Travis Hay, Author at Inside Track Blog

Confidential by design: How we’re securing OneNote for the age of AI at Microsoft

Travis Hay — Thu, 21 Aug 2025 16:00:00 +0000

Here at Microsoft and at workplaces around the world, OneNote is used for everything from record keeping and note-taking to collaborating across teams. And with Microsoft 365 Copilot making work easier and more efficient across all Microsoft 365 applications, OneNote should be no exception.

However, before we in Microsoft Digital, the company’s IT organization, could fully integrate Copilot into OneNote, we first needed to make it more secure. We recently accomplished this internally at Microsoft by deploying labeling that makes our OneNote notebooks and files more secure. This allowed us to start using Copilot in OneNote without compromising our sensitive or classified data.

“We realized that notebook oversharing was happening significantly and that we were keeping a lot of sensitive data in our notebooks,” says David Johnson, a principal product manager with Microsoft Digital. “OneNote was the only Microsoft 365 program that didn’t support labeling, a gap that we needed to address.”

“OneNote is designed to be the ultimate collaboration tool. So, you can have OneNote as your own personal notebook, or you can share it out with other people and collaborate. People use OneNote for a lot of different things, but at Microsoft especially, it is used for things like troubleshooting guides, post-incident reviews and other very sensitive things that require a high degree of seamless collaboration.”

Faye Harold, principal product manager, Information Protection team, Microsoft Security

Our diverse and heavy use of OneNote throughout Microsoft made closing that gap a critical need.

“OneNote is designed to be the ultimate collaboration tool,” says Faye Harold a principal product manager within the Information Protection Team in Microsoft Security. “So, you can have OneNote as your own personal notebook, or you can share it out with other people and collaborate. People use OneNote for a lot of different things, but at Microsoft especially, it is used for things like troubleshooting guides, post-incident reviews and other very sensitive things that require a high degree of seamless collaboration.”

And the idea that “it’s fine” because no one will ever find your notes in OneNote?

That’s no longer a thing, if it ever was.

In the age of AI, security through obscurity is effectively gone.

“Now the construct is, ‘AI can show you everything you have access to, no matter where it is, including in your colleague’s OneNote notebooks,’” Johnson says. “Without labeling, Copilot can and will show you information that you’re not supposed to see.”

“Bringing sensitivity labels to OneNote marks a major step forward in helping tenant admins safeguard organizational data. It enables consistent enforcement of security policies across the Microsoft 365 suite, giving admins greater confidence that sensitive information in OneNote is protected and governed just like in other Office apps.”

Daniel Beade, senior product manager, OneNote product group

Permissions versus labeling

The current security measures in OneNote are permission-based, determining who can access content at a specific point in time. Labeling adds encryption and policy enforcement to ensure content is protected regardless of where it is stored or shared. And when it comes to AI, labeling establishes confidentiality and security requirements that Copilot must respect. Labeling also helps users understand the sensitivity of content used by Copilot, ensuring they handle the generated responses with appropriate care.

“Bringing sensitivity labels to OneNote marks a major step forward in helping tenant admins safeguard organizational data,” says Daniel Beade, a senior product manager with the OneNote product group. “It enables consistent enforcement of security policies across the Microsoft 365 suite, giving admins greater confidence that sensitive information in OneNote is protected and governed just like in other Office apps.”

Johnson used the analogy of a poisoned apple pie to explain further.

“Imagine if Copilot was baking you a nice apple pie and you weren’t told that the apples it used to make the pie were poison,” he says. “You probably should know that before you take a bite of that pie. Same basic idea here. You’ve got highly confidential content in use that Copilot is using to generate a response. You should be aware of it.”

A triangle deployment model

Security labeling for OneNote was deployed internally to our 300,000 Microsoft employees and vendors in April 2025, and we have updated the Microsoft 365 product roadmap to reflect our plan to make this capability generally available by January 2026 with more information to be shared in the coming months.

