6.4.5. Security Considerations and Known Limitations
💡 First Principle: Cowork can only do what you can do. It works with your identity and your permissions inside Microsoft's service boundary, so the security question is less "can Cowork break in?" and more "what will it do with the access I already have, and have I checked before it acts?"
Security considerations:
- Inherits your permissions. Cowork can access only what you can. It shows sensitivity labels, including the highest sensitivity label used in the session.
- Isolated processing. Task data is processed in a temporary, isolated environment inside the Microsoft 365 service boundary and removed when the task finishes. Users can't access that environment.
- No training on your data. Cowork doesn't train on your data. It follows Copilot data residency commitments, and Microsoft Purview applies.
- Browser tasks. Local browser use runs in Microsoft Edge on your device with your existing sign-ins, and Cowork hands back to you for MFA prompts, CAPTCHAs and payments. Admins control this with the Cowork Browsing tenant setting.
- Admin controls. Admins grant access through a spending policy (even a one-credit limit grants access), and can set per-user or per-group spending limits, exclude users, disable app auto-install and turn off individual models. Credit limits are enforced asynchronously, so a user may still start tasks just after reaching a limit.
- Eligibility. In education, faculty and staff can use Cowork, but students aren't eligible. Cowork uses Anthropic's Claude models for most of its reasoning, so it's also limited to regions Anthropic supports.
Known limitations (by design):
| Cowork can't… | So instead… |
|---|---|
| Use files on your local device | Store the file in OneDrive or SharePoint, or upload it |
| Delete files or folders in OneDrive or SharePoint | Delete them yourself |
| Read encrypted files, even ones you can open | Provide an unencrypted copy if policy allows |
| Accept attachments of 200 MB or more | Split or link the content |
| Guarantee custom skills are safe or correct | Use skills only from trusted sources, and review outputs |
Responsible AI limitations. Cowork may misinterpret ambiguous instructions, may return inaccurate results when sources are stale, and may not complete complex multi-dependency tasks. Plugin quality depends on the third-party publisher. Its outputs are drafts to review. Microsoft states it isn't intended for uses that need guaranteed accuracy without human review, such as legal filings, medical decisions or financial transactions that bypass approvals. The mitigations are the ones this guide keeps returning to: give clear, specific instructions; review before approving; use pause and cancel; and give feedback.
⚠️ Exam Trap: "Cowork can't open the encrypted board pack, so it must lack permission" is the wrong diagnosis. Cowork can't read encrypted files even when you can: that's a documented limitation, not a permissions problem. Likewise, Cowork refusing to complete an MFA prompt or payment isn't a failure. Handing those back to you is deliberate.
Reflection Question: A university wants every student and staff member to use Cowork for research projects, including automatically deleting old draft files from OneDrive. Which two parts of this plan won't work, and why?
