The Six Checkpoints Your Question Passes in Microsoft 365 Copilot

Checkpoint zero · What you type is not what the model receives

Everything else follows from this, and it is on Microsoft's own semantic indexing page rather than in anybody's commentary. Copilot does not hand your sentence to a model. It uses your sentence to search, adds what it finds, and sends the result onward.

Semantic indexing works by "appending additional information to your Microsoft Copilot prompt". Semantic indexing for Microsoft 365 Copilot

And then, in the same five-step flow: "Copilot sends the modified prompt to the Large Language Model." Semantic indexing for Microsoft 365 Copilot

Modified prompt. Those are Microsoft's words, not a paraphrase. You never see the modification, and you never see what it failed to find. That is the whole reason a list of checkpoints is useful: each one is a place where the search comes back with less than you assumed, and none of them announce themselves in the answer.

Part one · Checkpoints 1 to 3

What you can reach

The three that decide what is available to your question

All three are about reach. Not one of them is about the model being clever or stupid, which is why rewriting the prompt is the wrong first move when an answer is missing something you know exists.

Copilot only sees what you can already open

There is no separate Copilot account with its own keys. It runs as you.

"Copilot can only summarize or reference content that the user is authorized to access." Copilot architecture and data protection · updated 6 May 2026

The consequence people trip over is not the rule, it is what the rule implies: the answer is not a property of the question. Two colleagues, same tenant, same afternoon, the same sentence word for word, and two different answers. Nothing has gone wrong. That is the security model working exactly as designed.

So when two of you compare notes, the first question is not which answer is right. It is which files each of you can see.

The label on the file

Where a sensitivity label applies encryption, Copilot needs usage rights on the file before it will work with the content. Microsoft states the requirement twice, and the two statements do not agree.

One bullet

"When encryption is applied, the user must have EXTRACT and VIEW usage rights for Copilot to interact with the content."

The next bullet

"Items encrypted by Azure Rights Management without a sensitivity label still require EXTRACT or VIEW usage rights for the user for Copilot to summarize the content."

Same page, one bullet apart, and neither sentence carries a version number. This guide is not going to tell you which one is current, because there is no way to know from the page. What both versions agree on is the practical test: the right to copy from the file. Build your expectations on that and you are safe under either reading.

The second edge on this checkpoint

In Word, Excel and PowerPoint the policy that prevents Copilot from processing content is "evaluated at file open". If a sensitivity label is applied mid-session, it is enforced "the next time the file is opened". A document can be relabelled while it sits on your screen and nothing changes until you close it and reopen it.

The policy your administrator wrote

This one only applies if an administrator has configured a data loss prevention policy for the Microsoft 365 Copilot location with the sensitivity-labels condition. It is not out-of-the-box behaviour, and any version of this claim that implies otherwise is false. Where such a policy does exist, here is the state it leaves you in.

Body of the page

"Identified items still appear in the citations of the response."

Conditions table, same page

"The content of the item is not processed by Copilot or used in the response summary", though "the item could be available in the citations of the response."

Two different promises about the same feature, and the disagreement sits on the thing that tells you whether your document was used. This guide uses the weaker wording throughout: a citation can appear, never always appears.

Whichever sentence is current, the useful consequence is the same and it is narrower than the internet version of it. The cited item is real. It exists. You can open it. The citation is real and the reading did not happen. That is not a fabricated source and it is not a hallucination, and calling it one gets the mechanism wrong.

Whether the interface marks such a citation is not written down anywhere on the page. Not that it does, not that it does not.

Two more edges from the same page

Uploads are a different path: "DLP can't scan the contents of files that you upload directly into prompts, so evaluation of the uploaded file for sensitive data doesn't occur. DLP only checks the text you type into the prompt itself." And policy changes are not immediate: "Updates to a DLP policy can take up to four hours to reflect in Microsoft 365 Copilot and Copilot Chat experience." Which turns "we fixed it in Purview" into "we fixed it in Purview, and it is still the old behaviour until this afternoon".

