What Microsoft Copilot Can and Cannot Read From Your Files

When you use Copilot in Microsoft 365 apps, you might wonder what data it can see inside your Word documents, Excel spreadsheets, and other files. Copilot accesses content from your Microsoft Graph, but it does not have unrestricted access to everything on your device or in your tenant. This article explains exactly what Copilot reads from your files, what it cannot read, and how permissions control this access.

Copilot works by grounding its responses on your Microsoft 365 data stored in Exchange Online, SharePoint Online, OneDrive for Business, and Teams. It does not scan local files on your PC or files stored outside Microsoft 365. Understanding these boundaries helps you use Copilot correctly and safeguard sensitive information.

You will learn the specific data sources Copilot connects to, the file types it can process, and the limitations you need to know. The article also covers how to verify and adjust permissions through the Microsoft 365 admin center.

How Copilot Reads Your Files

Copilot does not open files directly from your hard drive or from a USB drive. It accesses data through Microsoft Graph, the unified API for Microsoft 365. When you ask Copilot a question in Word, Excel, or Teams, it sends a query to Microsoft Graph, which returns relevant content from your Microsoft 365 storage locations.

The data sources Copilot can read include:

• Exchange Online: Email messages, calendar events, and contact details from your mailbox. Copilot can summarize email threads and suggest replies.
• SharePoint Online: Documents, lists, and pages from sites you have permission to access. Copilot can summarize a document library or answer questions about a specific file.
• OneDrive for Business: Files stored in your personal work cloud storage. Copilot can assist with documents you have opened or shared.
• Microsoft Teams: Chat messages, channel conversations, and files shared within Teams. Copilot can recap a meeting or pull action items from a chat thread.

Copilot only reads content that you have permission to view. If a file is not shared with you or is outside your Microsoft 365 environment, Copilot cannot access it.

File Formats Copilot Can Process

Copilot extracts text from these file formats:

• Word: .docx (not .doc)
• Excel: .xlsx (not .xls)
• PowerPoint: .pptx (not .ppt)
• PDF: .pdf (text-based only)
• Text: .txt, .csv

Copilot ignores images, charts, and embedded objects. It cannot read scanned documents that lack selectable text. For PDFs, the text must be extractable by standard OCR or text layer. Encrypted files or files protected by Information Rights Management are also inaccessible.

Steps to Verify and Adjust What Copilot Can Read

Admins can control Copilot data access through the Microsoft 365 admin center. Regular users cannot change these settings, but they can see which data sources are enabled.

1. Open the Microsoft 365 admin center
   Go to admin.microsoft.com and sign in with a Global Admin or SharePoint Admin account.
2. Navigate to Copilot settings
   Select Settings in the left navigation, then choose Copilot from the list.
3. Review data source permissions
   Under Data sources, you see a list of Microsoft Graph services. Each service has a toggle: Exchange, SharePoint, OneDrive, Teams. Toggle off any service to block Copilot from reading that data.
4. Limit SharePoint scope
   Click SharePoint and then Manage. You can restrict Copilot to specific site collections. For example, allow only the Sales team site and block the HR site.
5. Apply changes and test
   Click Save. Changes take effect within 15 minutes. Ask Copilot a question that references a file from the restricted source to verify the block works.

Common Limitations and Misunderstandings

Copilot reads local files on my PC

Copilot does not access files stored only on your local hard drive, network shares, or external drives. It only reads files stored in Microsoft 365 cloud locations. If you save a document to your desktop, Copilot cannot see it until you upload it to OneDrive or SharePoint.

Copilot can read all files in my OneDrive

Copilot reads files you have opened or that are shared with you. Files in your OneDrive that you have never opened in a Microsoft 365 app might not be indexed. The file must be processed by Microsoft Graph search. If a file is very old or corrupted, Copilot may not return results.

Copilot reads images and scanned PDFs

Copilot cannot read image content, including photos, screenshots, or scanned documents that lack a text layer. If you have a scanned PDF, it must first go through OCR in a tool like Microsoft Lens or Adobe Acrobat. Copilot only reads the resulting selectable text.

Copilot reads encrypted or rights-managed files

Files protected by Azure Information Protection or Microsoft Purview Information Protection are blocked. Copilot cannot decrypt these files. You must remove the protection or use a different method to extract the data.

Copilot reads files from third-party cloud storage

Copilot only works with Microsoft 365 storage. Google Drive, Dropbox, Box, and other third-party services are not supported. Files stored there are invisible to Copilot.

Copilot Data Access vs Copilot Pro: Key Differences

Item	Copilot Pro	Copilot for Microsoft 365
Target users	Individual subscribers	Business and enterprise users with Microsoft 365 E3 or E5
Data sources	Public web and limited Microsoft Graph (mail, calendar)	Full Microsoft Graph: Exchange, SharePoint, OneDrive, Teams, Viva
File access	Cannot read your Microsoft 365 files	Reads files you have permission to view in Microsoft 365
Admin control	No admin console	Full control via Microsoft 365 admin center
Data grounding	Bing search and public web	Your tenant data and optional web search

Copilot Pro is a personal assistant that does not connect to your work files. Copilot for Microsoft 365 is the business version that reads your organization’s data based on permissions. If you need Copilot to work with your SharePoint documents, you must have a Copilot for Microsoft 365 license.

Now you know exactly which files Copilot can read and which ones it cannot. Use the Microsoft 365 admin center to restrict data sources if needed. For sensitive documents, consider moving them outside the allowed SharePoint sites or applying encryption. Test your configuration by asking Copilot a question about a specific file to confirm access is working as expected.