“The user awareness aspect of labeling is absolutely critical. When you think about labeling, it’s about user awareness of how sensitive a piece of content should be and the applicability of policies to make sure that the content doesn’t go beyond whatever limits are imposed.”

David Johnson, principal product manager, Microsoft Digital

Our internal deployment happened in two stages. The first stage enabled labeling in the user interface. The second stage rolled out a default policy that labeled all content with a protected label, with options for users to adjust based on the sensitivity of the content.

“The user awareness aspect of labeling is absolutely critical,” Johnson says. “When you think about labeling, it’s about user awareness of how sensitive a piece of content should be and the applicability of policies to make sure that the content doesn’t go beyond whatever limits are imposed.”

“It’s super important to have a labeling capability in OneNote, because down the road labeling is going to help enable more capabilities of Copilot that will allow users to increase their productivity.”

Humberto Arias, senior product manager, Microsoft Digital

The internal deployment strategy involved a triangle model where one organization focused on security requirements, another on tenant management, and his team focused on employee experience.

The model ensured that security measures did not hinder productivity.

“Because Copilot extracts and surfaces content from various sources, it is essential for it to know the sensitivity of the content it uses to generate responses,” says Humberto Arias, a senior product manager in Microsoft Digital. “So that’s why it’s super important to have a labeling capability in OneNote, because down the road labeling is going to help enable more capabilities of Copilot that will allow users to increase their productivity.”

As for those future capabilities, Beade from the product group listed three that will further enhance security within OneNote.

The first, user-defined permissions labels, or UDP, will allow tenants to define permissions at the user level. This means one of our employees could set up a UDP label and then use it to grant edit permissions to one person and read-only access to another. This is similar to what currently exists in Word, PowerPoint and Excel.

The second feature Beade mentioned is auto-labeling. This will allow OneNote to automatically label information based on criteria defined by the tenant admin. Flagging certain content automatically will help prevent Copilot from surfacing sensitive information.

Another security feature coming soon to OneNote is dynamic watermarking.

“Not only will the labeling protection be added into the file, but also watermarking will be added that will ensure everyone knows that the information is confidential,” Beade says. “All three will compliment security labeling and add more protection to OneNote.”

Adding new features to OneNote will now be much easier.

“Labeling is going to make it very seamless for us to deploy new Copilot features in the future,” Arias says. “This was an important step for us to bring OneNote up to par with the rest of the Microsoft 365 apps.”

Key takeaways

When sensitivity labels become publicly available in OneNote in January 2026, here are some of things you will be able to do with them:

Use OneNote features with confidence. OneNote is a powerful tool for collaboration, and security labeling makes sure Copilot does not surface sensitive information from your notebooks.
Foster collaboration without the risk of exposing sensitive data. Permission-based security determines who can access content at a specific point in time. Security labeling adds encryption and policy enforcement, protecting your content regardless of where it is stored or shared.
Be AI-aware when it comes to security. Security labeling ensures Copilot respects confidentiality and security requirements while also helping users understand the sensitivity of content used by Copilot so they handle the generated responses with appropriate care.
Set location label defaults. We set an encrypted protection label, limiting data to tenant members only for all our employees’ OneDrive. That made it so simply rolling out OneNote with labeling resulted in a high percentage of active sections having that default label applied.

Try it out

Try out Microsoft OneNote.

Mapping our migration from the Windows 10 version of OneNote to the Desktop app

Travis Hay — Thu, 22 May 2025 15:50:00 +0000

Microsoft OneNote is a tool used every day by millions of people, from school teachers to boardroom executives, to keep their professional lives orderly. In October 2025 some of those lives could become a little more chaotic when Microsoft ends support for the Windows 10 version of OneNote.

To prevent that kind of disruption, organizations will need to follow our example and migrate from the Windows 10 version of OneNote to the OneNote for Desktop app. Migration is necessary because when support ends on October 14, 2025, the Windows 10 version will no longer be updated and may become vulnerable to security risks. Along with strengthened security, when you migrate to the desktop app you’ll also get better syncing and access to new features and future Copilot integration.