What was not done to test this

None of checkpoint 3 was demonstrated on a live tenant. Configuring Purview DLP policies in a real company tenant to find out what happens is not something anyone should do for a video, in simulation mode or otherwise. The documentation is the exhibit, and in this case it is the stronger exhibit, because it carries Microsoft's own conditions table and its own disagreement with itself.

The triage that comes out of the first three

When an answer is missing something you know exists, the instinct is to rewrite the prompt. Do that fourth, not first.

Can you open the document yourself, right now, in a browser? If not, checkpoint 1 already answered your question and no prompt will get past it.
Is the file labelled and encrypted? Try to copy text out of it. If you cannot, checkpoint 2 is in play. If it was labelled while you had it open, close it and reopen it.
Is the document in the citations but plainly not in the answer? That is the checkpoint 3 shape, and the person who can confirm it is whoever owns your Purview policies.
Only now, rewrite the prompt, and rewrite it the way the last section of this guide describes rather than by adding adjectives.

Part two · Checkpoints 4 to 6

Whether it was ever findable

The three that decide whether it was ever in the index to be found

Your permissions can be perfect and all three of these can still leave a document out of the answer. That is what makes them worth knowing: they fail quietly, and they fail in ways a prompt cannot fix.

Content somebody pulled out of reach

Restricted Content Discovery is how an administrator takes a site out of organisation-wide search and Copilot experiences. Three sentences from the page decide what it actually does, and none of them say what the name suggests.

"The feature doesn't remove content from the Microsoft 365 search index." Also on the page: "eDiscovery and auto-labeling continue to function." Restricted Content Discovery · updated 28 July 2026

"For sites with more than 500,000 items, an update to Restricted Content Discovery could take more than a week to fully process and reflect in search and Copilot experiences." Restricted Content Discovery

It "doesn't affect experiences that operate on content that's already in use by the user, such as summarizing an open document." Restricted Content Discovery

Put together: restrict a large site on Monday and Copilot can keep answering from it for over a week. Once the restriction does land, a document somebody already has open still gets summarised.

The governance sentence to get right

Restricted Content Discovery is a discovery control, not an access control, and Microsoft says so on the page. The mistake it invites is reading "restricted from Copilot" as "Copilot cannot see it". Permissions are unchanged; users who already have access keep it.

The web, and who decides whether you get it

Web search is on by default, and an administrator can turn it off: "If the IT admin turns off web search, the Web content toggle is turned off and appears dimmed. Users can't turn on the toggle to use web search."

The more interesting half is what gets searched. Copilot does not send your sentence to Bing.

"This generated search query is different from the user's original prompt, it consists of a few words informed by the user's prompt." Manage public web access for Copilot · ms.date 15 July 2026

Microsoft's own worked example on that page is the clearest thing in this guide. The prompt "Who is my manager and what public information is available about them?" produces a generated query that is the manager's name. Copilot finds the name in Microsoft 365 data, then builds a Bing query from it. This is checkpoint zero made visible: the search that runs is not the sentence you wrote.

What you can see

The exact derived queries, in the chat thread, for 24 hours. Not in the Copilot pane inside Word or PowerPoint, where citations for web queries are not available at all.

What your administrator can see

"Search, audit, and eDiscovery on the exact web search queries Copilot derived from the user's prompt." The page gives no retention period, so this guide does not state one.

Credit where it is due: Copilot showing you the queries it derived is real transparency, and most tools do not. The asymmetry is worth knowing anyway, because the two windows are not the same length.

Read this one exactly as written, and no further

The same page says: "The Microsoft Products and Services Data Protection Addendum (DPA) doesn't apply to the use of generated web search queries in Microsoft 365 Copilot, Microsoft 365 Copilot Chat, or the Bing search service. Also, HIPAA compliance and the EU Data Boundary don't apply to generated search queries."

That is a statement about which agreements cover the derived query. It is not a statement about what the query contains or where it goes, and it must not be repeated as one. The same page also says prompts and responses stay within the Microsoft 365 service boundary "without customer direction". Those are two different sentences about two different things, and merging them produces a claim neither one supports.

