Summary of governance, lifecycle, and compliance capabilities for Copilot Pages and Copilot Notebooks

As a Compliance Manager or IT administrator, it's crucial to stay up-to-date on the latest governance, data lifecycle, and compliance posture for the software solutions being used in your organization. This article details the capabilities available and not available yet for Copilot Pages and Copilot Notebooks.

At a glance

SharePoint Embedded

Copilot Pages and Copilot Notebooks content are stored in SharePoint Embedded. Content stored in SharePoint Embedded containers follows the SharePoint Embedded security and compliance documentation. The sections below outline governance, lifecycle, and compliance capabilities applicable to all Copilot Pages and Copilot Notebooks storage types.

Foundations

• Admin policy: Use Cloud Policy to turn on or off creation of Copilot Pages and Copilot Notebooks. Copilot Pages can also be shared as Loop components in supporting apps. See relationship to Loop components.
• GDPR: Data subject requests can be serviced through the Microsoft Purview portal and Purview eDiscovery workflows.
• EUDB: Compliance is supported. See What is the EU Data Boundary?

Data Security, Devices

• Intune: Device Management Support is available for the Microsoft 365 app and Teams app on iOS and Android.
• Conditional Access: Only applies at the app level. Because Copilot Pages and Copilot Notebooks are features of the Microsoft 365 Copilot app, Conditional Access applies to the entire app at m365.cloud.microsoft. Use admin policies to block creation of new content.
• Information Barriers: Not supported. See admin policies for available controls.

• Customer Lockbox: Supported.
• Guest app access: Available for Copilot Pages and Copilot Notebooks containers. Enables third-party export/eDiscovery tools, migration tools, and developer APIs. Use PowerShell to Get and Set guest app permissions.

Data Lifecycle

• Storage: Copilot Pages and Copilot Notebooks are stored together in a single user-owned SharePoint Embedded container that is also used by Loop My workspace. In admin tools, the owning application is shown as Loop. Storage counts against your organization's SharePoint quota. See Managing SharePoint Embedded containers.
  • Limitation: There's no admin control to set limits on individual containers.
  • Admin control note: This single user-owned container can be created when either the Loop policy or the Copilot Pages and Copilot Notebooks policy allows creation for the user. To prevent creation, disable both policies for the same user.
  • Limitation: Unlike OneDrive, there's no user workflow for content after departure. The container is deleted on the same schedule as OneDrive defaults. See Storage management after user departure.
• Multi-Geo: Supported. The container is created in the geo matching the user's preferred data location.
  • Known issue: Some operations may not work correctly after moving containers across geos. Microsoft is working on a fix.
• Recycle bin: No end-user recycle bin exists.
  • Limitation: Neither administrators nor end users can recover individually deleted Copilot Notebooks.
• Version History: Export in Purview or via Graph API. 50 versions per file (not configurable).
• Audit logs: Available for all events. Retained, exportable, and streamable to third-party tools. Search in Purview for "page" and filter by "SourceFileExtension":"page". Copilot Notebooks create and update .pod files to manage content.

eDiscovery

• Purview eDiscovery: Supported for search/collection, review (Premium license required), and export as HTML (Premium license required) or original format. Download and reupload files to OneDrive to view in native format.
  • Limitation: Full-text search within .page files in Purview review sets isn't available.
• Graph API export: Supported for third-party tools. Use PowerShell to Get and Set guest application permissions.
• Legal Hold: Supported. Content is stored in the Preservation Hold Library.
  • Limitation: Unlike OneDrive, Copilot Pages and Copilot Notebooks aren't automatically included when a user is placed on Litigation Hold. You must manually add the container for each user.

Microsoft 365 retention and deletion

• Retention policies from Microsoft Purview Data Lifecycle Management configured for all SharePoint sites are enforced for all Copilot Pages and Copilot Notebooks.

  • For more information on how to configure specific Copilot Notebooks, see Purview and SharePoint Embedded

• Retention labels from Microsoft Purview Data Lifecycle Management and Microsoft Purview Records Management are supported for Copilot Pages (.page files) and Copilot Pages in Copilot Notebooks by applying published labels in OneDrive or SharePoint, or automatically applying the labels. There's limited support for manually applying retention labels.

  • Retention labels cannot be viewed or applied directly from a Copilot Page. Instead, the user must navigate to the Copilot Page within the Loop app to view or apply a retention label on a Copilot Page.
  • Retention labels that mark the content as a record or regulatory record can't be manually applied in either the Copilot Page or when the content is opened in the Loop app. If content is automatically labeled as a record, locking and unlocking this record is not yet available.

Information Protection

• Sensitivity labels: Available for Copilot Pages. Copilot Notebooks don't have container sensitivity labels because they share a container with all Copilot Pages.
• Data Loss Prevention (DLP): Rules enforced with end-user policy tip support.

Related articles

• Requirements
• Storage
• Permissions
• Admin policies
• Managing SharePoint Embedded containers
• Purview management