Copilot Access to External Resources (XPIA)

Benjamin Zulliger@benscha

•updated Feb 26, 2026•12•0•152

This rule detects instances where Microsoft Copilot accesses external resources, specifically identifying events where 'XPIADetected' is true. This indicates Copilot interacting with resources outside its immediate environment, which could be a security concern if the accessed resources are sensitive or untrusted.