Microsoft 365 Copilot Vulnerability: File Access Without Audit Log Entry
A vulnerability in Microsoft 365 Copilot reportedly allowed file access without creating corresponding audit log entries. Microsoft fixed the issue but did not notify customers or publicly disclose the vulnerability, leaving organizations unaware their audit logs may be incomplete.
What happened
A vulnerability in Microsoft 365 Copilot allowed the system to access files without recording the access in audit logs. The issue could be triggered by asking Copilot to behave in a manner that would prevent audit logging, making it possible to access files without leaving a trace.
Reported impact
The vulnerability created security and legal compliance problems for organizations that rely on audit logs to track who accessed sensitive files. Organizations could be unable to detect unauthorized file access if performed via Copilot, and compliance records could be incomplete or inaccurate.
Index analysis
Microsoft classified the issue as an 'important' vulnerability and fixed it. However, Microsoft chose not to notify customers or publicly disclose that the vulnerability existed, leaving organizations unaware that their audit logs may have been incomplete.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.