How Microsoft Copilot Decides Which Data Sources to Search

Official documentation checked October 14, 2026.

Copilot’s answer can draw on general model knowledge, information supplied in the conversation, work sources, web results, or an enabled extension. Which sources are available depends on the account, entitlement, app, task, and policy. There is no single Settings menu that controls all of them across every Copilot product.

This guide focuses on Microsoft Copilot for work or school. The Windows app, an Office document experience, and an organizational agent should not be treated as interchangeable search tools.

Distinguish available sources from sources actually used

Current Copilot Chat documentation describes work grounding, web grounding, and content attached to the prompt. In the updated interface, the Work IQ button replaces the older Work and Web tabs. When enabled for an eligible account, it allows reference to authorized work content; disabling it does not remove files or text that you explicitly provide. See Microsoft’s grounding explanation.

An available source is not a promise that every answer searched it exhaustively. Likewise, an answer without a citation is not proof that no relevant document exists. The useful test is whether the response answers the task using the correct, current source.

Permissions can arise from group membership, site access, or other authorized collaboration, not only a person directly sharing a file. Review those permissions if Copilot exposes information that seems surprising.

Check the controls in the experience you are using

1. Identify the account and surface. Record whether you are in organizational Chat, an Office app, or a named agent. Confirm your entitlement if organization-wide work search is expected.
2. Check work grounding. In the current Chat interface, inspect Work IQ. Older rollout interfaces may differ; do not look for an identical control in every Office pane.
3. Check web access separately. Use the control described for your Chat experience, subject to the administrator’s policy. Microsoft’s web-search guide explains the distinction. Disabling work grounding and disabling web search are different actions.
4. Inspect attached material and agents. Remove an unintended attachment before sending. For an organizational extension, ask which sources, permissions, and external services it uses.

Microsoft supports several extension mechanisms, including agents, connectors, and tools. Their configuration is not a universal “Plugins” tab inside every Microsoft 365 app. Do not grant new permissions simply because a guessed menu is missing.

Test one known source before broadening the question

Open an approved source yourself and confirm its title, location, and date. Use a prompt such as: “Use the attached current travel policy. What approval is required for this trip? Cite the supporting section and say if the document does not answer.” This is a suggested test prompt, not a technical restriction on the service.

Compare the result with the original. If the answer uses public advice instead, inspect work grounding and attachment selection. If the wrong revision appears, name or attach the correct revision and check the date. If the file cannot be opened directly, resolve access with its owner rather than asking Copilot to bypass it.

A local or network file is not automatically covered by organization-wide cloud search. Do not move confidential files to OneDrive, upload them, or connect an external service merely as a troubleshooting experiment. Use an approved attachment, connector, or storage route with the data owner’s agreement.

Treat citations as evidence, not a complete audit log

Open cited sources and check whether they actually support the conclusion. For an important answer, record which claim each source establishes and which claims remain unsupported. A citation to the correct document does not guarantee that every sentence in the response came from it.

If an agent behaves unexpectedly, the administrator can review its access and distribution in the agent management controls. Supply the agent name, user, time, sanitized prompt, and observed source. Do not assume a keyword “trigger” explains all extension routing.

For a possible information leak, preserve the evidence and escalate. Prompt wording can improve relevance, but source permissions and approved governance controls—not a request to “use only this”—provide the security boundary.