You cannot remediate what you cannot name. The catalog below is the canonical reference of every risk Cloudiway Compass evaluates on a Microsoft 365 tenant before activating Microsoft 365 Copilot.
It exists because Copilot inherits every permission decision your tenant has accumulated — broad sharing links, dormant guests, missing labels, mis-scoped Conditional Access policies, fragmented DLP coverage. Each one of those decisions becomes an AI-mediated retrieval path the moment the assistant goes live. Naming the risks turns a vague "tenant hygiene" effort into a tractable, prioritized backlog.
The catalog is technical. It assumes familiarity with Microsoft 365 administration concepts — Entra ID, sensitivity labels, DLP, Conditional Access, sharing capability. If you are looking for a higher-level framework first, read the AI Readiness Framework or the AI Readiness Checklist before this reference.
How the catalog maps to the CAF pillars
The catalog is organized along the four-pillar Cloud Adoption Framework readiness model used by the Cloudiway AI Readiness Assessment. Each category contributes to exactly one pillar; the per-pillar weighted average produces the global CAF Score.
| CAF Pillar | Weight | Categories | # Risks |
|---|---|---|---|
| Data Exposure | 40% | DE-EX, DE-PM, DE-SH, TE-CR, SD, WG-LC | 36 |
| Access Governance | 25% | WG-OW, WG-CH, WG-GR, AR, CA, EX | 33 |
| Data Protection | 25% | LC, DLP | 14 |
| AI Governance | 10% | TC, CT, RCD, SAI | 16 |
| Total | 99 | ||
The remainder of this article walks every category in pillar order. Inside each category, risks appear in their canonical numeric order (DE-EX-001, DE-EX-002, …) so the page can be used as a lookup reference: open the page, Ctrl+F the code, read the description.
DE-EX — External Access Exposure
External access risks describe the people from outside the organization who can reach internal Microsoft 365 content. Copilot will retrieve any content the requesting user can access, so external collaboration paths directly translate into AI exposure surface.
Guest Users in Tenant
What it detects: Inventory of guest accounts present in Entra ID. Each guest is an external identity that can be added to groups, Teams or shared content.
Why it matters for Copilot: Copilot honors guest permissions; every guest is a potential outside reader of internal content if added to the wrong group or site.
Teams With Guests
What it detects: Microsoft Teams that include at least one guest member.
Why it matters for Copilot: Guest members of a Team can read channel messages, files, and any wiki content — Copilot will too if the guest queries it.
M365 Groups With Guests
What it detects: Microsoft 365 groups (not security groups) containing guest members.
Why it matters for Copilot: M365 groups carry SharePoint sites, mailboxes, OneNote, Planner — guests in the group inherit access across all of them.
Sites Shared Externally
What it detects: SharePoint sites where external users hold direct permissions, not just inherited via guest groups.
Why it matters for Copilot: Site-level external sharing exposes the entire site library; one shared link can grant read access to thousands of files.
External Sharing on Files
What it detects: Files in SharePoint or OneDrive shared with email addresses outside the tenant domain.
Why it matters for Copilot: Per-file external sharing is the largest single source of accidental data leakage flagged in pre-Copilot audits.
Inactive Guest Accounts
What it detects: Guest accounts that have not signed in for 90+ days but still hold tenant access.
Why it matters for Copilot: Dormant guests are stale attack vectors; the contact may have left their company, leaving an orphan identity with active permissions.
DE-PM — Permission Model Exposure
Permission model risks describe configurations where access is granted to broad groups rather than to specific people — "Everyone", "Anyone in the organization", or large permission groups. These are the most efficient Copilot oversharing vectors.
Shared With Everyone
What it detects: Files or folders shared with the "Everyone" principal (all users including guests).
Why it matters for Copilot: Equivalent to a public document. Copilot will surface these files on any matching query, regardless of the asker's role.
Shared With Everyone Except External Users
What it detects: Files shared with the "Everyone except external users" group — every internal employee.
Why it matters for Copilot: A junior intern can find a confidential merger draft via Copilot the first time they ask a strategic question.
Sites With Open Permissions
What it detects: SharePoint sites where the root grants access to "Everyone" or a tenant-wide group.
Why it matters for Copilot: Whole-site openness multiplies DE-PM-001/002 across every library, list and page in the site.
