The New Unified Experience
Microsoft is consolidating its AI assistant into a single, unified Copilot app that allows users to switch between personal and work accounts. This move aims to simplify a previously fragmented experience where users might have had to navigate different
apps for different tasks. Now, whether you're using Copilot with a personal Microsoft account or a work account provided by your employer, the experience lives within one application. This unified app includes chat, image generation, and direct access to Microsoft 365 apps like Word, Outlook, and Excel. For employees, this means a more seamless workflow. For instance, you can be signed into both your work and personal accounts within an app like Word and use Copilot features, even if only one of those accounts has a Copilot license.
For Employees: Flexibility Meets Responsibility
The primary benefit for employees is convenience. You can now use a single interface to manage tasks across different contexts, such as using a personal Copilot Pro license to assist with a work document. The account switcher is designed to make toggling between identities straightforward. However, this flexibility comes with a crucial responsibility. While Microsoft states that work and personal experiences are separated by design and data does not flow between them, the user is still the one directing the AI. The most significant risk is accidental data crossover. For example, an employee might inadvertently paste sensitive company data into a Copilot prompt while signed in with their personal account, which may not be governed by the same strict corporate data protection policies. It is vital to always be aware of which account is active before using Copilot, especially when handling confidential information.
For IT Administrators: Control and Governance
For IT administrators, the introduction of multiple account access raises important questions about security and compliance. The good news is that Microsoft has confirmed that existing security, privacy, and compliance controls remain unchanged. When a user accesses a work document, Copilot's data protection is always based on the work identity used to access that file, regardless of which account provides the Copilot license. This ensures enterprise data protection policies are respected. Furthermore, admins have the power to manage this feature. Using the Cloud Policy service for Microsoft 365, administrators can deploy the "Multiple account access to Copilot for work documents" policy to control or completely disable the ability for users to use a non-corporate Copilot license on work files. This gives organisations granular control over how AI is used with their data.
Understanding the Data Security Layer
Microsoft has built safeguards to maintain a boundary between personal and work data. When Copilot is used with a work or school account, the prompts and responses are processed and stored in line with the organization's existing Microsoft 365 data commitments. This data is encrypted and is not used to train the foundational large language models (LLMs). However, the biggest security concern remains the risk of data oversharing that already exists within an organisation. If a user has excessive permissions and can access sensitive files they shouldn't, Copilot can also access and potentially summarise or transmit that data based on user prompts. Therefore, the rollout of Copilot serves as a critical prompt for IT departments to audit existing data access permissions and ensure that sensitive information is properly secured and labelled.
Best Practices for a Secure Rollout
A successful and secure adoption of Copilot with multiple accounts requires a partnership between the IT department and employees. For IT administrators, the first step is to review and configure the multiple account access policy based on the organization's risk tolerance. Conducting an audit of data permissions to mitigate the risk of oversharing is also essential before a wider rollout. Clear communication and training for employees should be a priority, educating them on the risks of data leakage and the importance of checking which account is active. For employees, the best practice is simple: pause and verify. Before asking Copilot to summarise a document or draft an email, double-check the account indicator in the app. Treat Copilot as an extension of your professional responsibilities, ensuring that company data is only ever processed while logged in with your work account, under the protection of corporate security policies.
