Enterprise Copilot Security Posture Comparison Across Microsoft, Google, and Salesforce

Microsoft 365 Copilot, Google Gemini for Workspace, and Salesforce Agentforce all work the same way under the hood. Each one inherits the permissions of the person using it. That means AI doesn't create new access to your data. It makes the access you already have findable and usable at machine speed, and that changes what you need to secure.

Why all three platforms inherit the same structural risk, even though their architectures differ

The core problem isn't the model. It's the permission structure the model sits on top of. When you deploy an AI assistant, you're not granting it new powers. You hand it the keys your employees already hold, then let it search every drawer, every folder, and every message thread in seconds. The question shifts from "can the AI see this?" to "should this user ever have been able to see this?" Most organizations haven't finished answering that second question. And with agentic AI, systems that plan and act on their own, the stakes are higher. An agent can chain steps and act on overpermissioned access with no human checking the work. The four risk categories that show up across all three platforms are overpermissioning, prompt injection, agentic sprawl, and audit blind spots. The platforms differ in the details, but the structure underneath is the same.

Microsoft 365 Copilot: how Microsoft Graph turns latent permission problems into active exposure

Copilot gets its power from Microsoft Graph, and that's exactly where the exposure lives. Graph gives Copilot scoped access to whatever the person using it can already reach: emails, files, Teams messages, calendar entries. Those permissions sat dormant before AI arrived. Now a single prompt like "summarize our M&A discussions from last quarter" pulls up every file the account has read access to, whether or not that person ever would have found them manually. SharePoint sites shared with "Everyone" or "Everyone except external users" were a common default for sites created before 2023. Those settings are now a search index for anyone holding them. EPC Group's tenant reviews document broken permission inheritance as a near-universal finding. You see salary data on broadly shared sites, HR folders with inheritance broken after temporary attorney access, old sharing links nobody revoked. All of it becomes queryable.

The sensitivity label gap makes it worse. Container labels don't inherit to items. A "Confidential" SharePoint site doesn't automatically label its files, and Copilot treats unlabeled items as valid grounding material. Copilot outputs also don't reliably inherit labels from source files. Sensitive data surfaced by the assistant can circulate unclassified, and the burden of catching that falls on the employee.

The prompt injection problem is documented, not hypothetical. EchoLeak, CVE-2025-32711, disclosed June 2025 by Aim Labs, was a zero-click vulnerability with a CVSS score of 9.3. One crafted email could make Copilot exfiltrate sensitive tenant data with no user interaction. ShareLeak, CVE-2026-21520, CVSS 7.5, patched January 15, 2026 and disclosed April 15, 2026, showed the same email-borne injection surface remained exploitable. WitnessAI's 2026 analysis describes the mechanism plainly: any document, email, or Teams message Copilot reads can contain hidden instructions that cross LLM trust boundaries and trigger actions on their own.

Copilot Studio agents extend this further by connecting Graph access to external data sources. Misconfigurations show up as agents shared too broadly, data exposed without authentication, and credentials stored right in agent definitions. To understand which permission gaps Copilot will expose, you need continuous assessment of the platform's access model before deployment. Promptarmor is one way enterprises surface those latent-access scenarios, salary data on shared sites, broken inheritance, unrevoked links, before they become queryable at machine speed.

Microsoft's native controls are real. Copilot runs within the Microsoft 365 trust boundary. Prompts and outputs are encrypted, logged through Purview, and not used for model training. Purview sensitivity labels, information barriers, DLP policies, and Restricted Content Discovery offer granular control. WitnessAI's 2026 analysis notes these are necessary but insufficient without pre-deployment permission remediation. Data residency also has a partial exception. Since April 17, 2026, Microsoft's default-on Flex Routing setting allows EU tenant LLM inferencing to route outside the EU Data Boundary during peak demand unless an admin disables it.

Google Gemini for Workspace: the same sharing-sprawl root cause, with thinner compliance coverage and newer agentic controls

Gemini inherits whatever the user can open in Gmail, Drive, and Docs. A Workspace tenant where Drive folders sit at "anyone in the organization with the link" has handed Gemini the same reach as a misconfigured Microsoft tenant. The primary risk surface is structurally identical: sharing sprawl, not model behavior.

