Skip to content

Control 2.5: Data Minimization and Grounding Scope — Troubleshooting

Common issues and resolution steps for data minimization and grounding scope controls.

Common Issues

Issue 1: Copilot Returning Content from Outside Grounding Scope

  • Symptoms: Copilot responses reference content from sites not on the RSS allowed list
  • Root Cause: RSS may not be fully propagated, content may be cached from before RSS was enabled, or the content may be in OneDrive or Exchange rather than SharePoint.
  • Resolution:
  • Verify RSS is enabled: Get-SPOTenantRestrictedSearchMode
  • Check if content is in a workload not covered by RSS (Exchange, OneDrive personal)
  • Allow 24-48 hours for RSS changes to fully propagate
  • Verify the specific content source and determine if additional scoping controls are needed

Issue 2: Grounding Scope Too Restrictive — Poor Copilot Quality

  • Symptoms: Copilot responses are vague, incomplete, or frequently state it cannot find relevant information
  • Root Cause: The grounding scope may be too narrow, excluding content sources needed for productive Copilot use.
  • Resolution:
  • Review user feedback to identify which content types are missing
  • Evaluate whether additional sites should be added to the allowed list
  • Submit a scope expansion request through the governance change process
  • Balance data minimization with utility — the scope should include content needed for approved use cases

Issue 3: Data Minimization Controls Conflicting with Business Needs

  • Symptoms: Business teams request broader Copilot access than the current minimization controls allow
  • Root Cause: Initial scope may have been set conservatively, and expanding use cases require broader access.
  • Resolution:
  • Document the specific business need and content sources required
  • Assess the risk of expanding the grounding scope
  • Submit the request through the governance committee for review
  • Implement the expansion with appropriate additional controls (DLP, labels)

Issue 4: Feature Disablement Not Taking Effect

  • Symptoms: Copilot features disabled in Admin Center remain accessible to users
  • Root Cause: Feature toggles may take time to propagate, or users may be using cached application states.
  • Resolution:
  • Verify the setting in Admin Center > Settings > Copilot
  • Wait 24 hours for propagation
  • Have users sign out and back in to refresh configuration
  • Verify the user is in the correct policy group for feature restrictions

Diagnostic Steps

  1. Check RSS status: Get-SPOTenantRestrictedSearchMode
  2. Review allowed list: Get-SPOTenantRestrictedSearchAllowedList
  3. Verify feature settings: Check Admin Center Copilot configuration
  4. Test as user: Query Copilot for known content and verify scope
  5. Review audit logs: Check for configuration changes

Escalation

Severity Condition Escalation Path
Low Scope expansion request Governance committee
Medium Controls not functioning correctly IT Operations
High Copilot accessing out-of-scope sensitive content Security Operations
Critical Data minimization controls bypassed CISO and governance committee