Is Microsoft Copilot Safe for Privileged Legal Work? The Cross-Matter Leakage Problem

How Microsoft Copilot surfaces data across matters

Copilot surfaces cross-matter data by honoring existing permissions, not by bypassing them. It can read anything the prompting user is allowed to open across Microsoft 365, so broad sharing links, inherited folder permissions, and open sites make one matter's files discoverable to anyone with latent access. The plain-language prompt is what turns that dormant access into a surfaced document ^[1].

Copilot is grounded in your organization's Microsoft 365 content through the Graph, and it respects the permissions already in place. That is the key fact and the trap at the same time. If access controls are tight, Copilot only returns what the user should see. If they are loose, Copilot returns what the permissions technically allow, which may be far more than anyone intended.

In a law firm, matters accumulate access over years. Files get shared to a client and forgotten, a folder inherits permissions from a parent site, a Teams channel keeps members who rolled off the matter, and a site is set to "Everyone except external users." None of that was a problem while finding the file required knowing where it lived. A natural-language prompt removes that friction and makes the whole accessible set searchable at once.

So the cross-matter concern is real, but the cause is permission sprawl, not a Copilot defect. The same feature that makes Copilot useful, its reach across everything you can access, is what surfaces material an ethical wall was supposed to keep separate when that wall was never enforced in the underlying permissions.

Why permission sprawl is a privilege problem

Ethical walls only work if they are enforced in the permissions, not just in policy. When a matter's files are broadly accessible, a lawyer on an unrelated or adverse matter can surface them through Copilot, which can compromise confidentiality under Model Rule 1.6 and undercut a screen the firm relies on. The privilege exposure exists whether or not Copilot is present; Copilot makes it discoverable ^[4].

Confidentiality under ABA Model Rule 1.6 and the duties described in Formal Opinion 512 assume the firm controls who can reach client material. A conflict screen or ethical wall is a promise that lawyers on one side of a matter cannot access the other side's files. If that wall lives only in a policy document while the SharePoint permissions stay open, the wall is not real.

Copilot tests that gap directly. A lawyer who is screened from a matter but whose account still has residual access to its files can ask Copilot a question and receive that matter's content in the answer. The firm may then face a confidentiality problem, and in a disputed screen, a factual record that the material was accessible to the screened lawyer the whole time.

This is why the pre-deployment permission audit is not IT hygiene; it is a professional-responsibility control. Fixing the permissions is how the firm makes its ethical walls enforceable rather than aspirational. Our guide on using AI without waiving privilege covers the broader duty this sits inside.

What Copilot does and does not do with your data

With Microsoft 365 enterprise data protection, Copilot does not use your tenant's prompts, responses, or Microsoft Graph data to train the foundation models, and it operates inside your service boundary honoring existing permissions and compliance controls. What it does is surface accessible content and reason over it. The confidentiality risk is oversharing within the tenant, not Copilot sending your data out to train a public model ^[2].

It is worth stating plainly what Copilot does not do, because the "AI will train on our files" fear is misdirected here. Under Microsoft's enterprise data protection commitments, Copilot does not use your organization's prompts, responses, or Graph-grounded data to train the underlying foundation models, and interactions stay within your tenant's compliance boundary ^[2].

What Copilot does do is retrieve content the user can access, reason over it, and generate a response, with the interaction subject to your auditing and retention controls. That is powerful and, handled correctly, defensible. The exposure to manage is internal: who inside the tenant can reach what, and whether sensitive matters are labeled and walled.

Getting this straight matters for the buying decision. A firm that bans Copilot over training fears may still run a dozen consumer AI tools with worse data terms, while a firm that deploys Copilot after fixing permissions and labels may have a more controlled, more auditable environment than it had before.

Isolating privileged work inside a Copilot tenant

Isolate privileged work with three Microsoft Purview controls plus a permissions cleanup: run a SharePoint oversharing assessment, apply MIP-encrypted sensitivity labels to material that should never be summarized, and use Purview DLP for Copilot to exclude labeled content from Copilot processing. Then remove broad access such as "Everyone except external users" from sensitive sites and review Teams membership ^[1][3][5].

The controls exist and are specific. Microsoft Purview sensitivity labels can encrypt documents and carry protection into any new content Copilot creates from them, since Copilot-generated content inherits the highest-priority source label ^[5]. Purview Data Loss Prevention for Copilot lets you exclude items with chosen sensitivity labels from being processed in Copilot responses, so the most sensitive matters can be walled off from summarization entirely ^[3].

Control names reflect Microsoft Purview and Microsoft 365 Copilot as of August 2026. Verify current feature names in Microsoft Learn before implementation, as Microsoft renames and reorganizes these controls frequently.

