Microsoft Copilot adds chat-derived memory with enterprise controls still limited

Microsoft says Copilot learns key details about users and their work during Copilot Chat conversations, then can turn chat inferences into manageable memories. Examples include a user’s job role, common tasks, and skills they want to improve.[2] The company says Copilot can draw on conversations, usage data, Microsoft 365 work data, usage signals, and profile information to personalize recommendations; saved memories also become part of the context used to generate responses.[2] NewsBytes reported that personalization could also draw on information from Bing, MSN, and Edge.[1]

Microsoft says saving memories is on by default, and Copilot asks whether to save information it considers important for future chats.[2] The Enhanced personalization control that allows end users to use memory is also turned on by default, according to Microsoft’s documentation.[3] NewsBytes warned that the setting might turn on automatically without a user’s request.[1] Users can delete all memories through the Delete all memories control, but switching memory off does not automatically remove memories already saved.[2] Temporary chats do not access or store personalized information.[4]

Organization retention policies and labels do not apply to this memory data.[3] Deleting a chat also does not delete saved memories generated from it.[3] Administrators can use eDiscovery and Microsoft Graph Explorer to search, export, and delete users’ memory data.[3] Microsoft says an IT administrator might be able to access the data during the retention period.[4]

Microsoft says administrators cannot restrict which types of information are added to Copilot memory, and memory or personalization actions do not create Purview audit-log entries.[3] Those limits matter for organizations assessing how the feature fits their existing oversight practices. NewsBytes reported that Microsoft cited monitoring performance, troubleshooting, diagnosing bugs, preventing abuse, and improving the product as reasons for recording data.[1] NewsBytes also said Microsoft advised users not to share sensitive information, including health information or sexual orientation, with Copilot.[1]