Public Groups / Public Teams
What it detects: Microsoft 365 groups or Teams with visibility set to Public — anyone in the org can join without approval.
Why it matters for Copilot: Public visibility means content is reachable by every internal user; Copilot will index it accordingly.
Large Group Permissions on Files
What it detects: Files where the granted permission is a group containing more than 100 members.
Why it matters for Copilot: Large permission groups behave as broadcast channels; 1,000-member group access on a single file is functionally org-wide.
DE-SH — Sharing Link Exposure
Sharing links risks describe the permanent shareable URLs created by SharePoint and OneDrive. Anonymous and tenant-wide links are persistent grants that survive long after the original collaboration intent.
Anonymous Links
What it detects: Sharing links scoped to "Anyone with the link" — no authentication required.
Why it matters for Copilot: Anonymous links are the highest-risk Microsoft 365 grant. If the URL leaks, the content is publicly readable. Copilot doesn't need the link — it has direct internal access — but the link's existence proves the content was meant to be widely accessible.
Anonymous Links to Sensitive Content
What it detects: Anonymous links pointing to files that carry a sensitivity label or contain detected sensitive content.
Why it matters for Copilot: Worst-case combination: confidential content + public-by-link grant. Treated as Critical severity in every CAF report.
Org-Wide Sharing Links
What it detects: "Anyone in the organization" links — internal but unrestricted.
Why it matters for Copilot: Created routinely for one-off meetings and never expired. Copilot retrieves these for any internal user's query.
Sharing Links Concentration By Site
What it detects: SharePoint sites where the count of files carrying sharing links exceeds a defined threshold.
Why it matters for Copilot: Highlights sites that systematically use broad sharing as a default pattern, not an exception. Targeted remediation sites.
Link Expiration Status
What it detects: Active sharing links that either lack an expiration date or have an expiration in the past.
Why it matters for Copilot: Expirationless links accumulate forever; expired-but-active links indicate broken governance enforcement.
TE-CR — Teams Collaboration Risks
Teams Collaboration risks are specific to Microsoft Teams' channel structure and cross-tenant federation. Private channels create shadow data; shared channels open cross-tenant boundaries.
Teams With Private Channels
What it detects: Teams that contain at least one private channel — a sub-channel with its own membership and SharePoint site.
Why it matters for Copilot: Private channels are stored in independent SharePoint sites that owners of the parent Team cannot see, creating shadow data outside the team's normal governance.
Teams Hosting Shared Channels
What it detects: Teams that host at least one shared channel (cross-tenant collaboration channel).
Why it matters for Copilot: Shared channels permit B2B Direct Connect with external tenants. Members from the partner tenant access content without guest accounts — a different identity model.
Shared Channels With External Tenants
What it detects: Shared channels actually connected to one or more external tenants right now.
Why it matters for Copilot: Highest-severity Teams risk. Every external tenant is an outside organization with read access to the channel content; Copilot in either tenant can surface it.
Private Channel Permission Divergence
What it detects: Teams with multiple private channels likely to have permissions diverging from the parent team's membership.
Why it matters for Copilot: When private channel members ≠ parent team members, governance reviews on the team alone miss the divergent grants.
Chat Files Folders With High Exposure
What it detects: The "Microsoft Teams Chat Files" folder in a user's OneDrive carrying 10+ external sharing links.
Why it matters for Copilot: Chat-shared files are stored in OneDrive but the original chat context is invisible to the OneDrive owner; outside grants accumulate quietly.
Attachments Folders With High Exposure
What it detects: Channel email attachments folder with 10+ external sharing links.
Why it matters for Copilot: When users email attachments to channels, files land in a hidden "Attachments" library that often inherits unintended sharing.
Teams With Shadow Users
What it detects: Teams whose underlying SharePoint site contains permissions for users who are not Team members.
Why it matters for Copilot: These users access Team content via the SharePoint side door — the Team owner has no visibility into the grant.
Teams Without Container Label
What it detects: Teams whose backing M365 group has no sensitivity label applied at the container level.
Why it matters for Copilot: Container labels enforce site-wide restrictions (no guests, no external sharing, encryption). Their absence means default permissive settings apply.
Teams With Hidden Transitive Members
What it detects: Teams whose membership includes nested groups, granting access to users not directly listed.
