The article discusses the risks associated with Microsoft 365 Copilot, a tool that can access and synthesize content across an organization. The risks are categorized into two layers: Layer 1, which covers risks associated with people who can access Microsoft 365 Copilot, and Layer 2, which covers risks associated with data that Microsoft 365 Copilot can access. The article highlights 13 risks, including overshared SharePoint and OneDrive content, sensitivity label gaps, excessive user permissions, and no DLP coverage on Copilot-generated outputs. To mitigate these risks, organizations can use Microsoft controls such as Microsoft Purview, SharePoint Advanced Management, Microsoft Entra ID Governance, and Microsoft Sentinel. The article provides step-by-step guidance on how to address each risk, including configuring and scoping controls deliberately before Copilot scales across the organization. It also emphasizes the importance of continuous monitoring and review of Copilot activity to detect and respond to potential security incidents. The article notes that mitigation requires a combination of technical controls, process changes, and user education to ensure that Microsoft 365 Copilot is used securely and effectively. By following the recommended mitigations, organizations can reduce the risks associated with Microsoft 365 Copilot and ensure that the tool is used in a way that supports their security and compliance goals. Overall, the article provides a comprehensive guide to understanding and mitigating the risks associated with Microsoft 365 Copilot, and is a valuable resource for organizations that are considering or have already deployed the tool.