Issue Summary

The Microsoft 365 Copilot connector for Confluence Cloud does not respect inherited page restrictions. It only enforces explicit page-level restrictions and space-level permissions. As a result, content from pages that inherit restrictions from a parent (but do not have explicit restrictions themselves) can be surfaced to unauthorized users via Copilot, leading to potential data exposure.

Steps to Reproduce

• In Confluence Cloud, create a space that is open to all licensed users.
• Within this space, create two root folders (parent pages):
  • One open to all users.
  • One restricted to a specific group via page-level restriction.
• Under the restricted parent, create child pages. Do not set explicit restrictions on these child pages; allow them to inherit restrictions from the parent.
• Deploy and configure the Microsoft 365 Copilot connector for Confluence Cloud as per Microsoft’s documentation.
• Using a user account that does NOT have permission to the restricted parent (or its children), issue a prompt to Copilot that would surface content from one of the restricted child pages.

Expected Results

Copilot should not be able to access or surface content from any page that is restricted to the user, whether the restriction is explicit or inherited from a parent page. Only users with the appropriate permissions (including inherited restrictions) should see restricted content in Copilot responses.

Actual Results

Copilot can access and surface content from child pages that inherit restrictions from a restricted parent, as long as those child pages do not have explicit page-level restrictions. However, this exposes restricted content to unauthorized users, disregarding inherited permissions.

Workaround

The only current workaround is to apply explicit page-level restrictions to every child page that should be protected, matching the parent’s restrictions. This can be done manually or via automation/scripting using the Confluence API. However, this approach is cumbersome, difficult to maintain, and not scalable for organizations that rely heavily on inherited restrictions.