Why it matters for Copilot: Effective access ≠ visible membership; an admin reviewing the Team roster does not see who ultimately holds rights.
SD — Sensitive Documents
Sensitive Documents risks describe files identified as confidential by content classification (PII, PCI, financial, IP, regulated) but lacking the protection their classification implies.
Sensitive Documents Without Encryption
What it detects: Files classified as sensitive that lack a sensitivity label enforcing encryption.
Why it matters for Copilot: Without encryption-enforcing labels, sensitive content is readable by anyone who reaches the file — Copilot included.
Highly Confidential With Anonymous Links
What it detects: Files labeled "Highly Confidential" that also carry an anonymous sharing link.
Why it matters for Copilot: Direct contradiction: the label says do not distribute, the link says distribute publicly. Always Critical severity.
Sensitive Documents Externally Shared Unprotected
What it detects: Sensitive files shared with external email addresses without DLP block or watermarking.
Why it matters for Copilot: External recipients can save, forward, screenshot the content with no organizational control.
PII Without Sensitivity Label
What it detects: Files containing detected PII (national ID, passport, credit card) with no sensitivity label applied.
Why it matters for Copilot: GDPR / HIPAA / PCI-DSS frameworks require classification; absence is both a compliance gap and a Copilot exposure path.
PCI Data Unencrypted
What it detects: Files containing PCI cardholder data without any encryption-enforcing label.
Why it matters for Copilot: PCI-DSS Section 3.4 explicitly requires encryption at rest of cardholder data; failure is a compliance violation regardless of Copilot.
Orphaned Sensitive Documents
What it detects: Sensitive files whose owner has left the organization (account deleted or disabled).
Why it matters for Copilot: Without an active owner, no one is reviewing, archiving or deleting the content — but Copilot still finds it.
WG-LC — Lifecycle & Stale Content
Lifecycle risks describe Microsoft 365 objects that are still indexed and retrievable but no longer actively maintained. Stale content is the favorite source of Copilot hallucinations grounded in obsolete truth.
Inactive Teams
What it detects: Microsoft Teams with no message activity in the last 180 days.
Why it matters for Copilot: Inactive Teams still expose all their content. Their owners may have left; nobody is reviewing the access list.
Inactive Sites By Usage
What it detects: SharePoint sites whose Microsoft 365 usage report shows zero activity in 180 days.
Why it matters for Copilot: Usage-report-based detection catches sites that look fresh by metadata but are functionally dead.
Inactive Users
What it detects: Internal user accounts with no sign-in in the last 90 days.
Why it matters for Copilot: Dormant internal accounts are prime credential-theft targets and still hold all their inherited group memberships.
Inactive Sites
What it detects: SharePoint sites whose last modified timestamp is older than 1 year.
Why it matters for Copilot: Files last edited a year ago are likely obsolete drafts that Copilot may quote as current.
Old Files Ratio Per Site
What it detects: SharePoint sites where a high proportion of files (>50%) have not been modified in the past year.
Why it matters for Copilot: Identifies sites with structural staleness rather than isolated old files. Strong candidates for archival before Copilot rollout.
WG-OW — Group & Team Ownership
Ownership risks describe Microsoft 365 groups and Teams without robust ownership — no owner, single owner (SPOF), or owners who have left the organization. Without an active owner, no one approves new members, reviews access, or archives the workspace.
Teams No Owners
What it detects: Microsoft Teams without any active owner.
Why it matters for Copilot: Ownerless Teams are governance dead-ends: no one can add members, change settings, or archive the team. Risk score 9.0 (Critical).
Groups No Owners
What it detects: Microsoft 365 or security groups with no assigned owner.
Why it matters for Copilot: Same as Teams ownerless: nobody is accountable for the group's lifecycle, members or grants. Risk score 9.0 (Critical).
Single Owner (SPOF)
What it detects: Groups or Teams with exactly one owner.
Why it matters for Copilot: Single point of failure. If the owner leaves, the workspace becomes orphaned overnight. Microsoft recommends 2+ owners minimum.
Owners Inactive
What it detects: Groups or Teams where every owner has been inactive for 90+ days.
Why it matters for Copilot: Functionally equivalent to ownerless. The workspace runs unattended and may have accumulated drift since last review.
Orphan SharePoint Sites
What it detects: SharePoint sites whose backing M365 group has been deleted but the site survives.
