security teams analyze how employees interact with AI applications to assess risks.
Risk-based access controls – Organizations can enforce policies to restrict unauthorized AI applications while enabling secure use of approved tools.
A recent study found that 38% of employees share sensitive work information with AI tools without employer permission.1 By actively tracking AI interactions and applying zero trust access controls, organizations can reduce exposure to Shadow AI risks while still enabling AI-driven productivity.

Additionally, understanding an organization’s risk landscape is crucial in combating Shadow AI. AI-driven auto-discovery provides real-time visibility into where sensitive data resides and how it moves across environments—from endpoints and SaaS to private apps. This allows security teams to apply controls consistently and eliminate blind spots, making it easier to enforce data protection measures.

Securing Public AI ApplicationsOnce an organization understands its AI landscape, securing interactions between users and AI applications becomes the next priority. Without strong security measures, organizations risk unintentional data exposure, intellectual property theft, and compliance violations.

Implementing AI governance policiesA robust AI governance framework should include:

Acceptable data usage policies – Defining what types of data AI applications can process.
Authorized AI use cases – Outlining which AI tools are permitted for business use.
Ongoing compliance monitoring – Continuously monitoring AI usage to ensure compliance with corporate policies and regulatory standards.

By establishing clear governance policies, IT teams and end users can be guided in responsible AI usage. Regular audits ensure that AI adheres to these standards, minimizing the risk of accidental data misuse.

Applying data protection measuresBeyond governance, organizations should implement advanced data loss prevention strategies to protect sensitive information from being inadvertently accessed or shared by AI applications. Key protection measures include:

Inline DLP Inspection: Monitoring AI interactions in real time to prevent unauthorized data transfers.
Cloud App Control: Blocking or cautioning unsanctioned AI apps used by an organization’s users.
Inline Prompt Control: Monitoring AI input prompts to prevent sensitive data from entering prompt workflows.
Isolation of AI Apps: Isolating users and AI apps in a secure cloud browser to control interactions such as cut, paste, and download.

By integrating data protection security controls, organizations can leverage AI-driven efficiencies while ensuring sensitive data remains protected and compliant.

Securing Microsoft Copilot DataMicrosoft Copilot is a powerful tool that enhances productivity by integrating AI-driven automation into daily workflows. However, its deep access to Microsoft 365 data poses a significant security challenge. Copilot can pull information from SharePoint, OneDrive, and Teams, which, if not properly governed, could expose sensitive data to unintended users.

For example, if an employee requests Copilot to summarize sales trends, misconfigured permissions could allow it to surface financial reports, customer details, or even internal acquisition plans. Since Copilot relies on existing user permissions, any overly accessible data can become an unintended security risk. Organizations must take a proactive approach to access control and data protection to ensure Copilot enhances productivity without introducing security gaps.

Data Protection for Microsoft Copilot SecurityTo mitigate these risks, organizations need to enhance standard Microsoft Security with additional data protection approaches, ensuring that only authorized users and applications access the correct data.

OneDrive Permissions: Leveraging CASB, organizations can revoke excessive permissions in OneDrive to prevent Copilot consumption and sharing.
Preview Sensitivity Labels: Identify and update sensitive data that is missing sensitivity labels to prevent Copilot consumption and sharing (via CASB).
Fix Copilot Misconfigurations: Scan and fix Microsoft 365 and Copilot misconfigurations that could expose data to unnecessary risk.

Controlling Copilot and Data with Inline Data ProtectionEven with proper access controls in place, organizations should use inline data protection controls to ensure sensitive data remains secure within the context of Copilot use. This requires:

Input Prompt Visibility: Understand how users are interacting with and using Copilot through session and prompt visibility.
Inline DLP Inspection: Leverage inline DLP dictionaries to prevent sensitive data from entering Copilot workflows.
Purview Label Blocking: Extend your Copilot security by enabling the blocking of data leaving the organization based on Purview sensitivity labels.

By layering these advanced data protection approaches with Microsoft’s built-in protections, businesses can confidently adopt Copilot while ensuring their most sensitive information remains secure and compliant. However, many organizations underestimate the risks posed by over-permissioned data in Microsoft 365.

A recent Zscaler blog on Microsoft Copilot security explores even more how businesses can audit permissions, monitor AI interactions, and enforce Zero Trust principles to prevent Copilot from exposing sensitive data to unauthorized users.  

​[#item_full_content] [[{“value”:”A Focus on Securing Data from AIAs enterprises rapidly adopt Microsoft Copilot and other Generative AI (Gen AI) applications, ensuring their security is paramount. While these tools enhance productivity and streamline workflows, they also introduce significant security risks. Sensitive data may be inadvertently exposed, and unauthorized AI applications can proliferate within an organization. Businesses must take a proactive approach to prevent security breaches.

Zscaler’s Data Protection provides organizations with the visibility and control necessary to embrace AI and Copilot safely. This blog explores how enterprises can secure Public Gen AI applications while also minimizing risks of data oversharing via Microsoft Copilot.

Understanding data loss to Public AIAI has transformed businesses with powerful new approaches that can boost productivity and drive competitive advantages. However, one of the biggest risks of leveraging public AI is the potential exposure of confidential information.

