Microsoft Copilot security directory

Office 365 Users

Published by Microsoft

Medium risk

Office 365 Users Connection provider lets you access user profiles in your organization using your Office 365 account. You can perform various actions such as get your profile, a user's profile, a user's manager or direct reports and also update a user profile.

Security assessment

Plutonium assessed this connector for permissions, capabilities, and security-relevant behavior.

  • Reads your private information: This connector can read data the connected service holds about you - documents, messages, contact lists, source code, customer records, or saved profile details - and pass it back to the AI.
  • Can change or update your information: This connector can edit, rename, overwrite, or otherwise modify records in the connected service. If a request gets manipulated, your data could be altered without you noticing.
  • Can send messages as you: This connector can post messages, emails, or notifications on your behalf. Recipients will believe the message came from you, which makes phishing or social-engineering risks higher.

Available capabilities

This add-on exposes 13 tools or capabilities.

  • Get direct reports (V1) [DEPRECATED]
  • Get direct reports (V2)
  • Get manager (V1) [DEPRECATED]
  • Get manager (V2)
  • Get my profile (V1) [DEPRECATED]
  • Get my profile (V2)
  • Get my trending documents
  • Get relevant people
  • Get trending documents
  • Get user photo (V1) [DEPRECATED]
  • Get user photo (V2)
  • Get user photo metadata
  • Get user profile (V1) [DEPRECATED]
  • Get user profile (V2)
  • Search for users (V2)
  • Search for users [DEPRECATED]
  • Send an HTTP request
  • Update my profile
  • Update my profile photo

The interactive security report will load automatically.