ARGUS

1.0.0

Checks/Copilot/ARG.COP.006.ps1

Register-ArgusCheck @{
    Id          = 'ARG.COP.006'
    Title       = 'Web search in Copilot is a deliberate choice'
    Area        = 'Copilot'
    Category    = 'AI data processing'
    Severity    = 'Low'
    UsesBeta    = $true
    Description = 'Reads the tenant-level "Allow web search in Copilot" Cloud Policy setting (`GET /beta/copilot/admin/policySettings/microsoft.copilot.allowwebsearch`, delegated sign-in only). When the policy is not configured, web search is available in Copilot and Copilot Chat (unless optional connected experiences are disabled): To review. The meaning of each configured value is not documented, so a configured value is To review unless it is listed in the `DisabledValues` parameter after you verified it in the Cloud Policy service. A group-scoped policy cannot be read by this API and is also To review.'
    Rationale   = 'With web search on, Copilot sends search queries derived from prompts (and sometimes from open documents) to Bing. Microsoft acts as data controller for those queries: the DPA, HIPAA and the EU Data Boundary do not apply to them. Whether that is acceptable is a privacy decision the organisation should take explicitly.'
    Remediation = @{
        Steps      = "1. In the Microsoft 365 Apps admin center (config.office.com), open Customization > Policy Management.`n2. Create or edit a policy with Allow web search in Copilot and choose Enabled, Disabled, or Disabled in Work mode only, according to the organisation's privacy decision.`n3. Record the decision; after verifying the value ARGUS shows for the disabled option, add it to the DisabledValues parameter of ARG.COP.006 in the ARGUS configuration."
        PortalUrl  = 'https://config.office.com/officeSettings/officePolicies'
    }
    References  = @(
        @{ Title = 'Data, privacy, and security for web search in Microsoft Copilot'; Url = 'https://learn.microsoft.com/en-us/microsoft-365/copilot/manage-public-web-access' }
        @{ Title = 'Get copilotPolicySetting'; Url = 'https://learn.microsoft.com/en-us/microsoft-365/copilot/extensibility/api/admin-settings/copilotpolicysetting-get' }
    )
    Requires    = @{
        Services    = @('Graph')
        GraphScopes = @('CopilotPolicySettings.Read')
        DataSets    = @('CopilotWebSearchPolicy')
    }
    Parameters  = @{ DisabledValues = @() }
    Tags        = @('Copilot', 'AI', 'GDPR', 'Policy')
    Test        = {
        param($Context)
        $setting = $Context.Data['CopilotWebSearchPolicy']
        $unavailable = Get-ArgusProperty $setting 'ArgusUnavailable'
        if ($unavailable) { return New-ArgusResult -Status Skipped -SkipReason $unavailable }
        if ((Get-ArgusProperty $setting 'GroupScoped' $false) -eq $true) {
            return New-ArgusResult -Status Investigate -Summary 'Allow web search in Copilot is set in a group-scoped policy, which the API cannot read; review the policy in the Cloud Policy service.'
        }
        $value = Get-ArgusProperty $setting 'value'
        $policyId = Get-ArgusProperty $setting 'policyId'
        $finding = [pscustomobject]@{
            Setting  = 'Allow web search in Copilot'
            Value    = if ($null -eq $value) { 'Not configured' } else { [string]$value }
            PolicyId = if ($policyId) { [string]$policyId } else { 'No tenant-level policy' }
        }
        if ($null -eq $value) {
            return New-ArgusResult -Status Investigate -Findings @($finding) -EvaluatedCount 1 `
                -Summary 'Allow web search in Copilot is not configured: web search is available to users and its queries are outside the DPA and the EU Data Boundary.'
        }
        if ([string]$value -in @($Context.Parameters.DisabledValues | ForEach-Object { [string]$_ })) {
            return New-ArgusResult -Status Passed -EvaluatedCount 1 -AffectedCount 0 -Summary "Web search in Copilot is turned off by policy (value $value)."
        }
        New-ArgusResult -Status Investigate -Findings @($finding) -EvaluatedCount 1 `
            -Summary "Allow web search in Copilot is configured with value '$value'; confirm the chosen option in the Cloud Policy service."
    }
}