# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-M365-TENANT-020
title: Restrict Copilot web search, agents and third-party AI providers
finding:
  title: Copilot can reach the web, run any agent and use third-party AI models without review
  description: Prompts and grounding data can be sent to Bing or to third-party model providers, and users can install or share agents that have not been assessed.
status: active
profiles: [hardened]
risk:
  severity: medium
assessment: manual
tags: [copilot, ai, agents, web-search, data-protection]

applicability:
  requires:
    - "Microsoft 365 Copilot"

description: |
  Microsoft 365 Copilot settings follow a decision recorded by the organization (data protection
  officer and security team) and, by default in this profile:

  - **Web search** (web grounding in Microsoft 365 Copilot and Copilot Chat) is turned off, or
    limited to groups whose use case was assessed;
  - **agents**: access is limited to selected groups, sharing agents with the entire organization
    is limited to administrators, and only agents built by the organization or approved in
    **Integrated apps** can be installed;
  - **AI providers operating as Microsoft subprocessors** (such as Anthropic models) are off until
    an assessment covers data location and processing terms;
  - **self-service trials and purchases** of Copilot are not allowed.
rationale: |
  Web grounding sends generated search queries, derived from prompts and work content, to Bing,
  outside the Microsoft 365 service boundary. Third-party model providers process prompts under
  separate terms, which matters under GDPR and for data sovereignty. Agents and their connectors
  act with the user's permissions and can reach external services. Each of these features widens
  where work data goes, so it should be enabled by decision, not by default.
impact: |
  Users lose web answers in Copilot and access to agents that are not approved; they request them.
  Copilot features change often: review these settings at each major announcement.
notes: |
  This control is drawn from the ASD Blueprint and will be revisited when CIS or SCuBA publish
  Copilot rules. Copilot Studio agents are covered in the POWER domain, agent identities in the
  APPS domain.

audit:
  manual: |
    1. Sign in to the Microsoft 365 admin center (https://admin.cloud.microsoft) as at least a
       Global Reader (AI Administrator for Copilot settings).
    2. Browse to **Copilot** > **Settings** and open:
       - **Web search**: check how web search is controlled (the Cloud Policy setting **Allow web
         search in Copilot** in the Microsoft 365 Apps admin center, https://config.office.com) and
         that it is disabled or scoped to assessed groups;
       - **Data access** > **AI providers operating as Microsoft subprocessors**: third-party
         providers are disabled;
       - **User access** > **Microsoft 365 Copilot self-service purchases**: **Do not allow**.
    3. Browse to **Agents** > **Settings** (or **Copilot** > **Agents**): **Allowed agent types**,
       **Sharing** and **User access** are limited as described.
    4. Browse to **Settings** > **Integrated apps** and check that each available agent is
       approved.
    5. Fail if any of these settings is open to all users without a recorded decision.

remediation:
  manual: |
    1. With an AI Administrator or Global Administrator, record the organization's decision for
       each feature.
    2. In the Microsoft 365 Apps admin center (https://config.office.com) > **Customization** >
       **Policy Management**, create or edit a policy with **Allow web search in Copilot** set to
       **Disabled** (or enabled only for an assessed group), with an Office Apps Administrator.
    3. In the Microsoft 365 admin center, **Copilot** > **Settings** > **Data access**, disable the
       third-party AI subprocessors; **User access**, set self-service purchases to **Do not
       allow**.
    4. In **Agents** > **Settings**, limit allowed agent types to those built by the organization
       and approved ones, sharing to administrators, and access to selected groups.
    5. Block or remove unapproved agents in **Settings** > **Integrated apps**.
  rollback: |
    Re-enable the features in the same pages.

references:
  - title: Configure Microsoft Copilot settings in the Microsoft 365 admin center
    url: https://learn.microsoft.com/copilot/microsoft-365/microsoft-365-copilot-page
    publisher: Microsoft
    kind: vendor-doc
    accessed: 2026-10-24
  - title: Manage web search in Microsoft 365 Copilot and Copilot Chat
    url: https://learn.microsoft.com/copilot/microsoft-365/manage-public-web-access
    publisher: Microsoft
    kind: vendor-doc
    accessed: 2026-10-24
  - title: Manage agents for Microsoft 365 Copilot in the Microsoft 365 admin center
    url: https://learn.microsoft.com/microsoft-365/admin/manage/manage-copilot-agents-integrated-apps
    publisher: Microsoft
    kind: vendor-doc
    accessed: 2026-10-24
  - title: ASD's Blueprint for Secure Cloud, Copilot settings
    url: https://blueprint.asd.gov.au/configuration/microsoft-365/copilot/settings/
    publisher: Australian Signals Directorate
    kind: guide
    accessed: 2026-10-24
mappings:
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: AC-4
    relation: related
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: CM-7
    relation: related
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: SA-9
    relation: related
related_controls:
  - id: CB-M365-POWER-022
    type: related
  - id: CB-M365-APPS-018
    type: related
  - id: CB-M365-APPS-019
    type: related
  - id: CB-M365-POWER-024
    type: related
  - id: CB-M365-DATA-004
    type: related

authors:
  - name: Alice
    github: Sn0wAlice
introduced_in: 0.1.0
created: 2026-10-24
updated: 2026-10-24