When a legal-native tool is the safer choice

Copilot is the right tool for firm-wide productivity once permissions and labels are fixed. A legal-native tool is the safer choice when you need matter-level isolation and a verifiable record by default rather than after a cleanup project, or when the practice cannot absorb a four-to-eight-week permission remediation before deploying. The decision is about default posture and provable isolation, not which tool is more capable.

There is no single right answer, and the honest framing is a trade-off. Copilot's strength is that it works across the whole Microsoft 365 environment a firm already runs. Its weakness for privileged work is that safe deployment depends on the firm getting its permissions and labels right first, and keeping them right as matters churn.

A legal-native tool built around matter isolation starts from the opposite default: each matter walled by design, with a record of what the tool accessed. If you need that posture on day one, or you cannot commit to the remediation and ongoing permission hygiene Copilot safety requires, a purpose-built tool reduces the surface you have to manage. RankShield Legal's privilege-isolation attestation is built to produce a verifiable record of what did and did not reach a model, which is the evidence a firm wants when a screen is challenged.

Either way, the decision belongs to the firm's own risk assessment. The point is to choose deliberately: deploy Copilot after the permission and labeling work, or use a tool that isolates by default, rather than turning Copilot loose on an untended tenant and hoping the walls hold.

The ethical wall problem Copilot inherits

An ethical wall is a promise that specific people cannot reach specific material. Copilot honors the permissions it finds, which means a wall implemented socially rather than technically does not exist as far as Copilot is concerned. The tool does not breach the screen; it reveals that the screen was never enforced in the file system ^[2].

Many firms maintain conflict screens through instruction rather than access control. The screened lawyer is told not to look, colleagues are told not to discuss the matter, and the underlying documents sit in a location that lawyer can technically open. That arrangement can hold for years, because opening a file you were told to avoid requires a deliberate act someone might notice.

Copilot removes the deliberate act. A general query can surface content from any location the user can access, so material behind a purely instructional screen can appear in an answer the screened lawyer never went looking for. Neither the lawyer nor the tool did anything furtive, and the wall is breached anyway.

This is the sharpest version of the permission-sprawl problem, because the consequences are not merely a confidentiality concern. A screen that fails can be the basis for disqualification, and the firm's position is considerably worse if the failure is documented in an audit log showing exactly what surfaced and when.

The remediation is to convert instructional screens into technical ones before deployment, not after. For each active screen, confirm that the screened individuals lack file-system access to the matter's material, rather than merely having been told to stay out. Where the firm cannot enforce the wall technically, that matter's content should be excluded from Copilot's reach entirely.

The auditing capability cuts both ways here and is worth understanding as a feature. Copilot interactions can be logged, which means a firm can demonstrate what a screened user did and did not receive ^[2]. A firm that has done the technical work can prove the wall held; a firm that has not will find the same log proving the opposite.

A pre-deployment audit you can run before anyone gets a licence

The work that makes Copilot safe for privileged material happens before rollout, not after. Five checks cover most of the exposure: oversharing in the tenant, active ethical walls, sensitivity labelling on privileged content, DLP policy scoped to Copilot, and audit logging confirmed as on. Each is verifiable rather than a matter of judgment ^[1][3][5].

The single most useful reframing is that Copilot does not introduce a new permission model. It inherits the one the firm already has, and most firms have never had that model stress-tested by something that reads everything a user can reach.

The checks below are ordered by how much exposure they close per unit of effort, and each produces an artifact rather than an opinion. Run them before licences are assigned, because a rollout is far harder to pause than to delay.

Treat the output as a gate, not a report. If the oversharing review surfaces broad-access locations holding privileged material, that is a blocker for those locations rather than a note for the backlog. The rollout can proceed for the parts of the tenant that pass.

1. Run an oversharing reviewIdentify sites, libraries, and folders with broad or organization-wide access that contain client or matter material. Purview's data security tooling for Copilot is built for exactly this question, and it is the highest-yield check in the list ^[1].
2. Convert instructional ethical walls into technical onesFor every active conflict screen, verify that screened individuals lack access at the file-system level. An instruction is not an access control and Copilot will not honor it.
3. Apply sensitivity labels to privileged contentLabels are how Copilot and Purview understand that material is sensitive, and they drive downstream protection. Unlabelled privileged content is indistinguishable from routine content to the tooling ^[5].
4. Scope DLP policy to Copilot specificallyPurview supports DLP for Microsoft 365 Copilot and Copilot Chat as a distinct location. A DLP posture built for email and file sharing does not automatically cover what Copilot surfaces in an answer ^[3].
5. Confirm auditing is on and retainedVerify that Copilot interactions are logged and that retention matches how long the firm may need to reconstruct what a user received. The log is what answers a challenge to a screen months later ^[2].