Here at Microsoft Digital, the company’s IT organization, we’ve migrated roughly 400,000 accounts internally to the preferred app version of OneNote. This was done as part of our role as Customer Zero, meaning we validate and improve products before they go to customers. As part of that process, we often take what we’ve learned and incorporate it into the final product.

“The great thing about stress testing and migrating with Microsoft is because we are such a large company, we’ve seen all the edge cases and we’ve accounted for them, so customers don’t have to,” Humberto Arias, senior product manager for Microsoft Digital.

Our learnings from being Customer Zero range from making tweaks to the migration guide to improving the script used for migration to meet the needs of our customers.

“One thing we learned is that 60-70 percent of our enterprise customers block the Microsoft Store,” says Bolanle Soneye, a senior product manager in the OneNote product group. “This meant that those users likely were not upgraded to the most recent version of OneNote for Windows 10. So, we created a sample script where IT admins can customize to automatically update you to the right version.”

While all migration situations are unique, Arias offered these steps as a high-level overview of what a migration might look like:

Detection: The first step in the migration process is to detect the version of OneNote being used. This involves collecting telemetry data to understand all of the versions within the tenant.
Synchronization: The next step is to synchronize all notebooks with the cloud to ensure no data is lost.
Installation: The OneNote for Desktop app is then installed. This ensures that employees have access to the latest features and security updates.
Uninstallation: After successful synchronization, the old version of OneNote is uninstalled. This step is necessary to remove outdated software and prepare for the new installation.
Resynchronization: The final step is to resynchronize all the files to the devices and keep copies in the cloud.

Different approaches for different customers

Bolanle Soneye (left) and Humberto Arias urge customers to move from the Windows 10 version of OneNote to the desktop app version as quickly as they can. Soneye is a senior product manager in the OneNote product group and Arias is a senior product manager for Microsoft Digital.

When it comes to our customers, we have three primary segments of OneNote customers: enterprise, education, and consumers. Because each one has different needs, we use different strategies for migrating each segment.

Our enterprise customers make up the majority of users who need to migrate. Our strategy for migrating our roughly 2.7 million enterprise accounts includes providing them with a sample script that is customizable for their needs. We also have a detailed migration guide for enterprise customers to follow. The experiences of 12 pilot tenants who stress tested the guide and provided feedback on their experiences were essential in formulating the migration guide.

“Think of it as a modular toolkit,” Arias says. “It covers every step required to ensure data consistency and a frictionless experience—detect, sync, install, uninstall, and re‑sync—and customers can mix and match the pieces they need. If they’re comfortable moving quickly, they can execute the whole sequence in one shot; if not, they can start with detection, add synchronization later, and roll it out gradually.”

Because it is most convenient for IT managers of educational institutions to conduct mass migrations during breaks in the academic year, we’ve shifted our communications strategy to emphasize the importance of migration during those times. The challenge we’ve found with education tenants is they tend to keep multiple versions of the app instead of uninstalling the old version of OneNote after migration, which can create confusion for users and increase the risk of issues once the older version reaches end of support.

Looking ahead, there’s one final major opportunity for education users in the Northern Hemisphere to complete their migrations: the upcoming June to August 2025 break. We’re encouraging IT managers to take advantage of this window to ensure a smooth, timely migration and to uninstall the older version of OneNote afterward to help provide a clearer, more secure experience for everyone.

The consumer segment, which represents approximately 1.7 million people, has been the slowest to migrate. Our strategy for reaching them and encouraging migration involves in-app messaging around the sunsetting of the Windows 10 version of OneNote and the importance of migrating. Our call to action for organizations affected by this challenge is for them to use the in-app migration dialog to migrate before the app reaches end of support.

The benefits of migration

Soneye stresses the importance of migrating not just because of what you’ll lose if you don’t but also what you will gain when you do.

“We’ve heard lots of positive feedback on the improved syncing that comes with the desktop app, and you will have access to the new Copilot capabilities that we will be rolling out, alongside security labeling,” she says. “And IT admins have had a reduction in incidents and support requests related to OneNote, thanks to the migration. The benefits of migrating far outweigh the risks.”