Why it matters for Copilot: Site is still accessible to existing members but no longer governed by group lifecycle policies.
WG-CH — Teams Channels
Channel risks describe the structural use of private and shared channels in Microsoft Teams. Both channel types create governance side-doors around the parent Team.
Private Channels Inventory
What it detects: Count of private channels per Team and across the tenant.
Why it matters for Copilot: Each private channel is a separate SharePoint site with independent permissions. A Team with 10 private channels has 11 distinct access boundaries to govern.
Shared Channels Inventory
What it detects: Count of shared channels per Team and across the tenant.
Why it matters for Copilot: Shared channels enable B2B Direct Connect cross-tenant collaboration. Inventory is the prerequisite for any external-collaboration audit.
WG-GR — Group Membership & Size
Group membership risks describe groups whose composition (size, type of members) makes them inappropriate as access principals. Large or mixed-type groups multiply exposure when used to grant permissions on content.
Large Groups
What it detects: Groups with 1,001 to 5,000 members.
Why it matters for Copilot: Large groups behave as a broadcast principal. Granting site permission to a 2,000-member group is effectively org-wide for medium tenants.
Critical Size Groups
What it detects: Groups with 5,000+ members.
Why it matters for Copilot: Criticial-size groups should never be used as direct access principals — they always represent the whole company at this scale.
Groups With Guests
What it detects: Groups (security or M365) that contain guest members alongside internal users.
Why it matters for Copilot: Mixed-membership groups make audit harder: a permission grant intended for internals also grants to guests.
Nested Groups
What it detects: Groups whose membership includes other groups (nesting).
Why it matters for Copilot: Effective membership becomes opaque. Reviewing a group's roster does not show users granted via nested children.
Groups With Service Principals
What it detects: Groups that contain service principals (application identities) as members.
Why it matters for Copilot: App identities behave like users. A service principal in a permission group can grant the underlying app machine-level access to content.
AR — Admin Roles
Admin role risks describe the configuration and assignment of privileged roles in Entra ID. Privileged identities are the highest-impact compromise targets and the steepest Copilot exposure if misconfigured.
Global Administrator Without MFA
What it detects: Global Admin accounts with no multi-factor authentication enrolled.
Why it matters for Copilot: Global Admin without MFA is the worst configuration in Microsoft 365. Phishing the password yields total tenant compromise.
Excessive Global Administrators
What it detects: More than 5 active Global Admin assignments.
Why it matters for Copilot: Microsoft recommends 2–5 Global Admins. Above that, every additional admin is an additional credential-theft target with full powers.
Permanent Privileged Role Assignments
What it detects: Privileged roles assigned permanently rather than via PIM eligible activation.
Why it matters for Copilot: Permanent assignments mean standing privileges. PIM (Privileged Identity Management) provides just-in-time activation — the modern best practice.
Inactive Admin Accounts
What it detects: Admin accounts that have not signed in for 90+ days.
Why it matters for Copilot: Dormant admin accounts retain their privileges. Combined with weak MFA they are credential-theft jackpots.
Service Accounts With Admin Roles
What it detects: Service principals or app accounts holding interactive admin roles.
Why it matters for Copilot: Service accounts often run with stale credentials that are not rotated. Admin role assignment elevates the impact of any compromise.
Guest Users With Admin Roles
What it detects: Guest (external) accounts holding any admin role in the tenant.
Why it matters for Copilot: External identities holding admin roles is an extremely high-impact configuration; treat as Critical until justified.
CA — Conditional Access
Conditional Access risks describe the absence or weakness of policies that gate authentication based on user, device, location and risk signals. Without Conditional Access, the identity layer reduces to passwords and TOTP.
No Conditional Access Policies Configured
What it detects: Tenant with zero Conditional Access policies in place.
Why it matters for Copilot: No CA means no enforcement of MFA, no compliant-device requirement, no location filtering. Worst-possible identity baseline.
MFA Not Required For Admins
What it detects: Conditional Access policies that do not require MFA on admin sign-ins.
Why it matters for Copilot: Admin without enforced MFA is the same risk as AR-001 but at the policy layer rather than the user enrollment layer.
Legacy Authentication Allowed
What it detects: Conditional Access does not block legacy auth protocols (POP, IMAP, SMTP basic auth).
