From the Microsoft edition of November 10, 2026
City of Portland's Microsoft 365 Copilot privacy impact assessment (48 risks, police excluded) reaches its stated validity end on Nov. 10, 2026
City of Portland, Oregon (Smart City PDX privacy program; Bureau of Technology Services) · Local government (city operations) · Oregon, United States
- Publisher
- City of Portland eFiles
- Original publication
- 2025-12-17 (release); final edit 2025-11-10; valid until 2026-11-10
- Source retrieved
- 2026-11-11
- Event date
- 2026-11-10
What happened
Portland's 79-page privacy impact and risk analysis of Microsoft 365 Copilot for city staff identified 48 risks across six areas; the worst case after mitigation was weighted Medium-high. It excludes Portland Police Bureau use. Highlighted risks include unintentional sharing of sensitive data in prompts (Medium), oversurveillance of staff through productivity data (Medium-high) and aggregation of information about individuals. It says Copilot outputs and interaction logs can become public records subject to disclosure. Copilot Chat initially had no Microsoft Graph access, though the assessment covers Graph-integrated risks. BTS adopted Copilot as Standard Technology, was approving a use policy and required training. The document states it is valid until Nov. 10, 2026.
Why it matters
Why now: the assessment's stated validity ends on this edition date, and no renewed assessment was found in search. U.S. cities and counties can use it as a model risk register for Copilot and as a reminder that privacy reviews expire while licensing and features (Graph grounding, agents) keep expanding.
Evidence and measured results
Government-authored privacy risk analysis using the Smart City PDX impact-likelihood matrix; qualitative ratings, no usage data, incident counts or outcome measures.
Limitations and uncertainty
Released December 2025, so it predates recent Copilot changes (Copilot Chat fair-use limits, agents, new models). Ratings are expert judgments, not measured incidents. Whether Portland has renewed or extended it is unknown; absence of a renewal in search results is not proof none exists.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-11-11; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- Local governments deploy Copilot under privacy reviews that age quickly as Microsoft adds Graph grounding, agents and usage limits.
- Stakeholders
- City privacy officer
- CIO / IT director
- City attorney and records manager
- HR and labor relations
- Police IT (separate scope)
- Discovery questions
- When was your Copilot privacy or risk assessment completed, and when does it expire?
- Does it cover Graph-grounded Copilot and agents?
- How are Copilot prompts and outputs handled under public-records law?
- Is public-safety use scoped separately?
- Value hypothesis
- A refreshed risk register aligned to current features can reduce records and privacy surprises as Copilot scope expands.
- Potential engagement
- A Copilot privacy reassessment using a 48-risk register modeled on Portland's, scoped to current features.
- Unsupported claims
- That Copilot is safe or unsafe for city use
- Incident rates or measured harms
- Productivity benefits
- That Portland has not renewed the assessment
Pre-sales engineering
Role takeaway
- Fit
- City and county Microsoft 365 tenants with Copilot Chat or Microsoft 365 Copilot enabled for staff.
- Architecture and integration
- Copilot orchestrates LLMs, Microsoft Graph content and Microsoft 365 apps; agents are managed as integrated apps in the admin center.
- Prerequisites
- Permission and oversharing review
- Purview retention policies for Copilot interactions
- Documented feature on/off settings
- Constraints
- Public-records disclosure obligations
- Police and CJIS use scoped out
- Assessment predates late-2026 Copilot changes
- Security
- Prompts can contain sensitive data; eDiscovery and overshared files can expose other users' information; supervisor access creates surveillance risk.
- Proof of value
- Verify Graph-grounded responses respect sensitivity labels
- Test retrieval of Copilot logs for a mock records request
- Confirm agent inventory against approved list
Delivery
Role takeaway
- Work
- Schedule and run a reassessment tied to feature changes, with mitigation owners for each risk and records guidance for staff.
- Dependencies
- Privacy program capacity
- Current Copilot feature configuration
- Records retention schedule for AI interactions
- Ownership
- City privacy program with the Bureau of Technology Services as system owner.
- Skills and adoption
- Mandatory Copilot training extended with records and privacy modules.
- Governance checkpoints
- Reassessment before validity end
- Re-review when Graph or agents are enabled
- Separate review before any police use
- Acceptance criteria
- Each identified risk has a named mitigation owner and status
- Records-request test completed within a defined turnaround
- Reassessment published before the next validity date
- Risks
- Assessment lapses unnoticed
- Feature changes outpace review
- Public-records exposure of prompts
- Staff oversurveillance concerns
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Risk profile changes when Copilot Chat moves from web-only grounding to Microsoft Graph access across mail, chats and files; agents managed as integrated apps add further scope.
Governance
Who approves, reviews and stays accountable for outcomes?
Shows a city privacy program rating Copilot risks, scoping out police use, and setting a fixed validity period, which creates a re-assessment checkpoint as features change.
Security and privacy
What data, permissions and controls need testing?
Prompts, outputs and logs can become public records; eDiscovery and overshared documents can expose other users' information; supervisor access to staff data raises oversurveillance risk.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Identifies workforce risks including oversurveillance and roles affected by Copilot, with mitigation that may involve unions; mandatory training required.
Procurement
What should contracts, pricing and exit terms secure?
Copilot provided within the city's existing Microsoft licensing bundle; Graph access requires an add-on, affecting cost and risk scope.
Operating model
Which teams own the service once it runs?
Central IT (BTS) administers Copilot; a separate privacy program assesses it with a fixed validity period.
Publication history
- 2026-11-10Microsoft · Issue 124 resources
Stable resource ID: portland-m365-copilot-privacy-impact-assessment-48-risks-validity-ends-20261110