Microsoft 365 Copilot data connector is enabled on the Microsoft Sentinel workspace

Overview

The Microsoft 365 Copilot data connector brings Copilot activity logs into Microsoft Sentinel, including which prompts were issued, what grounding sources were consulted, and what responses were returned. This enables analysts to correlate Copilot sessions with identity and sensitivity label signals to determine whether Copilot was part of a security event. This check verifies the connector is enabled on at least one Sentinel-onboarded workspace.

When the Microsoft 365 Copilot connector is not enabled, Sentinel has no record of Copilot prompts, grounding sources consulted, or responses returned. Threat actors who have compromised a user account can exploit this gap because Copilot-assisted reconnaissance — rapidly enumerating and summarizing sensitive documents across the user’s scope — leaves no trace in any Sentinel table. Without this connector, the organization cannot correlate a Copilot session with concurrent Entra sign-in anomalies or Purview label events, making it impossible to determine whether Copilot was part of an attack.

Remediation

• Connect the Microsoft 365 Copilot data connector
• Auditing Microsoft 365 Copilot interactions

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	Low
Impact on users	Low
Pillar	AI
Category	AI Threat Detection
Product	Azure
Feature	Microsoft Sentinel
Area	Logging and detection
Licence	Microsoft_365_Copilot
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.