A housing authority hears surprising Copilot answers about sealed case files and wants to investigate oversharing before blaming Copilot itself. What should staff do first?

When a housing authority hears surprising Copilot answers about sealed case files, staff should first use oversharing troubleshooting tools to check whether SharePoint permissions or links already expose the content too broadly. Copilot answers from content the signed-in user can access; unexpected answers usually mean the sharing model already allowed that access. Fixing oversharing addresses the root cause before blaming the model.

Auditing Copilot interaction history in Microsoft Purview to identify which users received answers containing sealed case files is a useful follow-up, but it does not correct SharePoint ACLs and does not address the root cause first. Assigning sensitivity labels to sealed case libraries to enforce encryption and control sharing of new case documents is a sound longer-term control, but it does not investigate whether existing sealed files are already overshared and should not come before the sharing check. Reconfiguring the central SharePoint search schema for sealed case libraries to reduce discoverability of sensitive files in Copilot responses is a broad change that may mask results without fixing actual permissions, so it is not the right first investigation step. Each wrong option fails because it escalates disruption or risk instead of inspecting sharing posture.

Exam caveat: On AB-900, “surprising Copilot output about sensitive content” commonly maps to investigate oversharing first. Copilot does not magically bypass Microsoft 365 permissions; overshared sealed files become visible to Copilot for users who inherited that access. Labels and DLP remain additional controls after sharing is corrected.

Operational check: Identify the sealed-case library, run oversharing troubleshooting for Everyone/Anyone/broad group links, remediate excess grants, confirm only authorized caseworkers retain access, have a test account without rights ask Copilot the same question, and verify the surprising content no longer appears. Document findings for the housing authority’s privacy officer.