# Communication compliance monitoring is configured for Microsoft Copilot
Until organizations configure Communication Compliance policies to capture Copilot interactions, they can’t see when users expose sensitive data to AI…
Source: https://maester.dev/docs/tests/ZTA.35039
## Overview
Until organizations configure Communication Compliance policies to capture Copilot interactions, they can’t see when users expose sensitive data to AI services. They also can’t tell how people use Copilot with confidential information or spot possible policy violations. As a result, users may unknowingly share customer records, financial data, source code, or trade secrets with AI services.
Communication Compliance policies that focus on Copilot interactions give organizations clear oversight of AI use while respecting privacy controls. These policies show how users work with sensitive data in AI features and help ensure teams follow data governance and compliance requirements.
## Remediation
- [Create and manage Communication Compliance policies](https://learn.microsoft.com/purview/communication-compliance-policies?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | High |
| Effort to fix | Medium |
| Impact on users | Medium |
| Pillar | Data, AI |
| Category | Data Security Posture Management |
| Product | [Purview](/docs/tests/products/purview) |
| Feature | Insider risk management |
| Area | Logging and detection |
| Licence | EXCHANGE_S_ENTERPRISE |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.