Here is what you need to know about migrating to the OneNote for Desktop app:

Support and security are ending: On October 14, 2025, Microsoft will end support for the Windows 10 version of OneNote.
Keeping data safe and secure will be crucial: If you do not migrate you will be vulnerable to security risks.
Take advantage of the new features of an improved OneNote app: When you migrate, you will have faster synchronizations and access to upcoming Copilot features within OneNote for Desktop.

Download the latest version of OneNote.

Want more information? Email us and include a link to this story and we’ll get back to you.

The post Mapping our migration from the Windows 10 version of OneNote to the Desktop app appeared first on Inside Track Blog.

Deploying Microsoft Places at Microsoft with our works councils

Travis Hay — Thu, 08 May 2025 16:00:00 +0000

Our strong partnership with our works councils has led to the successful deployment of many Microsoft 365 Copilot applications, including one of the latest, Microsoft Places.

Places is a workplace scheduling tool that uses AI to make scheduling in-person meetings and working in hybrid work environments easier for you and your colleagues. It helps hybrid and non-hybrid teams align and manage schedules so they can know when the best times might be to collaborate in person or hold on-site meetings. It does that through location tracking, which can be turned on and off.

We are Microsoft Digital, the company’s IT organization, and before we deployed Places globally here at Microsoft, we consulted with our works councils, groups of our employees who work in various geographies that advocate for the interests of employees in their region or country. One of the hot topics for works councils in today’s workplace is the introduction of AI into many areas of work. More and more, we’re being exposed to new ways of working with AI and we’re still learning how to use it in responsible ways. Many still have questions about its use around privacy. Initially the way Places uses AI has brought up some questions for our works council countries.

“It’s actually a very simple product, Places, but it touches on something that has huge interest in a number of works council countries, which is the aspect of tracking people’s location,” says Allan Hvass, regional experience lead for Microsoft Digital. “So even if technology is simple, it’s a high, high-interest topic.”

{Read and download our guide for deploying Places at your company.}

Works councils provide a ‘golden opportunity’

Addressing works council concerns is a focus for Allan Hvass (left to right), Jason McWreath, and Daniel Yuan.

While we at Microsoft Digital serve as Customer Zero, meaning our internal usage and feedback is used to shape the product before it’s launched to the public, we partner with works councils to help inform our product groups of potential concerns. One of the keys to our strong partnership with our works councils has been being transparent with the purpose and benefits of the features we plan to roll out and being proactive with our communications. We work closely with them to ensure that everyone feels heard and protected when it comes to employee privacy.

Being proactive and starting conversations with works councils early has its benefits, according to Daniel Yaun, a senior product manager for Microsoft Digital.

“It’s a golden opportunity for us to have an open and transparent dialogue with works councils and for us to understand what the concerns are,” he says.

Part of the conversations around Places with works councils involved detailing the benefits of enabling location sharing. Being clear about the benefits, such as knowing when coworkers are in the office, seeing the availability of meeting spaces, and enabling in-person collaboration, helped relieve some of the concerns raised by employees.

“In a hybrid work environment, we needed to be clear about what the value is for employees,” Hvass says. “We had to be very strong on the message of why it is a great benefit for me as an employee to be part of this and share my data. What I can gain from it and how can I help my colleagues, versus just being used for tracking whether I show up at a physical place or how many people are in a building. Otherwise, people would find ways of opting out rather than opting in.”

In the end, having a strong relationship, communicating clearly, and proactively and incorporating feedback into the final product has served us and our customers well.

“It’s really beneficial that Microsoft has a very mature process on the work of council engagements,” Yuan says.

Making a better product through works councils reviews

Aside from acting as the voice of employees in various geographies, one of the more valuable roles our works councils play is as an extension of Customer Zero. We listen to their concerns and work with product groups to incorporate their feedback to make sure the product meets their requirements.

