The arrival of Copilot in the Microsoft ecosystem has changed how we locate knowledge and act on it. The key is combining lexical and semantic search with the context of Microsoft Graph , so that each query returns more relevant, explainable, and secure results within your organization.
If you're interested in maximizing this capability, it's essential to understand how the semantic index is built, how information flows between Copilot, Graph, and apps, and what limitations, security, and governance apply. You'll also learn when to use Copilot's Search API and how to prepare semantic models in Power BI so that AI performs optimally in natural language queries, DAX metric generation, and content discovery.
What is the lexical and semantic index in Copilot?
Microsoft 365 Copilot builds and maintains a hybrid index that combines lexical and semantic signals from tenant data. This index is fed by Microsoft Graph and understands relationships, context, and social signals (collaboration, proximity, permissions) to personalize relevance for each user.
At the semantic level, vectors are used —numerical representations of text or other attributes—located in multidimensional spaces where similar elements are grouped together. This allows for the retrieval of related content even without exact word matches , capturing inflected forms, synonyms, and even the intended meaning of a phrase.
Semantic indexing coexists with traditional search: queries are made using keywords and, in addition, semantic similarity . Copilot combines both approaches in practice to anchor language model responses with real tenant data.
The entire process is designed with security, compliance, and privacy in mind. Responses only include content you already have access to , using the same permissions model as Microsoft 365, and organizational and geographic boundaries are respected according to tenant settings.
How information flows between Copilot, Graph and the apps
When you make a request from a Microsoft 365 app, Copilot receives the query, accesses Graph and the semantic index , and enriches the prompt it sends to the LLM. After receiving the model's initial response, it cross-references it with Graph/index to incorporate recent data and application commands before displaying the result.
This cycle includes encryption in transit (HTTPS) and encrypted data at rest. Neither the queries nor the content used to support responses are used to train the base LLMs , thus reinforcing corporate privacy and regulatory compliance (GDPR, EU Data Boundary, etc.).
Currently, indexes are generated at the tenant and user levels. The tenant index covers textual content from SharePoint Online and will be expanded; the user index adds signals from their "work environment" (e.g., emails and documents they mention or comment on), always respecting permissions.
The creation and updating of these indexes is automatic: no administrative intervention is required to enable them . SharePoint collaborative content for multiple users is reindexed daily; changes to already indexed documents are reflected almost instantly.
Supported content types and update frequency
Semantic understanding is applied to multiple Microsoft 365 sources. At the user level, these include personal mailboxes and OneDrive/SharePoint files (Word, PowerPoint, PDF, ASPX pages, OneNote). At the tenant level, these include text-based documents (Word, PPT, PDF, ASPX, OneNote) and data from Graph connectors.
There are some important exclusions: delegated or shared mailboxes are not supported in the user index , and content archived in mailboxes or SharePoint is not processed. At both levels, final visibility depends on each person's actual permissions.
Regarding data freshness, an initial indexing of the data is performed first. From then on, new documents from collaborative sites are added daily, and updates to already indexed items are reflected immediately , so that responses are based on recent versions.
Semantic analysis is not "all or nothing": Copilot combines lexical signals (keywords) with vectorial similarity to classify results and anchor responses with citations to documents, emails, or pages that support the final proposition.
Administration, exclusions, and discovery settings
Semantic indexing is automatically enabled and cannot be disabled as a Microsoft Search enhancement . However, there are several ways to prepare your environment: reviewing SharePoint collaboration settings, the permissions model, or applying DLP with Microsoft Purview to exclude sensitive data.
If your organization doesn't use DLP and you need to exclude a specific site from SharePoint Online, or review how to manage SharePoint Online with Copilot , you can mark it so it doesn't appear in search results (Site settings > Search and offline availability > "No" under "Allow this site to appear..."). You can also automate this process with PowerShell for multiple sites.
In the Microsoft 365 admin center, "item conclusions" and "people conclusions" are enabled by default . Disabling them will cause you to lose personalization and signals that improve relevance (for example, relevant colleagues derived from distribution or org chart).
Remember that the Microsoft 365 permissions model is the foundation: Copilot never exposes content without authorization . If there is overexposure due to broad links (“anyone in my organization”), review the sharing governance and consider using Advanced Management for SharePoint to audit and remediate access.
Connectors, privacy, storage, and BYOK encryption
Copilot connectors allow you to incorporate external content into Microsoft Graph while preserving permissions . Ideally, this data should be text-rich to maximize semantic effectiveness; it can reside on-premises or in public/private clouds.
Regarding privacy and compliance, Copilot respects GDPR and geographical boundaries . The user index is hosted where their mailbox is located; the tenant index is stored in an isolated container within the SharePoint site's region. For EU Data Boundary, the index resides in EU/EFTA data centers.
For customers with a Bring Your Own Key (BYOK) option, Copilot supports encryption with custom keys , and semantic indexing is automatically enabled without any extra steps. In all cases, the data used to inform responses does not train the underlying models.
If you need additional layers, use Purview Information Protection, sensitivity labels, and data retention or minimization policies . Reducing unnecessary content improves both security and search accuracy.
Copilot's Search API: When to use it and how to get the most out of it
Copilot's Search API provides hybrid (semantic + lexical) search on OneDrive for work or school with natural language queries. It's ideal for custom apps that want to discover documents without replicating or managing indexes outside of Microsoft 365.
In terms of security and compliance, the API looks "on-site," preserving permissions and governance . If a user cannot view a document in M365, they will not obtain it via the API either, preventing data breaches and simplifying compliance.
Licensing: It's available at no additional cost to users with the Microsoft 365 Copilot license add-on . Currently, it doesn't support users without this add-on, and the supported data source is OneDrive for work or school.
- Best Practices: provides context in the consultation, avoids overly generic questions and uses clear natural language.