Why it matters for Copilot: Legacy auth bypasses MFA entirely. Most credential-stuffing attacks succeed via legacy auth endpoints.
No Location-Based Access Restrictions
What it detects: Tenant has no Conditional Access policy referencing named locations or country blocking.
Why it matters for Copilot: Location-based controls catch geo-anomalous sign-ins (sudden access from a country your org never operates in).
High-Risk Sign-In Conditions Not Blocked
What it detects: Entra ID Identity Protection flags exist but Conditional Access does not block or challenge high-risk sign-ins.
Why it matters for Copilot: Detection without enforcement is theater. The signals exist but the gate stays open.
Policies With User Coverage Gaps
What it detects: Conditional Access policies that exclude large user groups or include only a subset of users.
Why it matters for Copilot: A policy applied to 60% of users leaves the remaining 40% on legacy defaults — typically the high-risk subset (executives, contractors, M&A targets).
EX — Exchange & Mailbox
Exchange risks describe mailbox-level configurations that leak content out of the organization or grant excessive access. Auto-forwarding rules and full-access delegates are the two largest mailbox exfiltration vectors.
Mailbox With External Forwarding
What it detects: Mailboxes configured to auto-forward all incoming mail to an external address.
Why it matters for Copilot: Whole-mailbox exfiltration channel. Often added by a compromised user before incident response detects the breach.
Inbox Rules Forwarding Externally
What it detects: Inbox rules (user-side) that forward matching messages to an external address.
Why it matters for Copilot: Rule-based forwarding survives password resets. Standard post-compromise persistence technique.
Mailbox With Excessive Delegated Access
What it detects: Mailboxes with more than 5 delegates holding Send On Behalf or Folder permissions.
Why it matters for Copilot: Each delegate is a copy of the mailbox owner's effective access. Audit reviewers need to verify each grant is justified.
Full Access Permissions To Sensitive Mailboxes
What it detects: Executive or HR mailboxes (CEO, CFO, HR Director, Legal) with FullAccess granted to additional accounts.
Why it matters for Copilot: FullAccess grants read of all mail in the mailbox — including drafts, deleted items, sensitive attachments.
Send As Permissions
What it detects: Accounts holding SendAs permission on other users' mailboxes.
Why it matters for Copilot: SendAs allows impersonation. Mail recipients see messages as coming from the owner, not the actual sender.
Inbox Rules With Delete Actions
What it detects: Inbox rules that delete or move messages to non-standard folders based on keywords.
Why it matters for Copilot: Standard attacker technique to hide alerts ("if subject contains 'login from new device' move to Deleted Items").
Calendar Shared With External Users
What it detects: Mailbox calendars shared with external email addresses with full details visibility.
Why it matters for Copilot: Discloses meetings, attendees, attachments to outside parties — frequently a low-noise data exposure source.
Shared Mailboxes Without Owners
What it detects: Shared mailboxes (used by multiple staff) with no listed owner in the directory.
Why it matters for Copilot: Without an owner, nobody is reviewing the access list or rotating delegates over time.
Excessive Internal Calendar Permissions
What it detects: Calendars granting full details to large internal groups or to "Default".
Why it matters for Copilot: Internal calendar oversharing is the most common DE-PM equivalent for the mail workload.
LC — Label Compliance
Label Compliance risks describe the deployment and adoption of Microsoft Purview sensitivity labels. Without labels, Microsoft 365 has no signal to differentiate confidential content from public — including Copilot.
Labeled Files Count (Coverage)
What it detects: Aggregate count of files carrying any sensitivity label, with distribution per label.
Why it matters for Copilot: Coverage metric. Tenants typically show <5% labeled files at first scan; production maturity is >50%.
Groups Without Container Label
What it detects: Microsoft 365 groups (and the Teams / sites they back) without an applied container label.
Why it matters for Copilot: Container labels enforce site-level guardrails: block guests, block external sharing, block downloads. Absence means default permissive settings.
Auto-Labeling Policies Not Configured
What it detects: Tenant lacking auto-labeling policies that classify content based on sensitive info type detection.
Why it matters for Copilot: Without auto-labeling, classification depends on user behavior — typically unreliable. Auto-labeling enforces baseline consistency.