Was the file ever readable

The least glamorous checkpoint on the list, which is exactly why it catches people. These are the published limits of the Microsoft Graph File Share connector, the connector that puts on-premises Windows file shares into Copilot.

"The maximum supported file size is 100 MB. Files that exceed 100 MB aren't indexed. The maximum post-processed size limit is 4 MB. Processing stops when a file's size reaches 4 MB. Therefore, some phrases present in the file might not work for search." Microsoft Graph File Share connector · updated 23 July 2026

"Only the textual content of these formats is indexed, and all multimedia content is ignored. For multimedia and other file types, only metadata is indexed." Microsoft Graph File Share connector

Read plainly: on a connected file share, the back half of a long specification may as well not exist, and a scanned or image-based drawing reduces to a filename and some properties. The file name is in the index. What is drawn is not. Nothing in an answer tells you which of your files hit that ceiling.

Scope, and this one matters

4 MB is the File Share connector's post-processed limit. It is not a Copilot-wide file limit. "Copilot only reads the first 4 MB of your documents" is false, it is the easiest mistake to make with this number, and it is worth correcting whenever you see it. The claim only holds where the connector is the path to the file.

One inconsistency on that page

GIF, JPEG, JPG and PNG appear in the indexable-formats list under Capabilities, and the very next sentence says multimedia content is ignored and only metadata is indexed. Read together, images are indexed for metadata only. Do not quote the format list without the sentence that follows it.

The technique

And it is not what you have been told

Write it like it has to find something

The advice in circulation is right. The reason attached to it is wrong, and the wrong reason is why people abandon the advice the moment it stops working.

The reason you were given

Be specific, or Copilot's guardrails will block you. Copilot is stricter. Copilot is locked down. Vague questions get refused.

What actually happens

Nothing gets refused. A vague question does not get blocked, it gets answered from the model instead of from your data, and the answer is fluent either way. Be specific because a name is what survives the rewrite.

Go back to checkpoint zero. Your words are also the search, and a search has to match something. "Summarise my last meeting" gives a search nothing to grab: last according to whom, in which calendar, and does that calendar even hold the meeting you mean. "Summarise the Q3 budget preparation meeting" gives it a title. A title is findable, and it survives being rewritten. Ask like you are talking to a search box that has to find something first, because it is one.

The only signal you get about whether any of that worked is whether there are sources underneath the answer. And as checkpoint 3 shows, a citation is not a receipt.

Seven patterns, with the real reason for each

Every reason below has been checked against a Microsoft page or against a filmed test. Three of these patterns circulate with reasons that are flatly false, and those are marked.

Pattern	Instead of	Write	The real reason
1. Anchor to a real object	VagueWhat were the key points from yesterday's meeting?	AnchoredSummarise the Teams meeting titled "Q3 Strategy" held on 12 August 2026, which I attended. Focus on action items assigned to me.	A title and a date are things that can be looked up. Microsoft's own worked example shows the derived query for "who is my manager" is the manager's name: the proper noun is what came through. That example is web search, and no page says tenant retrieval behaves identically, so treat it as the principle rather than the proof.
2. Name the file and where it lives	VagueDraft an email about the new campaign.	AnchoredDraft an email about the "Summer 2026 Campaign" document in our SharePoint "Campaigns" folder. Include the budget highlights and ask for feedback by Friday.	Your prompt is rewritten before it reaches the model. Proper nouns survive a rewrite. Adjectives do not.
3. Stay inside your own access	VagueShow me all customer feedback from last month.	AnchoredList the customer feedback emails in my "Client Feedback" Outlook folder from the last 30 days and summarise the top 3 recurring themes.	Documented, not folklore: "Copilot can only summarize or reference content that the user is authorized to access." Labels and DLP can subtract further, and quietly.
4. Ask for the tool you will actually use	VagueCreate a project timeline in a Gantt chart.	AnchoredCreate a project timeline in Microsoft Planner for the "Product Launch" task list, using milestones from the "Timeline" Excel file in the same SharePoint folder.	Not because Copilot is restricted to Microsoft tools. It is not. This is about the output landing somewhere you can use it, which is a workflow reason rather than a permission one.
5. Point at data, not at the future	VaguePredict how our sales will perform next quarter.	AnchoredAnalyse the "Q2 Sales Data" Excel file in our "Finance" SharePoint site and identify the top 3 trends.	Not because Copilot avoids speculation. It will speculate happily. The difference is that one answer is your data talking and the other is the model talking, and the interface does not label which.
6. For automation, name the platform	VagueWrite a Python script to clean this dataset.	AnchoredCreate a Power Automate flow to extract "Customer Name" and "Order Value" from the "Sales Records" Excel file in our "Data" SharePoint folder.	The usual reason for this one is false and should not be repeated. Copilot writes and runs Python; that was tested. The real reason is durability: a flow persists and a script in a chat window does not.
7. Start from a template that exists	VagueWrite a press release about our new product.	AnchoredDraft a press release using the "Press Release Template" in our "Templates" SharePoint folder, populated with details from the "Product Launch Plan" Word document.	Two retrieval anchors instead of zero, and the house format comes along for free.

