Copilot access is the permission for a Microsoft 365 user to use Microsoft 365 Copilot against the data, mail, and files that the signed-in account is already allowed to reach. Copilot does not normally bypass access controls; it inherits the user’s permissions, labels, and governance settings.
In cyber security, that matters because a stolen enterprise login can become much more useful when Copilot is available. An attacker who controls the account may use Copilot to quickly summarize email threads, extract business context, find payment-related details, and draft messages that sound internal and urgent. This can strengthen business email compromise and CEO-impersonation fraud without needing to break the AI service itself. Defenses focus on protecting identity and limiting blast radius: phishing-resistant MFA, least privilege, conditional access, mailbox-rule monitoring, and out-of-band verification for payment requests.