Sensitive Content Without Copilot Restrictions
What it detects: Documents labeled as sensitive but the label itself does not enforce Copilot-specific restrictions (encryption, blocked from AI processing).
Why it matters for Copilot: Microsoft Purview supports "Block Copilot from referencing" as a label property since 2024. Without it, the label is administrative metadata only.
No Encryption Labels For Copilot
What it detects: Tenant has no sensitivity labels at all that enforce encryption.
Why it matters for Copilot: If no label encrypts, Copilot can summarize and quote any sensitive content it reaches. Encryption-enforcing labels are the only hard control.
DLP — Data Loss Prevention
DLP risks describe the configuration and operational health of Microsoft Purview Data Loss Prevention policies. DLP is what blocks sensitive content from leaving — via mail, sharing, copy/paste, or Copilot output.
No DLP Policies Configured
What it detects: Tenant has zero DLP policies in place across any workload.
Why it matters for Copilot: Worst-possible data protection baseline. No content type triggers any block, alert or audit. Always Critical severity.
No DLP Copilot Blocking Rules
What it detects: DLP policies exist but none reference Copilot as a target location for blocking.
Why it matters for Copilot: Generic DLP policies do not automatically apply to Copilot output. Specific Copilot location must be added since 2024.
Incomplete DLP Workload Coverage
What it detects: DLP policies do not cover every relevant Microsoft 365 workload (Exchange, SharePoint, OneDrive, Teams, Endpoint, Copilot).
Why it matters for Copilot: A workload not covered is a free leakage path; DLP-aware attackers route through whichever workload is unprotected.
DLP Policies Not Enforcing
What it detects: Policies stuck in audit-only or test mode rather than enforce mode.
Why it matters for Copilot: Test-mode DLP detects but does not block. Useful for tuning, but indefinitely test-mode = no protection.
Insufficient Sensitive Info Types Coverage
What it detects: DLP policies reference fewer than the recommended baseline of sensitive info types for the org's regulatory profile.
Why it matters for Copilot: Missing PII / PCI / HIPAA detectors mean specific content categories are unprotected even when DLP is in enforce mode.
High Volume Of DLP Incidents
What it detects: Tenant reports more than 100 DLP incidents in the last 30 days.
Why it matters for Copilot: Either DLP policies are over-tuned (false positive flood) or genuinely ongoing data leakage. Either way, attention required.
Unresolved High Severity DLP Incidents
What it detects: Open DLP incidents marked High or Critical severity older than 30 days.
Why it matters for Copilot: High-severity incidents should be triaged within hours, not weeks. Backlog indicates broken incident response loop.
DLP Policy Override Abuse
What it detects: Users override DLP block actions ("Send anyway") at a rate above 10% of triggered policies.
Why it matters for Copilot: Override abuse means users have learned the policy is advisory and routine. The DLP signal becomes noise.
Sensitive Content Shared Externally
What it detects: DLP-detected sensitive content actually transmitted to external email addresses.
Why it matters for Copilot: Confirmed exfiltration events (already left the tenant). Each one is a potential breach notification trigger.
TC — Tenant Configuration
Tenant Configuration risks describe the high-level sharing and collaboration settings at the tenant root. These settings dominate every workload below — fixing them is the lowest-effort highest-leverage remediation possible.
Copilot License Configuration
What it detects: Copilot licenses assigned but adoption telemetry shows utilization below 50%, or Copilot active without a defined governance owner.
Why it matters for Copilot: Underutilized Copilot licenses are wasted spend; Copilot without governance accumulates risk over time.
SharePoint External Sharing Too Permissive
What it detects: SharePoint tenant sharing capability set to allow Anonymous links by default.
Why it matters for Copilot: Tenant default cascades to every site that does not override. "Existing guests" is the recommended baseline.
OneDrive External Sharing Too Permissive
What it detects: OneDrive sharing capability set to allow Anonymous or all external by default.
Why it matters for Copilot: OneDrive is per-user storage; permissive defaults create a massive long-tail of anonymous-link drift across thousands of mailboxes.
Teams Guest Access Configuration
What it detects: Teams guest access setting allows guests to perform privileged actions (start meetings, share screen, create channels).
Why it matters for Copilot: Default Teams guest permissions are surprisingly broad. Tightening them blocks several attack scenarios at once.
