Communication compliance monitoring is configured for Microsoft Copilot

Overview

Until organizations configure Communication Compliance policies to capture Copilot interactions, they can’t see when users expose sensitive data to AI services. They also can’t tell how people use Copilot with confidential information or spot possible policy violations. As a result, users may unknowingly share customer records, financial data, source code, or trade secrets with AI services.

Communication Compliance policies that focus on Copilot interactions give organizations clear oversight of AI use while respecting privacy controls. These policies show how users work with sensitive data in AI features and help ensure teams follow data governance and compliance requirements.

Remediation

• Create and manage Communication Compliance policies

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	Medium
Impact on users	Medium
Pillar	Data, AI
Category	Data Security Posture Management
Product	Purview
Feature	Insider risk management
Area	Logging and detection
Licence	EXCHANGE_S_ENTERPRISE
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.