Three things you will read that are wrong

All three circulate in prompt packs and internal training decks. Each one is disproved in seconds, and each one takes the rest of the advice down with it.

Claim

"Copilot cannot access the open web."

Reality

Web search is on by default. An administrator can turn it off, at which point the toggle is dimmed for users, but the default is on.

Claim

"Copilot restricts code generation to Microsoft 365 tasks."

Reality

It wrote and executed general-purpose Python, including OpenCV and pytesseract, on a live tenant on 13 August 2026.

Claim

"Copilot only works with files stored in Microsoft 365."

Reality

Files upload directly into prompts, and Microsoft's DLP page carries a section titled "Files uploaded in prompts". Checkpoint 3 notes what that path does to inspection.

What this guide does not claim

A list of checkpoints reads as more certain than the evidence behind it, so here is the evidence's own boundary. These are limits of the sources, not hedging.

No frequency, anywhere. The retrieval behaviour shown in the episode was observed twice, minutes apart, in one tenant, with the model pinned by hand to the same model both times. Twice is an existence proof, not a rate. Nothing here says how often anything happens.
No named cause for it either. The effect was observed. The mechanism was not, and nothing in the documentation explains it, so it is not going to be guessed at here.
Two Microsoft pages contradict themselves and this guide does not resolve either one. Neither contradicting sentence carries a version number, so there is no way to tell which is current from the page.
Nothing was tested by configuring policy on a live tenant. Checkpoints 2, 3 and 4 are documentation findings.
No retention period for admin-side query logging, because the page does not give one.
Every quotation was taken from the fetched page, not from a search summary. Two search summaries during this research produced precise-looking figures that appear nowhere in the pages they cited.

Every page quoted, both parts

Six pages. All read 13 August 2026. Microsoft revises these without notice and none of them carry a version history, so check the date on the page against the date here before relying on a quote.

Page	Page date when read	Used for
Semantic indexing for Microsoft 365 Copilot	updated 23 April 2026	Checkpoint zero
Copilot architecture and data protection	updated 6 May 2026	Checkpoints 1 and 2
Learn about DLP for Microsoft 365 Copilot	updated 17 July 2026	Checkpoints 2 and 3
Restricted Content Discovery	updated 28 July 2026	Checkpoint 4
Manage public web access for Copilot	ms.date 15 July 2026	Checkpoint 5
Microsoft Graph File Share connector	updated 23 July 2026	Checkpoint 6

Where all of this stops

Nothing in this guide, and nothing in the episode it accompanies, is a method for putting AI inside a safety authorisation decision. Permit to work, lock out tag out, confined space entry, job safety analysis, incident classification, inspection sign-off: those carry a named accountable human, and they stay that way.

The six checkpoints are the argument for that boundary rather than a caveat attached to it. A retrieval system that can miss a document because of a label, a policy that has not propagated yet, a restriction that takes a week, or a file share that stopped indexing a document at 4 MB, is a system that can return a confident and incomplete answer without saying so. AI prepares. Humans decide.