The things that made the rollout of Places with our works councils successful were:

Having an established framework for working with works councils that has been successful and is repeatable
Having the ability to manage the release of certain functionality to specific markets
Moving the product to an opt-in model
Providing a full explanation of what the technology was doing

Jason McWreath, a director of business programs for Microsoft Digital, says there was an initial issue where collaborators could see each other’s locations across country boundaries, which had not been approved by all works councils. This raised privacy concerns and required a product update.

By acting as Customer Zero and partnering with global works councils, we heard the feedback and took that back to the product group to address the issue. We updated Places to allow for specific targeting. This change enabled granular management at the country level, where the feature could be turned on or off for individual countries based on works council approvals. Getting approvals from works councils also allowed for Places to be updated after it was deployed.

“Instead of looking at it like these are more requirements that we need to consider, it’s more about what we can learn to enhance the product and make it more globally applicable for more customers by introducing these enhancements the works councils have raised,” says Jason McWreath, a director of business programs for Microsoft Digital.

Due to continued privacy concerns for everyone globally, location sharing became our most debated feature and we had to address the varying privacy regulations of works councils countries. By giving employees the default opt-out feature, it enables employees to choose whether they want to share their location and it has helped the product meet the requirements for global works councils approvals.

The feedback we receive from works councils around AI and other technologies not only helps us effectively deploy products externally, it also helps improve products for external customers. And now that several Places features have been approved by most work councils, we can bring new features such as the ability to locate someone where they’re sitting in a room or know whether a colleague is in a building based on Wi-Fi access, to works councils for review.

Here are some tips for collaborating with your works councils as you get started with Places:

When working with global works councils, be transparent and trustworthy.
Listen, learn, and implement feedback from works councils.
After you’ve established a successful framework for working with works councils ensure that it’s repeatable and use it to partner with them.

Get a free trial of Microsoft Places.

Want more information? Email us and include a link to this story and we’ll get back to you.

The post Deploying Microsoft Places at Microsoft with our works councils appeared first on Inside Track Blog.

Taking back time: Evolving how we use Microsoft 365 Copilot Chat at Microsoft

Travis Hay — Thu, 20 Mar 2025 16:00:00 +0000

When we deployed Microsoft 365 Copilot internally at Microsoft, we thought it would save time for our employees and vendors, and it has, especially with the help of Copilot Chat.

With a Microsoft 365 Copilot subscription, Copilot Chat becomes more powerful with its ability to bring together your web and work data as your front door to Copilot. It’s accessible within the flow of where you work, including in your Microsoft 365 Copilot app, Teams, Outlook, and Edge sidebar.

Swapna Malekar (left to right), Anishkumar Thoppil Ramakrishnan, and Tom Heath are playing key roles when it comes to letting our employees know when we improve and add capabilities to Copilot Chat.

“It allows you to get ahead of all the noise that’s all around you,” says Swapna Malekar, co-lead for deployment of Copilot Chat and a principal product lead in Enterprise Search on our Microsoft Digital team, the company’s IT organization. “It’s about creating a coherent experience wherever you go—whether it’s your emails, your chats, your documents, your people, your calendars, your meetings, each and every entity type is covered under Copilot Chat.”

In short, Copilot Chat, a key path for accessing Copilot, simplifies your life at work, so you have time to think and get high-value tasks done.

Today, our employees and vendors are using Copilot Chat to get summaries of their emails, meetings, and messages; to check Teams mentions; to manage their inboxes; and to make graphics and illustrations. They’re using it to create documents and set up meeting agendas. They’re using it to draft documents, augment content, and do simple searches.

But to get these benefits, we first had to ready our employees for the change.

Employees wanted ‘more and more’ Microsoft 365 Copilot

Malekar and Anishkumar Thoppil Ramakrishnan, director of product management on the Microsoft Search team in Microsoft Digital, co-led the initial deployment pilot in May 2023, when 2,000 of our employees in sales roles were trained to use the product. Microsoft Digital used different scenarios and use cases to show that group of employees the value of Copilot and Copilot Chat.

