AI Agent Data Access Governance: The Risks of Agents Reading User Data

An AI agent reads data through an identity. That identity is either the person chatting with the agent or a fixed account, such as the maker's connection or an app registration with tenant-wide rights. The choice decides what the agent can expose, and most of the risk sits there.

Copilot users meet this question as soon as they build an agent in Copilot Studio. The controls exist, but they live in different admin centers and ship with different defaults.

How agents inherit or exceed user permissions

Microsoft Graph supports two access models. With delegated permissions, the app acts on behalf of a signed-in user and can't access anything that user couldn't access, according to Microsoft's Graph permissions overview. With application permissions, the app acts as itself and can reach any data the permission covers. Microsoft's example is an app holding Files.Read.All as an application permission, which can read any file in the organization.

Microsoft calls application permissions highly privileged and recommends the delegated model whenever it meets the requirement. An agent that answers employee questions rarely needs app-only rights. A scheduled agent with nobody signed in usually does, so give it a narrower scope and a shorter review cycle.

Copilot Studio adds a second decision for each tool. Connector tools use the end user's credentials by default, according to Microsoft's Copilot Studio connector documentation. If a maker switches a tool to maker-provided credentials, every user acts through the maker's connection. That works like a shared service account, and someone with no access to the underlying system can still query it through the agent.

For agents that need their own identity, Microsoft Entra Agent ID best practices recommend a unique identity for each agent instead of a shared one. Interactive agents should use the on-behalf-of flow so the user's access policies still apply.

Oversharing becomes exposure

An agent that respects user permissions surfaces whatever the user can already open. Microsoft's Copilot privacy documentation states that Copilot only surfaces organizational data to which individual users have at least view permissions. That stops privilege escalation. It does nothing about a salary workbook someone shared with the whole company years ago.

Microsoft's SharePoint Advanced Management guidance for Copilot notes that SharePoint defaults to the most permissive sharing setting. Its data access governance reports flag sites shared with Everyone except external users and sites with heavy sharing link activity. Restricted Content Discovery keeps high-risk sites out of Copilot and organization-wide search while leaving their permissions unchanged.

Prompt injection can turn an agent into an exfiltration path

The OWASP Top 10 for LLM Applications 2025 ranks prompt injection first. OWASP describes indirect injection as instructions that reach the model through external sources such as websites or files, and one of its example scenarios shows hidden instructions in a web page leading to exfiltration of a private conversation (OWASP LLM01). An agent that reads inbound email is reading text written by strangers.

OWASP's entry on excessive agency traces damaging actions to agents that hold more permissions and autonomy than the task needs. Its mitigations match the identity work above. Run downstream actions in the user's context with the narrowest scope, and require a person to approve high-impact actions.

Microsoft's privacy documentation says Copilot uses classifiers against jailbreak and cross-prompt injection attacks, and that they may not be available in every scenario. A Purview DLP preview control can also exclude email from external senders from Copilot grounding. Treat both as layers, because the agent's permissions still decide how much a successful injection can reach.

Sensitivity labels and DLP set a second boundary

When content is encrypted with Microsoft Purview Information Protection, Microsoft's privacy documentation says Copilot honors the usage rights granted to the user. Microsoft Purview's DLP documentation describes two more controls for Microsoft 365 Copilot and Copilot Chat. One rule can stop Copilot from processing files and emails with chosen sensitivity labels, and another, still in preview, can block prompts containing sensitive information types such as passport numbers. Labeled items can still appear as citations, but Copilot does not use their content.

Policy updates can take up to four hours to reach Copilot, and DLP cannot scan files uploaded directly into a prompt. Labels only help when content carries them, so label the HR and finance libraries first.

Logging and review

Copilot Studio writes agent creation, publishing, sharing and authentication changes to the Microsoft Purview audit log, plus a CopilotInteraction event for each user interaction, according to Microsoft's Copilot Studio audit documentation. The audit event carries metadata and a transcript thread ID, and compliance staff read the transcript itself through Data Security Posture Management for AI. Decide before launch who reads these records and how often.

Microsoft's Entra Agent ID guidance also recommends access reviews that include agent identities, with sponsors attesting every six to twelve months that each agent is still needed. An agent whose sponsor does not confirm becomes a candidate for decommissioning.

An access review checklist for each agent

• Identity: Record whether each tool and knowledge source runs as the signed-in user or as a fixed identity, and name that identity.
• Permission type: List every Graph or API permission as delegated or application, and challenge each application permission.
• Shared credentials: Flag every connector set to maker-provided credentials.
• Content scope: Run data access governance reports on every site the agent reads and fix Everyone-level sharing first.
• Labels and DLP: Test that the Copilot DLP rule blocks labeled content.
• Untrusted input: Name every source written by outsiders and limit what the agent may do after reading it.
• Actions: Require human approval before the agent changes a record or sends data outside the tenant.
• Ownership: Name a sponsor and set the date of the next review.

Our Copilot Studio agent guardrails guide walks through the build-time settings. The AI governance page covers how we install these controls in a client's tenant.

Where to start

Run the checklist against one agent that already touches sensitive data. The first pass shows whether your risk sits in permissions or in overshared content, and that tells you what to fix first.

QueryNow builds AI workflows and agents in your own environment. We scope one workflow with you, build it in two weeks, and you pay $10,000 only after it meets the acceptance criteria you signed off on.

Questions security teams ask

Does a Copilot Studio agent respect SharePoint permissions?

SharePoint knowledge sources use the agent user's Microsoft Entra ID authentication, so the agent only surfaces content that user can access, according to Microsoft's Copilot Studio knowledge documentation. Tools set to maker-provided credentials behave differently, so check each one.

Can we keep Copilot away from certain files without changing permissions?

Yes. A Purview DLP rule can exclude labeled items from Copilot processing, and Restricted Content Discovery hides whole SharePoint sites from Copilot and organization-wide search while their permissions stay the same.

Do Microsoft's filters stop prompt injection?

Microsoft says its classifiers help mitigate these attacks and may not cover every scenario. Limit what an agent can do with content it reads, and keep human approval on high-impact actions.