Probably from the Microsoft 365/Teams/Outlook/whatever profile which can include who's your manager, or potentially from Outlook emails. From what I can tell, Microsoft's been trying hard to shove copilot in any of their systems, like AAD/Entra.

My company has recently migrated their emails to it and as an admin I was very surprised that you can just read any email in full in any mailbox from "regular" functionality like email trace or antispam. I have no idea how that's GDPR compliant - in my other jobs we were using Google Workspace which only shows metadata because of that, and accessing another person's mailbox by other means (e.g. resetting the password on an ex-employee account) was a huge no-no