“People were loving it more than we thought,” Thoppil Ramakrishnan says. “They wanted more and more because they were seeing the benefits.”

By October 2023, the number of internal users rose to 25,000 when our legal and marketing teams were onboarded, and in February 2024 our company-wide rollout was completed.

Driving adoption of a powerful, easy-to-use tool

The impact of Copilot Chat was almost immediate and transformational. And as Copilot Chat usage grew, so did the focus on accuracy and reliability. We in Microsoft Digital studied the rollout closely, evaluating overall user experience and the product’s accuracy, reliability, completeness, relevancy, personalization, coherency, consistency, and ability to evolve. Of equal importance, we also compared how well it surfaced and shared workplace information.

While usage was high, the deployment team remained cautious, especially as some employees wanted more accuracy for the information Copilot Chat was gathering.

“We have to help employees use Copilot Chat to find information, but at the same time, we have to be cautious,” Ramakrishnan says. But over time, the model continued to learn and improve. And with it, accuracy and user confidence went up. “They trust it more now.”

No longer having to focus on the mundane

Advancements haven’t just focused on accuracy, but product refinements and feature releases that empower our employees to do more.

“As an employee, as a user, you want to work on the most high-priority items,” Malekar says. “Copilot Chat can help you with the mundane tasks and free up your time to think more strategically and be more effective in your communication with your stakeholders.”

Our employees can automate their favorite prompts and share them with their colleagues using a feature that will become widely available in the coming months. If they create a useful Copilot prompt and want to keep using it, they can save and automate the prompt by asking Copilot to run it for them later. The prompt can be scheduled to run at set times and frequencies.

This spring, the team is releasing a new feature called Rewrite, which allows users to edit typed text for tone, format, and length within an open page in Microsoft Edge. Last year we introduced Copilot Pages—a dynamic, persistent canvas designed for multiplayer AI collaboration that our employees are now using to turn Copilot responses into editable and sharable pages. This gives users a digital place for generating, organizing and refining content in real-time.

And the product is improving rapidly, so if it can’t do something thing one day, chances are it will be able to do it the next.

This is just the start

It takes time to build new habits.

“That’s the journey we’re on,” says Tom Heath, senior business program manager for Microsoft Digital. “It’s a natural migration, and our employees are getting there.”

Malekar believes Copilot Chat needs to be extended to include more data, domain types, and knowledge sources. In the meantime, it’s becoming more personalized—and effective—through the actions of its users.

Heath is one of our employees who uses Copilot Chat every day.

“There’s always a file or a conversation or something that’s happened and I can’t find it in Teams or Outlook,” Heath says. “I just put a prompt into Copilot Chat, and there it is.”

Copilot Chat will continue to evolve at the speed of AI and the product team is continuing to share the learnings it hears from employees back to the product group. That feedback is used to make rapid and iterative improvements to the product, turning Copilot Chat into an even more user-friendly, intuitive, and easy to use tool.

“Our employees are finding wonderful and clever ways to use Copilot Chat,” Malekar says. “They are doing things with it that we never expected—it really has fueled their creativity. It’s changing the way we use and think about technology.”

Here are our suggestions for getting the most out of Microsoft 365 Copilot at your company:

Use Copilot Chat to help your employees quickly find and use information buried in documents, presentations, emails, calendar invitations, notes, and contacts.
Your employees can use it wherever they work, as it’s woven into m365copilot.com, Teams, Edge, Windows, Outlook, and the Microsoft 365 Copilot app.
It will save your employees much-needed work time to focus on their core work. In a three-month period during its deployment, Copilot Chat saved our employees 900,000 hours collectively.
Your use rates will go up when employees realize the best way to get to value is to change the way they work.
Teaching your employees how to prompt Copilot Chat is key. Our employees reported the feature’s usefulness went up when they learned how to write effective prompts.

Learn how to get started with Copilot Chat using our success kit.

Want more information? Email us and include a link to this story and we’ll get back to you.

The post Taking back time: Evolving how we use Microsoft 365 Copilot Chat at Microsoft appeared first on Inside Track Blog.