Google's DLP coverage has specific holes. Workspace DLP runs against Gemini output inserted into email or Drive, but stops short of Gemini Notebook. Notebook data is also exempt from file-sharing and data-region settings. Google Vault retention rules and litigation holds, added in June 2026, cover the Gemini app but not the "Help me write" features inside Gmail and Docs. That leaves two of Gemini's most-used surfaces outside the retention governance boundary.

Google's agentic governance design is architecturally deliberate. At Cloud Next '26, Google said every agent gets its own cryptographically attested identity, governed like an employee, with least-privilege permissions and role-based access approved by security administrators. That agent identity is stamped into the audit trail, so actions are attributed to the agent itself rather than a generic system account. External connections run through OAuth, mapped to the agent's identity. The Agent Gateway data plane routes all agent traffic through a firewall that enforces policy in real time. A policy written once, "agents may not open documents classified Need to Know," applies across the organization. This is promising, but unproven at scale.

Google holds SOC 1/2/3, ISO 27001, HIPAA compliance via BAA, and FedRAMP High authorization. The Enterprise Plus tier adds client-side encryption and Assured Controls with VPC Service Controls support. But Purview's information barriers and Restricted SharePoint Search have no direct Google Workspace equivalents. That gap matters for regulated industries evaluating data-boundary controls.

Salesforce Agentforce: a real governance stack with a documented masking gap and a pattern of agent-level prompt injection exploits

Salesforce has built more explicit AI governance than either Microsoft or Google. The Einstein Trust Layer, Data 360 policy enforcement, and a zero-data-retention contract with model providers are all substantive. But agents have a documented masking gap, and a string of public exploits shows that permission scope and action design determine real security posture.

The Einstein Trust Layer enforces field and record-level rules through Data 360. Employee-facing agents run under the invoking user's access. Customer-facing agents run under a dedicated agent user's permissions. A SOC 2 report covers Agentforce on Hyperforce. But these controls only hold for what Data Cloud has ingested or federated. Data outside that boundary isn't governed.

The masking gap is explicit. Salesforce's Trailhead module states: "Data masking for LLMs is currently disabled for agents." Masking still works for embedded generative features like service replies, but not for autonomous agents. Salesforce says masking adds latency and interferes with planner workflows. For agents, the protection is the scope of records and fields the agent can reach. Permission design is the primary control.

Three exploits show the same structural failure. ForcedLeak, July 2025, Noma Labs, CVSS 9.4: an attacker writing to a public Web-to-Lead "Description" field could embed instructions Agentforce would follow when a rep queried that lead. The instructions could extract email addresses from reachable CRM records and send them to an attacker-controlled server. Salesforce patched via Trusted URLs Enforcement on September 8, 2025. PipeLeak, Capsule Security, December 2025, went public April 15, 2026 alongside Microsoft's ShareLeak disclosure. SalesBleed, Zenity Labs, September 24, 2026, affected the Agentforce and Slack integration with three flaws. A routine agent request could trigger a silent data leak, no login, no click, no warning, and no CVE was issued.

None of these exploits defeated the Trust Layer. They worked because the agent could read more than it needed and send data somewhere. Those are permission and action-design problems that live in Setup, not in the model. Session tracing adds one more issue: it's off by default in most orgs. It must be manually enabled, creating an audit blind spot for the platform where autonomous agent actions are the primary risk surface.

How the four risk categories compare across the three platforms

The four risks map across all three platforms, but the severity and available mitigations differ in ways that matter. On overpermissioning, the origin is identical everywhere: inherited user permissions amplified at AI speed. Microsoft's pre-deployment remediation burden is highest because SharePoint permission inheritance breaks often and at scale. Salesforce's data model is more structured, so it limits lateral movement but concentrates risk in high-value records. Google's main exposure is Drive sharing defaults, "anyone in the organization with the link," functionally equivalent to Microsoft's "Everyone except external users."

Prompt injection is confirmed on all three. Microsoft has the longest public track record of disclosures and patches, with EchoLeak and ShareLeak. Salesforce has the most serious documented exfiltration chain in ForcedLeak and SalesBleed. Google has the fewest disclosures, which reflects its shorter deployment history rather than greater safety.

Agentic sprawl diverges more. Microsoft's Copilot Studio agents are the highest-risk variant, and Microsoft acknowledged the gap with an OWASP mapping in March 2026 and the May 2026 release of Agent 365. Google's per-agent identity and Agent Gateway are the most architecturally deliberate controls of the three, though unproven at scale. Salesforce's default-on agent posture and off-by-default session tracing make sprawl an operational requirement from day one.