Azure AD External Collaboration Settings
What it detects: Entra ID Cross-Tenant Access Policy and Authorization Policy allow unrestricted invitations from any tenant.
Why it matters for Copilot: Cross-tenant access governs B2B Direct Connect and shared channels. Unrestricted = anyone in any tenant can be invited as a guest.
CT — Copilot Tenant Settings
Copilot Tenant Settings describe Microsoft 365 administrative configurations that specifically govern Copilot behavior, audit, and data residency.
Data Residency Not Configured
What it detects: Copilot data residency setting not aligned with the tenant's regulatory geography (EU Data Boundary, US Sovereign Cloud, etc.).
Why it matters for Copilot: Copilot processes content where the licence directs it. Misconfiguration can route EU prompts through US infrastructure — a GDPR concern.
Unified Audit Log Not Enabled
What it detects: Microsoft Purview unified audit logging is disabled at the tenant level.
Why it matters for Copilot: Without unified audit, no Copilot interaction is logged. Forensic investigation of an AI-mediated leak becomes impossible.
Copilot Audit Events Not Logged
What it detects: Audit log is enabled but the specific Copilot event types (CopilotInteraction, CopilotResponseGenerated) are not ingested.
Why it matters for Copilot: Generic audit ingest may not include Copilot-specific events. Ingestion must be explicitly verified per workload.
Risky Third-Party Copilot Plugins
What it detects: Third-party Copilot plugins or connectors deployed at the tenant level with broad permissions or unverified publishers.
Why it matters for Copilot: Plugins extend Copilot's reach into external services. Each plugin is a new attack surface and a potential exfiltration channel.
RCD — Restricted Content Discoverability
Restricted Content Discoverability is a Microsoft 365 feature that limits which SharePoint sites Copilot can search. Properly configured, it is the most effective single control to reduce Copilot exposure surface.
RCD Not Enabled
What it detects: Tenant has not activated Restricted Content Discoverability for Copilot search scoping.
Why it matters for Copilot: Without RCD, Copilot searches every site the asking user can access — the maximum exposure surface.
RCD Enabled But Allowed Sites List Empty
What it detects: RCD is enabled but the list of sites explicitly allowed for Copilot is empty or trivially small.
Why it matters for Copilot: Empty allow-list with RCD on means Copilot has nothing to search. Often a misconfiguration where the feature is enabled but the curation step never happened.
Sites Excluded From Copilot Search
What it detects: Sites explicitly excluded from Copilot search via site-level setting.
Why it matters for Copilot: Inventory of opt-outs. Useful for governance review: are the right sites excluded? Are exclusions consistent with sensitivity labeling?
Site Owner Delegation Enabled
What it detects: Site owners can independently exclude their site from Copilot search without central governance.
Why it matters for Copilot: Decentralized opt-out is convenient but undermines central oversight. Either approve or block delegation deliberately.
SAI — Shadow AI
Shadow AI risks describe employee use of non-sanctioned AI services (ChatGPT, Claude, Gemini, Perplexity, browser extensions) that pull internal content into external AI processing pipelines.
Non-Copilot AI App Usage
What it detects: Use of consumer or third-party AI apps (ChatGPT.com, claude.ai, gemini.google.com) detected in network or audit logs.
Why it matters for Copilot: Content pasted into a consumer ChatGPT account leaves the tenant entirely. Common but invisible data leakage source.
AI Browser Extensions
What it detects: Browser extensions with AI capabilities installed on managed endpoints (Grammarly AI, Compose AI, Monica, etc.).
Why it matters for Copilot: AI-capable extensions read page content for processing, including from M365 web apps. Many have unclear data retention policies.
AI-Capable Third-Party Apps
What it detects: Approved third-party Microsoft 365 apps (Entra ID app registrations) that have AI processing capabilities.
Why it matters for Copilot: Approved apps with AI under the hood may export content for AI inference outside the tenant — an oft-overlooked exfiltration path.
How to scan all 99 risks automatically
Running this catalog manually across a single Microsoft 365 tenant requires roughly 8 to 10 working days of senior consultant time — PowerShell scripts for each category, multiple admin portals, and a hand-built consolidation. The math does not work for any MSP serving more than a handful of clients.
