To summarize a document protected by a sensitivity label, Microsoft 365 Copilot requires the user to hold the EXTRACT usage right (often listed as Copy). This right authorizes the "extraction" of content from the file into the Copilot service for processing.

• User1 (Owner) has full control, which includes the EXTRACT right.
• User2 (Editor) holds the "Co-Author" set of rights, which includes VIEW, EDIT, and COPY (EXTRACT). Therefore, they can use Copilot.
• User3 (Restricted Editor) corresponds to the "Reviewer" role. While they can edit the document content, this role restricts the COPY (EXTRACT) right to prevent data exfiltration. Consequently, Copilot is blocked from accessing the content.
• User4 (Viewer) has VIEW rights only and lacks the EXTRACT right.

A (User1 only): Incorrect because User2 (Editor) also possesses the EXTRACT permission necessary for Copilot to function.

C (User1, User2, and User3 only): Incorrect because User3 (Restricted Editor) lacks the EXTRACT right. Although they can edit the file, the restriction on copying data prevents Copilot from processing it.

D (User1, User2, User3, and User4): Incorrect because both User3 and User4 lack the required EXTRACT permissions.

Microsoft Learn: "Microsoft Purview data security and compliance protections for Microsoft 365 Copilot" (Confirming the requirement for EXTRACT usage right).

Microsoft Community/Docs: "Sensitivity label permissions" (Mapping updated names: Co-author is now Editor; Reviewer is now Restricted Editor).

Microsoft Learn: "Configure usage rights for Azure Information Protection" (Defining that Reviewer/Restricted Editor lacks the Copy/Extract right).