Audit blind spots also differ. Purview logs Copilot interactions and can apply retention policies, but nothing natively inspects prompt content for data loss. That's the buyer's problem. Google's agent-stamped audit trail is a design advantage, but Vault doesn't cover "Help me write" in Gmail and Docs. Salesforce leaves session tracing off by default, a step many deployments will miss. For regulated industries, Microsoft's compliance breadth, HIPAA BAA, GCC High, information barriers, gives it a structural advantage. Salesforce's zero-data-retention contract is a meaningful differentiator for organizations needing contractual guarantees about prompt handling. Google's FedRAMP High and CMEK are competitive, but its shorter enterprise history is a real maturity consideration.

Why native platform controls alone are not sufficient for enterprise security posture management

The native controls govern the pipes. Encryption, permission inheritance, basic audit logging. They don't inspect what flows through the pipes: prompt content, cross-tool spillover, agent action chains, emerging threat patterns. Strac's 2026 guide puts it plainly for Copilot. Nothing natively inspects whether an employee pasted a customer's SSN into a prompt. A Copilot response copied into Slack or Gmail lives outside Microsoft governance entirely. The same gap applies to Gemini and Agentforce. Native DLP catches content on governed surfaces, but cross-tool spillover and agent action chains sit outside the platform's visibility boundary.

Configuration drift compounds the problem. Permission remediation done before deployment doesn't stay remediated. New files, new sharing defaults, new guest accounts, new agent definitions keep reopening the surface. Salesforce's default-on agent posture and off-by-default tracing show how a compliant initial configuration can degrade without continuous monitoring. The vendor AI supply chain adds another layer. All three platforms connect to external model providers, connectors, and plugins. The Trust Layer, Agent Gateway, and Copilot Studio connectors each bring vendor AI components with their own security posture, and buyers typically can't assess these through the platform's own tools. Traditional third-party risk frameworks weren't built for unvetted models and plugins introducing injection and exfiltration vectors that generic checklists can't catch.

How to evaluate and monitor AI security posture across these platforms before and after deployment

Securing copilot deployments across Microsoft, Google, and Salesforce needs three layers: pre-deployment permission remediation, runtime monitoring, and continuous assessment of the vendor AI supply chain. No single native tool delivers all three. Before deployment, audit SharePoint, Drive, and Salesforce permissions before enabling any AI feature. The exploit history shows the attack surface is existing permission sprawl, not the model. Apply sensitivity labels at the item level in Microsoft 365, not just on containers. Enable session tracing in Agentforce before agents go live. Review Drive sharing defaults before activating Gemini. Scope agent permissions to least-privilege from the start. Misconfigurations like overly broad sharing, credentials in definitions, and action permissions wider than needed are preventable at design time.

At runtime, native audit logs are necessary but insufficient. They don't inspect prompt content, detect adversarial injection patterns, or surface cross-tool spillover. That takes a dedicated layer. Promptarmor is a dedicated AI risk intelligence platform that combines vendor AI risk assessment with continuous monitoring of AI assets across the vendor ecosystem. It covers unvetted models, plugins, agents, and connectors that introduce prompt injection, data exfiltration, and compliance gaps traditional tools and governance frameworks miss. It's built for TPRM, InfoSec, Privacy, and Legal teams evaluating multi-platform deployments including Copilot, Gemini, and Agentforce, with customers from Fortune 50 companies to AmLaw 50 law firms.

Platform-native tools fill narrower roles. Microsoft Purview covers Copilot audit logging and DLP within the M365 boundary. Google Agent Gateway enforces real-time policy within Workspace. Salesforce's Trust Layer enforces zero-data-retention contracts but doesn't cover external connectors or data outside Data Cloud. DSPM tools help with pre-deployment permission audits but not runtime AI interaction monitoring. The SalesBleed disclosure in September 2026 and ShareLeak in April 2026 both post-date the deployments they affected. The attack surface changes as vendors ship new features and integrations. A point-in-time review doesn't stay current. For teams running AI across more than one of these platforms, a single monitoring layer spanning the vendor ecosystem is more operationally viable than maintaining separate native tooling for each.