Copilot can make existing oversharing easier to notice, but a guest account is not proof that Copilot automatically searches every tenant a person has joined. Investigate the specific source, account and Copilot experience before calling an answer a cross-tenant leak.
Microsoft describes organizational Copilot access as scoped to the signed-in user’s permissions. The important questions are whether the user was entitled to the source, how the information entered the conversation, and whether the resulting answer was shared with an inappropriate audience.
Official documentation checked: October 14, 2026. This guide is an investigation workflow, not confirmation that a particular tenant is secure.
Distinguish Access, Retrieval and Resharing
A document may have been explicitly shared, copied into a prompt, uploaded, retrieved through an authorized connector or returned by an agent. Those are different routes. An external organization’s name in an answer is not sufficient evidence that Copilot queried that organization’s tenant.
Microsoft’s architecture guidance does not establish the earlier article’s claimed automatic aggregation of all guest tenants. Do not use that unsupported token explanation to make security decisions.
There can still be a real incident if a source was over-shared or an authorized recipient copied sensitive output elsewhere. Investigate effective permissions and the destination audience, rather than assuming an AI-specific bypass.
Collect Evidence Before Restricting Collaboration
- Record the affected user, time, app, account/organization shown in the app, prompt and response. Preserve evidence in your approved incident system, not a public forum.
- Open each relevant citation with the same user account. Identify the actual file, site, message or connected system and its owner.
- Ask the owner to review direct permissions, group membership and sharing links. Check whether the content was also pasted or uploaded in the conversation.
- Have an authorized investigator search Microsoft Purview Audit for the relevant CopilotInteraction records and time window. Use the available app/resource information to corroborate the route. See the audit schema and search guidance.
- If unauthorized access is established, use your incident-response process to contain the specific access path while preserving required records.
A copied response or historical chat can retain information that was previously available. Retest retrieval in a new conversation after the access change, while separately handling already-created copies according to policy.
Use the Correct Cross-Tenant and DLP Controls
In the Microsoft Entra admin center, the documented route is Entra ID → External Identities → Cross-tenant access settings. Review the default configuration and the relevant partner’s organization-specific settings. Inbound and outbound collaboration, device/MFA trust and B2B direct connect are different controls.
Microsoft’s initial defaults allow B2B collaboration but block B2B direct connect; they do not mean that every external tenant is trusted for everything. Consult the cross-tenant overview and direct-connect setup before making changes.
Do not block all inbound and outbound access as a routine Copilot troubleshooting step. Such a change can interrupt legitimate collaboration. Scope an approved correction to the actual partner, users and applications, test it, and retain a rollback plan.
Purview DLP supports documented content and labeling conditions. It does not document the previously claimed condition “source tenant ID differs from the user’s home tenant ID.” The external-email preview control is also not a general cross-tenant-file firewall. Use the supported conditions for the actual content type.
Confirm the Fix Without Deleting Accounts
Test both an authorized user and a user who should not have access, using non-sensitive test content where possible. Confirm direct source access and Copilot behavior separately. If a shared-channel or custom-agent scenario behaves differently, identify that product path rather than broadening permissions to force it to work.
Do not delete a former employee’s account to “clear Copilot tokens,” and do not assume reassignment of a license transfers that employee’s chat history. Follow the established offboarding, session-revocation, retention and guest-access procedures with the responsible administrators.
Close the investigation with the source, access path, approved change, test evidence and owner. If the source cannot be identified, keep the case open; neither an empty search result nor a generic Copilot reassurance proves the issue resolved.