Skip to content

Control 2.11: Copilot Pages Security and Sharing Controls — Portal Walkthrough

Step-by-step portal configuration for governing Copilot Pages and Copilot Notebooks using Cloud Policy, SharePoint Embedded administration, and Microsoft Purview.

Prerequisites

  • Office Apps admin role, SharePoint Admin role, or M365 Global Admin for the required portals
  • Microsoft 365 Copilot deployment planned or active
  • Governance decision on which users can create Copilot Pages and Copilot Notebooks
  • Records management and eDiscovery contacts identified

Steps

Step 1: Configure Copilot Pages Creation Policy

Portal: Microsoft 365 Cloud Policy service
Path: https://config.office.com > Customization > Policy Management

  1. Create a new policy or open the existing Copilot collaboration policy.
  2. Scope the policy to the approved users or groups.
  3. Set Create and view Copilot Pages and Copilot Notebooks to the approved state.
  4. Record the target group, owner, and approval reference.

Step 2: Review Code Preview Policy

Portal: Microsoft 365 Cloud Policy service
Path: https://config.office.com > Customization > Policy Management

  1. Review Enable code previews for AI-generated content in Microsoft 365 Copilot Chat and Copilot Pages.
  2. Disable it unless the business case is documented and approved.
  3. If enabled, document which teams are allowed to use the feature.

Step 3: Review SharePoint Embedded Storage

Portal: SharePoint Admin Center / SharePoint PowerShell

  1. Review the user-owned SharePoint Embedded containers used for Copilot Pages, Copilot Notebooks, and Loop My workspace.
  2. Confirm administrators understand the user departure lifecycle and cleanup timing.
  3. Document how ownerless or preservation-sensitive containers are escalated.

Departed User Workflow: When a user account is deleted, their SharePoint Embedded container (including Pages and Notebooks content) follows the OneDrive deletion lifecycle: it stays active for the tenant's configurable deleted-user retention period (30 days by default), then moves to a fixed 93-day recycle-bin period before permanent deletion. Because the access handoff isn't automatic for these containers, administrators should add a custodian as a container owner to preserve content, or use SharePoint PowerShell Set-SPOContainer to permanently reassign the container to a new owner, before the active retention period ends. If a departed user's content is subject to legal hold or regulatory retention, the compliance team must place a hold on the container before account deletion.

Information Barriers Limitation: Information Barriers are not supported for SharePoint Embedded content (including Copilot Pages and Notebooks). Organizations that rely on Information Barriers for MNPI separation (e.g., broker-dealer Chinese walls) should disable Pages and Notebooks creation for populations subject to Information Barriers. This limitation means IB-segmented users could potentially access cross-wall content through Pages if the feature is not disabled for those groups.

Step 4: Validate Sharing and Collaboration Posture

Portal: Microsoft 365 Copilot app, Loop app, SharePoint Admin Center

  1. Create a test Page with an approved pilot account.
  2. Confirm the default sharing behavior aligns with the firm's approved model.
  3. Test whether Loop component sharing is enabled in the broader Microsoft 365 ecosystem and document the effect on Pages sharing.
  4. Validate that external or cross-tenant scenarios are blocked unless expressly approved and tested.

Step 5: Apply Purview Controls

Portal: Microsoft Purview

  1. Verify sensitivity labels are available for Pages content.
  2. Run a DLP test with representative FSI-sensitive data.
  3. Confirm retention coverage by reviewing policies that include All SharePoint Sites.
  4. Run a test eDiscovery search for .page content and document the results.

Sensitivity Labeling Limitation for Notebooks: Sensitivity labels aren't available as a Notebook-level control — Copilot Notebooks share a user-owned container with Copilot Pages and Loop My workspace and don't have container sensitivity labels. For Pages, users can manually apply published labels, and mandatory labeling and a default document label are supported; automatic and recommended labeling aren't supported for Pages or Notebooks. Document DLP policies as the compensating control for Notebook content rather than relying on auto-labeling, which isn't available.

  1. Record the manual legal hold step required to add the user's container when preservation is needed.
  2. Update the offboarding procedure to preserve Pages/Notebooks content before cleanup windows expire.
  3. Identify populations that require Information Barriers and document whether Pages/Notebooks remain disabled for them.

FSI Recommendations

Tier Recommendation
Baseline Scope creation to approved users; test SharePoint retention and eDiscovery coverage; prefer named-user sharing only
Recommended Add code preview decision, quarterly sharing reviews, and documented offboarding preservation workflow
Regulated Disable Pages/Notebooks where Information Barriers are required; include manual hold workflow in examination and litigation procedures

Next Steps