A city attorney's office wants a clear map of what Copilot can reach for each attorney. What should that map be based on?

Copilot data access should be mapped to the Microsoft 365 permissions that already govern each attorney's access to mail, files, and sites. A city attorney's office wanting a clear map of what Copilot can reach for each attorney should base that map on existing Microsoft 365 permissions—the governance baseline for Copilot. Microsoft 365 Copilot license assignments indicating which attorneys can launch Copilot in Teams and Outlook show who can start using the tool, not what each licensed attorney can actually reach; license assignments and underlying SharePoint and Exchange permissions are separate things. Using job-title and department attributes synced from Entra ID as a stand-in for permissions assumes those attributes predict access, but an attorney's actual group memberships and site access can differ from what those attributes alone imply. Matter numbers and folder structure used to organize case files in SharePoint libraries organize content for reference; they are not an access-control mechanism and do not reflect which attorneys actually have permission to each matter's content. Exam caveat: AB-900 emphasizes the relationship between Copilot reach and existing Microsoft 365 permissions without requiring Graph API coding. Operational check: inventory each attorney's group memberships and site/library access, remediate excessive grants, and treat that permission map as the predicted Copilot reach map for legal content. Practically, the attorney reach map is the same spreadsheet or access review you would use for ordinary Microsoft 365 least privilege—groups, site membership, and library permissions—not a second Copilot ACL product. When privileged legal matter workspaces are locked down correctly, Copilot reach shrinks with them; when matter folders are overshared to "All Staff," Copilot exposure expands for every attorney in that group.