At a Glance
| Vendor | Microsoft |
|---|---|
| Category | Embedded AI |
| Default Risk Rating | Medium |
| Default Status for New Clients | Not Managed |
| Recognized By | Its client signature, so it has its own status even on domains it shares with another product |
| Desktop App Inventoried | Web only |
The risk rating and default status are ProctoredAI's starting points for a new client. Each partner sets the status per client.
What to Know About Microsoft 365 Copilot
Microsoft 365 Copilot Chat: the chat page on m365.cloud.microsoft and the Copilot hub on the substrate service. Routing and classification verified on 2026-10-18; the substrate path still needs confirming from a licensed account, and Copilot inside the Office desktop apps is not separated yet.
Why Embedded AI Tools Need Governing
AI features inside software the client already uses, such as office suites and note apps, send the content of the document to the AI service.
Decide per client whether each embedded feature is approved, and inspect what is sent like any other AI app.
How ProctoredAI Governs Microsoft 365 Copilot
- See it. The agent reports every device and account using Microsoft 365 Copilot.
- Decide it. Mark it Approved, Unapproved or Blocked for each client. Unapproved use can ask the person for a business reason first.
- Protect what is sent. Prompts and uploads are inspected on the device, and credentials, health and payment data and sensitive documents are stopped, redacted or warned on by the client's rules.
- Prove it. Usage, decisions and blocked events land in the client's monthly report as evidence.
Policy Packs That Fit
- Credentials & Secrets. Block API keys, private keys, passwords and connection strings everywhere.
- Sensitive Documents. Contracts, financial statements, HR and medical records, customer lists and credential files may only go to approved AI apps.