The Cloudiway AI Readiness Assessment automates the entire catalog as a 90-minute read-only OAuth scan. Every risk above is evaluated against the tenant; matches are scored on the 1.0–5.0 CAF scale, weighted into the global CAF Score, and exported as three deliverables: an executive PDF (6 pages, leadership-ready), a detailed risk PDF (every finding by severity), and a technical Excel (8 tabs of raw data plus a remediation checklist).
The interactive risk catalog is also available live at compass.cloudiway.com/compass/risk-catalog for partners and customers who want to browse, filter and export the catalog directly.
Scan your tenant against all 99 risks in 90 minutes
Read-only OAuth · No agent · No data stored · CAF Score · Executive PDF · 30-day remediation plan.
Start a Free AI Readiness Assessment →Frequently asked questions about the Microsoft 365 Copilot risk catalog
How many risks does Cloudiway Compass detect on a Microsoft 365 tenant?
The Cloudiway Compass risk catalog defines 99 distinct risk codes organized into 18 categories: 6 External Access Exposure (DE-EX), 5 Permission Model Exposure (DE-PM), 5 Sharing Link Exposure (DE-SH), 9 Teams Collaboration (TE-CR), 6 Sensitive Documents (SD), 5 Lifecycle (WG-LC), 5 Ownership (WG-OW), 2 Teams Channels (WG-CH), 5 Group Membership (WG-GR), 6 Admin Roles (AR), 6 Conditional Access (CA), 9 Exchange (EX), 5 Label Compliance (LC), 9 DLP (DLP), 5 Tenant Configuration (TC), 4 Copilot Tenant Settings (CT), 4 Restricted Content Discoverability (RCD) and 3 Shadow AI (SAI).
How are risks mapped to the CAF (Cloud Adoption Framework) score?
Each risk maps to one of the four CAF pillars used by the Cloudiway AI Readiness Assessment: Data Exposure (40% weight) covers DE-EX, DE-PM, DE-SH, TE-CR, SD and WG-LC; Access Governance (25%) covers WG-OW, WG-CH, WG-GR, AR, CA and EX; Data Protection (25%) covers LC and DLP; AI Governance (10%) covers TC, CT, RCD and SAI. The weighted average across pillars produces the global CAF Score from 1.0 to 5.0.
What is the difference between Data Exposure (DE) and Workload Governance (WG) risks?
Data Exposure (DE) risks describe configurations that make content reachable beyond its intended audience — anonymous links, org-wide sharing, external sharing, M365 groups containing guests. Workload Governance (WG) risks describe operational hygiene problems on the workload itself — missing owners, inactive teams, oversized groups, stale sites — that increase blast radius if a DE risk also exists.
Are all 99 risks detected by every Cloudiway scan?
Yes. A complete Cloudiway AI Readiness Assessment scan walks every Microsoft 365 workload (SharePoint, OneDrive, Teams, Exchange, Entra ID, Microsoft Purview) and evaluates every risk code in the catalog against the tenant. Risks that do not apply (for example, no DLP policies present means DLP-002 to DLP-009 are not flagged because the prerequisite DLP-001 already captures the underlying gap) are simply absent from the report.
How is each risk severity-scored?
Each risk carries an impact score from 1.0 to 10.0 derived from two factors: intrinsic severity (a permanent property of the risk type — anonymous links to sensitive files always score higher than dormant guests) and prevalence (how many tenant items match the risk). The catalog applies a base score plus a per-occurrence bonus capped at 10.0, then maps the result to severity tiers (Critical, High, Medium, Low) used in the executive PDF report.
Can the risk catalog be exported for an MSP's own assessment workflow?
Yes. The catalog is exposed both via the Cloudiway Compass UI at https://compass.cloudiway.com/compass/risk-catalog and via the Cloudiway Compass API. Each detected risk in an assessment includes the catalog code (e.g., DE-SH-002), category, the four-pillar mapping, the impact score, and a list of affected tenant items, so it can be ingested into any MSP ticketing or governance system for tracking.
Does the catalog cover risks specific to Microsoft 365 Copilot, or general M365 security?
Both. About one-third of the catalog is Copilot-specific (the LC, DLP, TC, CT, RCD, SAI categories), focused on what Copilot would surface or amplify after deployment. The remaining two-thirds covers general Microsoft 365 security and governance hygiene that pre-dates Copilot but becomes critical because Copilot inherits the existing permission graph at machine speed.
