Glossary

AI governance

AI governance is the set of policies, controls, and oversight practices that keep an organization's use of artificial intelligence safe, compliant, and accountable. In a Microsoft 365 context it covers tools such as Copilot and Copilot Studio: who can use them, what data they may reach, and how usage is monitored. Effective AI governance combines readiness checks, access reviews, and continuous policy monitoring so that innovation does not outpace control or regulatory obligations.

Oversharing

Oversharing is when files, sites, or workspaces are shared more widely than they should be, giving people access to content they do not need. Common causes include broad "everyone" links, inherited permissions, and forgotten guest access. Oversharing is a leading data-security risk in Microsoft 365 and SharePoint, and it becomes more dangerous once Copilot can surface the exposed content instantly to any user who has access to it.

Sensitivity label

A sensitivity label is a tag applied to documents, emails, sites, or containers to classify how confidential their content is and to enforce protection such as encryption, access limits, or watermarks. In Microsoft 365, labels like "Confidential" or "Public" travel with the content wherever it goes. Consistent labeling is a foundation of data protection: it tells people and tools, including Copilot, how each item may be shared, stored, and used across the tenant.

Shadow AI

Shadow AI is the use of artificial intelligence tools, models, or agents without the knowledge or approval of an organization's IT and security teams. It ranges from employees pasting company data into public chatbots to business users building unsanctioned agents in Copilot Studio. Like shadow IT before it, shadow AI creates blind spots: data may leave controlled boundaries, and no policy governs how it is used. Discovering and governing this hidden usage is essential to managing AI risk.

Workspace lifecycle

The workspace lifecycle is the full journey of a collaboration space, such as a Microsoft Teams team, Microsoft 365 group, or SharePoint site, from request and creation through active use to eventual archival or deletion. Managing the lifecycle means applying consistent naming, ownership, and expiry rules so workspaces do not accumulate unchecked. Good lifecycle management prevents sprawl, reduces stale content and orphaned data, and keeps the tenant tidy, secure, and easier to govern over time.