Copilot in Teams chats only sees the history a user can already access

In many of the tenants I work with, Copilot in Teams chats is the first Copilot feature to go live beyond Word or Outlook. The question I hear most from admins and compliance teams is what Copilot actually sees in chat and channel conversations, and what it ignores. The short answer is that Copilot only sees what the user sees. The details matter more than most people expect, though, especially once guests, external users and retention come into play.

Copilot reads only the chat history a user can currently access

When a user asks Copilot in Teams to summarise a chat or channel, Copilot draws only on the message history that the user can currently access. If a user or guest is added to a chat or channel, Copilot only sees messages from that point on. External participants are treated exactly the same way, so there are no "Copilot superpowers". Copilot's access model mirrors Teams' own permissions completely. The diagram below shows the pattern:

flowchart TD
  User["User"] --> History["Teams chat history (since join)"]
  Guest["Guest"] --> History
  Copilot["Copilot in Teams"] --> History
  History --> External["External participants"]

Figure: Copilot only sees the chat history the user can access, and that includes guests and externals.

This matters a lot in shared channels, where Copilot's summaries reflect the specific access the user has through their tenant and role. If you switch tenants or work with multiple identities, you'll notice quickly that Copilot's output changes with each context. Governance settings have a real effect on what Copilot in Teams chats produces.

Retention policies decide what Copilot can still reference in Teams

Retention gets complicated quickly. Teams chat messages follow the retention policies configured in Microsoft Purview (Teams retention policy docs). Copilot only works with messages that are still in the chat, so anything deleted or expired is gone for Copilot as well. Strict retention or early deletion therefore limits right away how far back Copilot can reference older conversations.

Since last year you can also set retention for Copilot interactions themselves in Purview (my article on Copilot audit and retention). This controls how long prompts and Copilot responses stay in the audit logs, which is a real concern for compliance teams that need to trace AI usage or investigate incidents.

Practical tip: Check regularly that your Teams chats and channels are covered by the right retention policies, and that Purview keeps Copilot audit data for as long as your compliance requirements demand.

Guests and shared channels need extra care in governance

Organisations with a lot of guest access or cross-tenant collaboration often find it hard to keep track of what Copilot can see. The rule stays the same. Guests and shared channel members only get Copilot summaries of content they can already access in Teams. In shared channels, visibility can differ by tenant and by channel. Copilot never gets extra history, so a guest who joins late won't see older messages through Copilot either. As a result, Copilot's output can differ dramatically between users with different access, and shared channels with many externals make governance tricky.

Copilot treats meetings and chats as two separately governed models

Copilot in Teams meetings is easy to mix up with Copilot in chats and channels, but the two are governed separately. In meetings, Copilot relies on the meeting transcript, provided transcription is enabled. It can only summarise what's in that transcript, not the meeting chat. That makes retention policies for transcripts critical, because once a transcript is deleted or expires, Copilot loses its source. I cover meeting transcripts in more detail in Copilot in Teams meetings: Transcript required, or not?.

Microsoft Purview makes Copilot interactions available for eDiscovery

One thing that often gets overlooked is that prompts to Copilot and its responses can be retained and discovered through Microsoft Purview, depending on your audit log setup and retention. If you need to investigate what Copilot did or reproduce an answer, you'll find the traces in the Purview portal (this requires compliance roles and a proper audit configuration). You should define a specific retention policy for these Copilot events and weigh compliance needs against privacy expectations.

Governance with Copilot still does not run on autopilot

In practice, Copilot in Teams chats doesn't make governance harder, but it does force us to get the basics right. If your Teams retention and access controls are well managed, Copilot won't cause surprises. In my experience the real headaches come from inconsistent guest access, badly managed shared channels and unclear retention settings. For the full privacy and security picture, Microsoft's Copilot privacy and security docs are always worth reading.