Customer data, proprietary code, and internal business information can be sent to AI and become part of model training, increasing the risk of unauthorized access and data breaches. These risks can be managed with a strong Data Protection architecture, which enables:

Instant Data Discovery: Identifying all sensitive data and where it is headed.
Powerful Shadow AI Visibility: Detecting risky unsanctioned AI app usage.
Smart Isolation Capabilities: Containing risky interactions with AI applications.

By implementing strong data protection solutions, businesses can maximize AI’s productivity benefits while maintaining strict security controls.

Uncovering Shadow AIBefore organizations can secure AI applications, they must first gain visibility into all instances of AI usage within their environments. Shadow AI—unauthorized AI applications deployed by employees—poses a serious security challenge. Employees using AI tools without IT oversight may unknowingly share sensitive data with external third-party systems, increasing the risk of data leaks.

Identifying and managing Shadow AITo combat Shadow AI, businesses must implement solutions that detect and monitor AI usage across networks:

Application discovery – AI-driven tools scan enterprise environments to detect unauthorized applications in use.
User activity monitoring – Security teams analyze how employees interact with AI applications to assess risks.
Risk-based access controls – Organizations can enforce policies to restrict unauthorized AI applications while enabling secure use of approved tools.
A recent study found that 38% of employees share sensitive work information with AI tools without employer permission.1 By actively tracking AI interactions and applying zero trust access controls, organizations can reduce exposure to Shadow AI risks while still enabling AI-driven productivity.

Additionally, understanding an organization’s risk landscape is crucial in combating Shadow AI. AI-driven auto-discovery provides real-time visibility into where sensitive data resides and how it moves across environments—from endpoints and SaaS to private apps. This allows security teams to apply controls consistently and eliminate blind spots, making it easier to enforce data protection measures.

Securing Public AI ApplicationsOnce an organization understands its AI landscape, securing interactions between users and AI applications becomes the next priority. Without strong security measures, organizations risk unintentional data exposure, intellectual property theft, and compliance violations.

Implementing AI governance policiesA robust AI governance framework should include:

Acceptable data usage policies – Defining what types of data AI applications can process.
Authorized AI use cases – Outlining which AI tools are permitted for business use.
Ongoing compliance monitoring – Continuously monitoring AI usage to ensure compliance with corporate policies and regulatory standards.

By establishing clear governance policies, IT teams and end users can be guided in responsible AI usage. Regular audits ensure that AI adheres to these standards, minimizing the risk of accidental data misuse.

Applying data protection measuresBeyond governance, organizations should implement advanced data loss prevention strategies to protect sensitive information from being inadvertently accessed or shared by AI applications. Key protection measures include:

Inline DLP Inspection: Monitoring AI interactions in real time to prevent unauthorized data transfers.
Cloud App Control: Blocking or cautioning unsanctioned AI apps used by an organization’s users.
Inline Prompt Control: Monitoring AI input prompts to prevent sensitive data from entering prompt workflows.
Isolation of AI Apps: Isolating users and AI apps in a secure cloud browser to control interactions such as cut, paste, and download.

By integrating data protection security controls, organizations can leverage AI-driven efficiencies while ensuring sensitive data remains protected and compliant.

Securing Microsoft Copilot DataMicrosoft Copilot is a powerful tool that enhances productivity by integrating AI-driven automation into daily workflows. However, its deep access to Microsoft 365 data poses a significant security challenge. Copilot can pull information from SharePoint, OneDrive, and Teams, which, if not properly governed, could expose sensitive data to unintended users.

For example, if an employee requests Copilot to summarize sales trends, misconfigured permissions could allow it to surface financial reports, customer details, or even internal acquisition plans. Since Copilot relies on existing user permissions, any overly accessible data can become an unintended security risk. Organizations must take a proactive approach to access control and data protection to ensure Copilot enhances productivity without introducing security gaps.

Data Protection for Microsoft Copilot SecurityTo mitigate these risks, organizations need to enhance standard Microsoft Security with additional data protection approaches, ensuring that only authorized users and applications access the correct data.

OneDrive Permissions: Leveraging CASB, organizations can revoke excessive permissions in OneDrive to prevent Copilot consumption and sharing.
Preview Sensitivity Labels: Identify and update sensitive data that is missing sensitivity labels to prevent Copilot consumption and sharing (via CASB).
Fix Copilot Misconfigurations: Scan and fix Microsoft 365 and Copilot misconfigurations that could expose data to unnecessary risk.

Controlling Copilot and Data with Inline Data ProtectionEven with proper access controls in place, organizations should use inline data protection controls to ensure sensitive data remains secure within the context of Copilot use. This requires:

Input Prompt Visibility: Understand how users are interacting with and using Copilot through session and prompt visibility.
Inline DLP Inspection: Leverage inline DLP dictionaries to prevent sensitive data from entering Copilot workflows.
Purview Label Blocking: Extend your Copilot security by enabling the blocking of data leaving the organization based on Purview sensitivity labels.

By layering these advanced data protection approaches with Microsoft’s built-in protections, businesses can confidently adopt Copilot while ensuring their most sensitive information remains secure and compliant. However, many organizations underestimate the risks posed by over-permissioned data in Microsoft 365.

A recent Zscaler blog on Microsoft Copilot security explores even more how businesses can audit permissions, monitor AI interactions, and enforce Zero Trust principles to prevent Copilot from exposing sensitive data to unauthorized users.”}]]