People are sharing Copilot chats by link. Who can see them, and should we turn it off?

Your DPO is asking the right question, and the answer is better than they might fear, with one real catch.

Here’s what’s going on. Roadmap 562353 (Session and Response Sharing in M365 Copilot) is now Launched on the MRC (GA August 2026, Worldwide, across web, desktop, Mac, mobile and Teams devices). Learn’s Manage content sharing for Microsoft Copilot page explains the two kinds. Session sharing shares a whole conversation, every prompt and response, as a snapshot of how it looked when shared. Response sharing shares one response along with the prompt that produced it. Either way the recipient gets a read-only view, and if they carry on, Copilot creates a separate copy in their own chat history.

The reassuring part: Learn says sharing a session or response doesn’t give recipients access to the files, emails, chats or meetings referenced in it. Existing Microsoft 365 permissions still apply, so a link to a cited document only opens for people who could already open it.

The catch is that the text of the answer is the content. If Copilot summarised a confidential file in the response, the summary is in the snapshot, whether or not the recipient can open the source. And with session sharing, every earlier prompt goes along too, including the one asking about a colleague’s performance review. That’s Schofield’s Third Law: the easier it is to share, the easier it is to share the wrong thing.

The controls, per Learn:

• One switch. In the Microsoft 365 admin center, under Copilot > Settings > Copilot sharing, the setting Allow users to share Copilot responses turns sharing on or off for the whole organisation. It’s on by default. Learn says it also governs sharing of content with lower-sensitivity labels (such as General or Public) or no label, which suggests more highly labelled content is treated differently, but the page doesn’t spell out the higher-label behaviour, so test it.
• Roles. Viewing the setting needs AI Reader; changing it needs AI Admin.
• What switching off does. No new links, and the Share option disappears, including from the meeting More options menu. Copies recipients already continued from stay in their history.
• Audit. Purview records sharing events, link opens and blocked sharing attempts, so you can see who shared what and when.

Options that actually work:

1. Leave it on, teach the habit. One line in your Copilot guidance: share a single response, not the whole session, and read it before you send. Best Steady path, because the alternative is copy-and-paste, which has no audit at all.
2. Leave it on, watch the audit. Have someone review sharing events monthly for the first quarter and report themes, not names, to the DPO.
3. Test labelled content. Share a response grounded in a Confidential file and see what the recipient gets, then write down the result.
4. Turn it off. Simplest answer for the DPO, but people will go back to pasting answers into Teams and email, where you lose the audit trail and the sensitivity context.

12 Panes action / comms: Tell the DPO: 562353 is launched and on by default; links don’t grant access to source files, but response text and earlier prompts in a session travel with the link; Purview audits shares and opens. Tell IT: Assign AI Admin to whoever owns the sharing setting, and run the labelled-content test. Tell staff: Share the response, not the whole chat, and check what’s in it first. Leadership: Sharing is safer than copy-and-paste because we can see it; we’re keeping it on with guidance.

Benefits / risks: Less copy-and-paste, reusable prompts, permission-respecting citations and an audit trail. The risks are that summaries of sensitive content travel in the text, whole sessions carry earlier prompts, the higher-label behaviour isn’t documented, and it’s on until someone decides otherwise.

I’d suggest this week: decide who owns the setting, run the labelled-content test, and add the “share the response, not the session” line to your Copilot guidance before the habit sets in.

DIGITAL SKILL WORKS LTD / 12 PANES · You ask, we answer