- Filtered outWhen using `filterExpression` with `path`, specify the full OneDrive path (not a share link).
Relevant current restrictions: query up to 1500 characters , maximum pageSize 100, up to 200 requests per user/hour, limited support for path expressions in the filter, and no semantic search on non-textual content (tables, images, graphs).
- Size limits: semantics in .docx/.pptx/.pdf up to 512 MB; in other extensions, up to 150 MB.
- File Types with semantics: aspx, docx, pptx, pdf, onepart, doc, html, eml, mp4, loop, one, fluid, png, jpg, json, csv, xml, ppt.
Copilot Search vs. Copilot Chat and vs. Microsoft Search
The “Copilot Search” appears as a universal search module within the Microsoft 365 Copilot app , designed to quickly find what you need, with contextual, semantic, and personalized results.
Copilot Chat, on the other hand, is conversational and serves for deeper reasoning, content creation, and task execution. Copilot Search is optimized for speed and discovery; chat, for elaboration and action.
What about traditional Microsoft Search? Copilot Search offers a modern, semantic experience across M365 and third-party sources (via connectors), with direct chat integration and enhanced personalization. Microsoft Search focuses on classic keywords and verticals.
Access and eligibility: If you have a valid Microsoft 365 Copilot license , you'll see Copilot Search on web, desktop, and mobile without any setup. Security and privacy are the same as in Copilot: no content is exposed without permission.
Copilot for content discovery in Power BI
In Copilot's standalone experience, Power BI allows you to search reports, semantic models, apps, and data agents . The search leverages metadata (title, description, workspace) and content within the elements (page names, visual titles, text boxes, etc.).
To categorize content, Copilot leverages signals such as favorites, recent opening, popularity and approval , or app membership. It also generates an automatic description if the author hasn't defined one.
You can better guide discovery by adding clear descriptions, unique keywords, and approval tags . Favoring an item is an explicit signal of importance and helps it appear higher in search results.
Limitations: Copilot respects app audiences and hidden fields/elements, does not suggest semantic models marked as unrecognizable without direct access, and some scenarios (access via M365 groups) will be covered in future versions. Direct changes to elements are usually reflected in ~5 minutes; indirect changes (such as renaming the workspace) can take up to 24 hours.
AI-ready semantic models in Power BI: development and consumption
For Copilot to "understand" your Power BI data, the semantic model must be well designed : clear names, correct relationships, standardized measures, useful hierarchies, and synonyms aligned with the language of the business.
Asking questions about the data from Copilot helps with exploration and validation. However, the chat responses are static and don't replace a good report with visuals that update with each model change. Use it to verify how well Copilot interprets entities and measures.
In the DAX query view, Copilot can suggest queries , generate ascending measures from a query, and explain DAX concepts. It's especially useful for learning patterns, refactoring, and documenting with comments, although it's advisable to validate your code and be careful with variable usage.
Linguistic modeling (synonyms and semantic relationships) is crucial. You can use Copilot to suggest synonyms and refine them later, sharing the valid ones across the organization. Generating measure descriptions is also helpful for improving documentation and understanding.
Preparing data for AI in Power BI: AI schema, tested answers, and instructions
From Power BI Desktop, the recommended workflow for preparing the model includes several steps. First, simplify the data schema : hide technical or redundant fields, avoid duplicate names between tables, and minimize unused objects that add clutter.
Next, set up verified answers : phrases or frequently asked questions that you map to a visual or an "official" definition. When someone asks something that matches those phrases, Copilot will respond consistently and in an approved manner, avoiding ambiguity.
The third pillar is AI instructions , short texts that guide Copilot on priorities, internal definitions, and domain nuances. For example, what “active customer” means, which metrics to prioritize over leadership, or equivalencies between terms (“opportunities,” “leads,” “deals”).
Before sharing, thoroughly test with Copilot: ask typical questions, verify that you're using the correct fields in the simplified schema, and adjust instructions and verified answers based on your observations. Publish the report and add descriptions to both the report and the model to enhance discovery.
Finally, mark the model as AI-ready in a compatible (Fabric/Premium) workspace. This optimizes the Copilot (“Chat with your data”) experience, improves natural language interpretation, and facilitates the automatic generation of visuals and metrics.
Government and security applied to semantic search
Although semantic indexing doesn't alter permissions, data governance remains crucial . Minimize outdated data, apply sensitivity labels, use DLP to temporarily restrict access, and review sharing practices to prevent overexposure.
Organizations with advanced needs can rely on Microsoft Purview for data retention, classification, and loss prevention, and on Advanced Management for SharePoint to audit and correct legacy or over-open permissions.
If you work with geographical boundaries or European requirements, you can rely on the EU Data Boundary for index storage and processing, and on BYOK for encryption with your own key. Copilot's promise is clear: responses are "grounded" with content you already have the right to access.
Practical recommendations for mastering semantic search
Think in natural language but with a clear intention: provide sufficient context in your query and avoid overly generic terms. This helps semantic reranking choose the best subset of content.
In Power BI, invest in the model: name things well, define standard measures, create hierarchies, and document everything . This significantly improves the quality of Copilot's responses and reduces the number of inquiries to the technical team.
For custom apps, consider Copilot's Search API: it offers on-site semantics with preserved security and governance . Review limits (file size, types, per-user quota) and filter by full OneDrive paths for accuracy.
Finally, consolidate governance: retain what's necessary, label what's sensitive, and share only what's essential . Semantic search works best in organized environments with clean schemas.
With all of the above, semantic search with Copilot becomes a reliable “shortcut” to corporate knowledge: an engine that understands intent, respects permissions and delivers answers with real documents , and which, in combination with Power BI and its AI-ready preparation, allows you to ask, explore and decide with less friction and more confidence.
