Protect organization data by preventing users from accessing Microsoft CoPilot without commercial data protection

In this example, a custom SaaS application is created with a custom user action. When a user, who has an Entra-ID account with commercial protection enabled, accesses Microsoft CoPilot, they can successfully navigate through CoPilot. See Commercial data protection explained for more information.

On the other hand, if a user attempts to access Microsoft CoPilot with an Entra-ID account that does not have commercial protection enabled or without logging in, they will find that CoPilot is unavailable. This is because the absence of commercial protection leaves the user’s data vulnerable, and as a safety measure, FortiOS can restrict access to CoPilot in such cases. This ensures that the user’s data remains protected at all times.

Microsoft’s Header solution, which provides a list of domains and header name-value pair, is one of the strategies designed to prevent the unauthorized use of Copilot without commercial data protection. See Require commercial data protection in Copilot for more information. FortiOS will utilize this domain list and header information during the configuration of the inline CASB profile.

To configure a customized inline CASB profile in the GUI:

1. Configure the inline CASB profile:

   1. Go to Security Profiles > Inline-CASB.

   2. Click Create new.

   3. Enter a Name, such as Microsoft-Copilot.

   4. In the SaaS Applications table, click Create new. The Create SaaS Application Rules pane opens.

   5. In the Application dropdown, click Create to create a custom entry. The Create Inline-CASB SaaS Application pane opens.

   6. Enter the Name as Copilot-services.

   7. Enter the Domains as bing.com, edgeservices.bing.com, and copilot.microsoft.com.

   8. Click OK. A confirmation dialog is displayed.

   9. Click OK and click Next.

   10. Configure the custom control and action:

       1. In the Custom Controls table, click Create new. The Create Custom Control pane opens.

       2. Enter a Name, such as Entra-ID.

       3. In the Application-Defined Controls table, click Create new. The Create Custom Control Action pane opens.

       4. Enter a Name, such as Entra.

       5. Set the Control Type to Manipulate HTTP headers.

       6. Set the Action to Create header.

       7. Set the Header name to x-ms-entraonly-copilot.

       8. Set the Header value to 1.

       9. Click OK to save the custom action.

       10. Click OK to save the custom control.

   11. Click OK to save the application rule.

   12. Click OK to save the inline CASB profile.

2. Use the CLI to remove the empty match entry:

   This step is only necessary when configuring the CASB profile in the GUI.

   config casb user-activity
       edit "Copilot-services-Entra-ID"
           config match
               delete 1
           end
       next
   end

3. Configure the firewall policy:

   1. Go to Policy & Objects > Firewall Policy.

   2. Edit an existing policy or create a new one.

   3. Set the Inspection Mode to Proxy-based.

   4. In the Security Profiles section, enable Inline-CASB and select the Microsoft-Copilot profile.

   5. Set the SSL Inspection profile to one that uses deep inspection.

   6. Configure the other settings as needed.

   7. Click OK.

To configure a customized inline CASB profile in the CLI:

1. Configure the CASB SaaS application:

   config casb saas-application
       edit "Copilot-services"
           set domains "bing.com" "edgeservices.bing.com" "copilot.microsoft.com"
       next
   end

2. Configure the CASB user activity:

   config casb user-activity
       edit "Copilot-services-Entra-ID"
           set application "Copilot-services"
           set category other
           config control-options
               edit "Entra"
                   config operations
                       edit "Entra"
                           set action new
                           set header-name "x-ms-entraonly-copilot"
                           set values "1"
                       next
                   end
               next
           end
       next
   end

3. Configure the inline CASB profile:

   config casb profile
       edit "Microsoft-Copilot"
           config saas-application
               edit "Copilot-services"
                   config custom-control
                       edit "Copilot-services-Entra-ID"
                           config option
                               edit "Entra"
                               next
                           end
                       next
                   end
               next
           end
       next
   end
   

4. Configure the firewall policy:

   config firewall policy
       edit 1
           set name "CoPilot"
           set srcintf "port2"
           set dstintf "port1"
           set action accept
           set srcaddr "all"
           set dstaddr "all"
           set schedule "always"
           set service "ALL"
           set utm-status enable
           set inspection-mode proxy
           set ssl-ssh-profile "deep-inspection"
           set casb-profile "Microsoft-Copilot"
           set nat enable
       next
   end

To test the configuration:

1. Open an Incognito tab in your browser and navigate to bing.com.

2. The Copilot option is not available because the user is not logged in with an Entra-ID account that has commercial data protection enabled.

   

3. Log in with an Entra-ID account that has commercial data protection enabled and verify that the Copilot option is available.

   

4. To verify if commercial data protection is turned on for your account, open a new tab in your browser and navigate to copilot.microsoft.com. Users should be able to identify a green shield adjacent to their user profile icon, indicating the active status of data protection. See Manage Copilot for more information.

   

Sample log:

1: date=2024-05-08 time=11:52:58 eventtime=1715125978612375798 tz="+1200" logid="2500010002" type="utm" subtype="casb" eventtype="casb" level="information" vd="root" policyid=1 poluuid="8abe7a4e-08ae-51ef-edb0-45c05b514641" policytype="policy" sessionid=123544 srcip=13.13.13.13 dstip=131.253.33.200 srcport=49752 dstport=443 srcintf="port2" srcintfrole="undefined" srcuuid="6e01eac6-a97d-51ed-5220-dac5db63d2ca" dstintf="port1" dstintfrole="wan" dstuuid="6e01eac6-a97d-51ed-5220-dac5db63d2ca" proto=6 url="https://www.bing.com/fd/ls/lsp.aspx" action="monitor" profile="Microsoft-Copilot" saasapp="Copilot-services" useractivity="Copilot-services-Entra-ID" operation="Entra" activitycategory="other" msg="CASB access was monitored because it contained activity."