3.1.3. Copilot Chat Experiences and Content Safety
💡 First Principle: Microsoft Copilot Chat (formerly Microsoft 365 Copilot Chat) is a standalone conversational experience—separate from the in-app Copilot embedded in Word, Excel, and Teams. It provides a unified chat interface (web and mobile) that every eligible work account gets; with a Microsoft Copilot license, users can ask questions grounded across organizational data without being inside a specific app. Content safety controls ensure AI responses stay appropriate, accurate, and aligned with organizational policies.
Copilot Chat vs. In-App Copilot:
| Feature | Copilot Chat (Web/Mobile) | In-App Copilot (Word, Excel, etc.) |
|---|---|---|
| Access | Browser or mobile app | Within specific M365 app |
| Best for | Cross-app questions, general research | App-specific tasks (drafting, analysis) |
| Data scope | Web + what you supply; with a license, all M365 data via Graph | Focused on current document (+ Graph with a license) |
| Example | "What did the team decide about the budget?" | "Summarize this document" |
Copilot Chat scenarios:
- Asking about meetings you missed (licensed: pulls from Teams transcripts)
- Finding information across emails, chats, and documents simultaneously (licensed)
- Getting quick answers on organizational topics without opening specific apps
- Mobile access for on-the-go productivity, signed in with the same work (Microsoft Entra ID) account, so identity, Conditional Access, permissions and compliance controls still apply
Content safety and filtering controls:
Microsoft implements multiple layers of content safety across all Copilot experiences:
| Safety Layer | What It Does | Business Benefit |
|---|---|---|
| Input filtering | Screens prompts for harmful content | Prevents misuse of AI tools |
| Output filtering | Screens responses for inappropriate content | Protects brand and user safety |
| Grounding guardrails | Restricts responses to authorized data | Prevents information leakage |
| Admin policies | Organizational controls on AI behavior | Aligns AI with company standards |
| Sensitivity labels | Respects document classification | Maintains information governance |
Administrators can configure content filtering to block specific content categories, set data loss prevention (DLP) policies that extend to AI interactions (for example, stopping Copilot from processing prompts that contain sensitive information types such as Social Security numbers), and audit AI usage for compliance. These controls build on existing Microsoft 365 compliance infrastructure. In practice they are Microsoft Purview controls, and they govern work-account Copilot, not the consumer app used with a personal account: audit logging, retention, data residency commitments, Communication Compliance policies that flag harmful content in prompts and responses, and a DLP policy location called Microsoft 365 Copilot and Copilot Chat. A rule in that location with a sensitivity-label condition stops Copilot from using the content of matching files and emails in its responses; DLP policies scoped only to Exchange, SharePoint or Teams don't do this, though they still check a Copilot-drafted message when it is sent or shared.
⚠️ Exam Trap: The exam may ask how to prevent Copilot from generating inappropriate responses. The answer involves content filtering and admin policies—not "don't use AI." Microsoft provides built-in safety controls that organizations can configure.
Reflection Question: An executive wants to use Copilot on their phone during travel. What experience would they use, and what security considerations apply?
