Findings & Tickets

"Everyone except external users" access on 3 sensitive sites

The Legal, HR and Finance libraries grant access to "Everyone except external users". Copilot surfaces any content a signed-in user can open, so this content would be available to every internal user as soon as Copilot is enabled. The Finance library also has an anonymous link, which is tracked separately as external sharing exposure.

Sensitivity label coverage at 61% on key repositories

Auto-labelling policy AL-04 has been drafted and is awaiting GDC approval for publication. Coverage on key repositories must reach the 90% Zertain threshold before the wider rollout gate.

9 guest accounts inactive for more than 90 days

These accounts retain access to any content shared with them until they are removed. The removal batch has been approved and scheduled. Guests cannot use GDC's Copilot, so the risk relates to content reach through search and sharing rather than to Copilot itself.

Legacy authentication on 2 service accounts

Legacy authentication does not support MFA, so these accounts bypass MFA. The owning application has not yet been identified; an enquiry is open with GDC IT.

No DLP policy for Microsoft 365 Copilot

Existing DLP policies cover Exchange, SharePoint, OneDrive, Teams and endpoints. The Microsoft 365 Copilot location must be configured in its own policy, so DLP-04 is being added under change CHG-1187. It excludes labelled files from Copilot and blocks prompts that contain sensitive data. Prompt-blocking availability in GDC's tenant will be confirmed before the policy is enforced.

Copilot audit records kept 180 days by default; custom policy set to 365 days

Copilot interaction records were subject to the default 180-day audit retention. GDC policy requires 12 months, so a custom audit retention policy for Copilot record types was set to 365 days and verified.