Understanding the Microsoft Copilot Details Page
The Microsoft Copilot details page shows everything the dashboard knows about your Copilot connection, including what Copilot did to your Microsoft 365 files.
This page goes further than the other application pages. Because Copilot works across your Microsoft 365 content, it also shows which files it has touched, which agents are operating on it, and where permissions may have widened as a result.
To open it, go to AI Security › Dashboard, then click View Details on the Microsoft Copilot card.
Finding your way back
The breadcrumb shows the path you took: AI Governance, Sanctioned AI, Microsoft Copilot. Click any step to go back.
Below it, the application name carries its connection status badge and the reporting period inherited from the dashboard.
What the page contains
The page has two halves. The upper half covers Copilot usage; the lower half, headed SharePoint & OneDrive visibility, covers what Copilot did to your files.
| Area | What it shows |
|---|---|
| Summary cards | Total Interactions, Human Identities, Agent Identities, Total Identities |
| Top Users | People using Copilot, ranked by interaction count |
| Sensitive Data (DLP) | Categories of sensitive data detected in Copilot traffic |
| Detected Agents | Agents operating on Copilot, each with its user and action counts |
| Connected Data Sources | The Microsoft 365 sources Copilot draws on, with a status against each |
| SharePoint & OneDrive visibility | A separate section with its own time filter and four cards |
| Copilot data footprint | The files Copilot accessed most often |
| Access volume by SharePoint site | Where that file activity was concentrated |
| External exposure risk | Correlated external-access and permission-change events |
Reading Detected Agents
Each agent is listed with its name, how many users it serves, and how many actions it has taken. The list is paged.
This is where Copilot differs from a directly used application. A populated list means work is being done on your behalf by agents rather than by people typing, so the Agent Identities card reads higher than zero.
Reading Connected Data Sources
This lists the Microsoft 365 sources Copilot can reach, such as SharePoint and OneDrive, with a status showing whether each is active.
These sources are what make the lower half of the page possible. Without them there is no file activity to report.
Reading SharePoint and OneDrive visibility
This section reports on Copilot file activity across your Microsoft 365 content store, built from logs rather than live inspection.
It has its own time filter, separate from the period inherited at the top of the page.
| Card | What it tells you |
|---|---|
| Files Touched by Copilot | How many distinct files Copilot accessed |
| Copilot Agent File Ops | File operations carried out by agents rather than people |
| Permissions Widened | How many times access to a file became broader |
| External Access Confirmed | Confirmed access from outside your organisation |
Permissions Widened is the figure to watch. It means content became reachable by more people than before, which is the mechanism by which a private file becomes a shared one without anyone deciding it should.
Reading the Copilot data footprint
This table lists the files Copilot accessed most often.
| Column | What it shows |
|---|---|
| File | The file name |
| Access Frequency | How many times it was accessed |
| Classification | The sensitive data classification of the file, if any |
| Initiated By | Who or what triggered the access |
| Last Accessed | The most recent access |
The badge in the corner shows the scope of the table. Human + agent means both are counted together.
Reading the remaining sections
Access volume by SharePoint site shows where file activity was concentrated. Until Copilot file activity is detected for the application, it shows No SharePoint site data yet.
External exposure risk correlates external-access events with permission-change events, to surface cases where widened permissions and outside access coincide. Until such events are detected, it shows No correlated exposure events yet.
Both are empty states, not errors.
What you can do from here
- See who your heaviest Copilot users are
- See which categories of sensitive data are passing through Copilot
- See which agents are operating on Copilot and how active they are
- Check which Microsoft 365 sources Copilot is drawing on
- See which files Copilot has touched most often
- Check whether file permissions have widened
- Return to the dashboard using the breadcrumb