Copilot is not 'ChatGPT with your files'. It is a retrieval pipeline wrapped around a model, and every capability, limitation and security property falls out of that pipeline. Walk one prompt through it and the product stops being magic.
The flow — what actually happens
Plain-language first; the packet-level
view underneath each step is what you'd see in a Wireshark trace, and what healthy looks like.
-
You ask: 'summarise what we agreed with Contoso'
The prompt does NOT go straight to a model. First stop is orchestration inside the Microsoft 365 service boundary: what is this user allowed to see, what sources could answer this, what app context (the open document, the meeting) is in play?
On the wire Client -> Microsoft 365 Copilot service over HTTPS 443 (the substrate endpoints). Nothing reaches any model yet — a DLP/policy block at this stage means the model never sees the prompt at all.
-
Grounding: retrieval runs AS YOU
Copilot queries the semantic index and Graph — mails, chats, files, meetings — strictly under YOUR permissions. It cannot read anything you cannot open yourself. This single fact explains both the magic (answers from your own world) and the scandal (it surfaces every file you technically had access to and never knew about — the oversharing concept).
On the wire Search/Graph queries with the user's security context; permission-trimmed results only. Proof: two users asking identical prompts get different answers — run that test once and the security model demonstrates itself.
-
The model call
Prompt + retrieved snippets + app context are assembled and sent to the LLM (Azure-hosted frontier models) INSIDE the service boundary. The model is stateless here: it sees this request's package, generates, and forgets. Your content does not train it.
On the wire Service-side call to the model deployment — not visible on your network. What IS observable: latency profiles (grounded prompts take longer than pure-chat ones — retrieval is real work).
-
Responsible AI + post-processing
The draft response passes safety and grounding checks, gets citations attached (links to the actual sources used), and only then renders. Citations are your audit handle: every claim should trace to a source you can open.
On the wire The interaction — prompt, response, citations — is recorded to the user's mailbox as a compliance record (audit/eDiscovery concepts). That record is the proof layer for everything governance needs.
The one-sentence model
Copilot = your permissions + retrieval + a stateless model + compliance recording.
Every question about Copilot ("can it see X?", "does it learn from us?", "why did it
miss the obvious document?") is answered by locating the right stage of that pipeline.
What each stage explains
| Question |
Stage |
Answer |
| "Can Copilot read the CEO's mailbox?" |
Grounding |
Only if THE ASKER can — it retrieves as the user, never as a service |
| "Why does it surface confidential files?" |
Grounding |
The asker had access (site link sprawl) — Copilot revealed reality, it didn't breach it |
| "Does it train on our data?" |
Model call |
No — tenant content is not used to train foundation models; the call is stateless |
| "Why is the answer stale?" |
Grounding |
The semantic index refreshes on its own cadence; brand-new content lags |
| "Why did legal find my prompts?" |
Recording |
Interactions are compliance records in your mailbox — by design |
| "Why is Copilot slow/down?" |
The pipeline |
Retrieval + model + RAI is a chain; June-2026-style outages hit any link (see reliability concept) |
The two honest limits to internalise
- Retrieval quality bounds answer quality. Copilot's ceiling is what search can
find under your permissions. Garbage sprawl in = confidently summarised garbage
out — which is why governance (module 3) precedes adoption, not follows it.
- The model is a component, not the product. Model upgrades swap under the
pipeline without your action; the governance surfaces are stable even as models
change. Manage the pipeline, not the model.
What to watch (proofs)
- The permission model live: the two-users-one-prompt test above; screenshot both.
- Retrieval visibility: response citations — every source listed is a document the
user can open; a citation they CAN'T open is a bug report, not a feature.
- The compliance record: Purview eDiscovery search for the user's Copilot activity
(interactions appear as searchable items) — run one search and the recording claim
is proven in your own tenant.
- Index freshness: create a document, ask about it immediately, then again later —
your tenant's real index lag, measured.
Discussion
No messages yet — start the thread.
