When you ask Microsoft 365 Copilot to “summarize last quarter’s sales figures”, Copilot gathers the answer from your organization’s files, emails and chats. The question to ask here is: which files can Copilot look at?
Microsoft’s answer is clear: Copilot only surfaces content that the user has at least view permission for. In other words, Copilot does not open new access; it uses the permissions that already exist. That is exactly where the problem starts. A folder shared with “everyone” years ago, an open site left over from an old project, or a link shared by an employee who has since left sits in places nobody has thought about until now. Copilot makes these much easier to search for and find.
This is called “oversharing”: sharing more widely than needed. The steps below are a practical start to reducing this risk before you turn on Copilot. This article is for general information.
What can Copilot access, and what not?
Copilot reaches email, calendar, chats, meetings and documents through Microsoft Graph. According to Microsoft’s documentation:
- Copilot is limited to content the user can already access. It does not reach another user’s or another organization’s data on its own.
- For content encrypted with sensitivity labels, the usage rights granted to the user apply.
- Permissions you give to people outside your organization through inter-tenant collaboration tools, such as shared channels in Teams, are also in scope.
In short, Copilot’s security depends on how orderly your permissions are. If permissions are messy, Copilot makes that mess visible.
1. Find the broadest sharing
The first step is to measure who can see what. Look especially at:
- Sites, folders and files shared with “everyone” or “everyone in the organization”.
- Sharing links that anyone with the link can open.
- Sites and teams with no clear owner, or whose owner has left the organization.
- Guest users: external people whose project has ended but whose access remains.
The Microsoft 365 admin center and the SharePoint admin center show part of this information. If your organization has at least one Microsoft 365 Copilot license, the Copilot readiness features of SharePoint Advanced Management can also be used. First among them are the Data access governance reports in the SharePoint admin center: site permissions across the organization, sharing links and content shared with “everyone except external users” are listed in these reports. Start with the two or three most critical areas (human resources, finance, management).
2. Mark sensitive content
Not every file is equally important. Content such as payroll, contracts, customer lists and documents containing personal data needs separate handling. With Microsoft Purview sensitivity labels you can sort documents into classes such as “Confidential” or “Internal only”. A label that includes encryption limits who can open the content even if it is moved to the wrong place.
Before you start labeling, you need to know which data sits where. For that, see our data map article.
3. Fix permissions, then turn it on
Close or narrow the broad sharing you find. This is the lasting fix. It can take time; in large environments it can take weeks. In the meantime, two interim tools help:
- Restricted Content Discovery: According to Microsoft, it removes a site from organization-wide search and from Copilot’s broad search; it does not change permissions, and people with access keep using the site. It is a setting turned on per site; it requires a Copilot license and SharePoint Advanced Management. It does not work on OneDrive; on very large sites (more than 500,000 items) it can take more than a week to take effect.
- Site access review: Started from the Data access governance report. An email goes to the site owner; the owner reviews who should have access, fixes permissions and completes the review. It works only on SharePoint sites, not on OneDrive.
Microsoft also notes that overusing Restricted Content Discovery can hurt search and Copilot performance. So this tool is not a lasting fix but a bridge used while permissions are being fixed. Microsoft is retiring the older Restricted SharePoint Search and recommends Restricted Content Discovery instead.
4. Start with a small group
Instead of turning Copilot on for the whole organization at once, start with a small pilot group from units whose permissions have been cleaned up. During the pilot, ask users whether they came across any unexpected content. Every unexpected result points to a sharing setting that needs fixing.
5. Make the order stick
Once cleaned up, permissions drift again. To prevent this:
- Require an owner and a privacy setting when new sites and teams are created.
- Make “specific people only” the default for sharing links.
- Review guest access at regular intervals.
- When an employee leaves, handle their account and sharing on the same day.
Summary: five questions to start with
- Which sites and folders are open to everyone in the organization?
- Who holds sharing links that anyone with the link can open?
- Which sites and teams have no owner?
- Are sensitive documents labeled?
- Which unit will try Copilot first?
If you don’t know the answers to these questions, now is a good time to look before turning on Copilot. Our Microsoft 365 management service covers roles, access and security settings; our Microsoft 365 Copilot page covers readiness starting with sharing permissions and sensitive data checks, license selection and pilot steps. Contact us with your questions.
Sources
Microsoft’s official documentation:
- Microsoft Learn, Data, Privacy, and Security for Microsoft Copilot: https://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-privacy
- Microsoft Learn, Restrict discovery of SharePoint sites and content: https://learn.microsoft.com/sharepoint/restricted-content-discovery
- Microsoft Learn, Get ready for Copilot with SharePoint Advanced Management: https://learn.microsoft.com/sharepoint/get-ready-copilot-sharepoint-advanced-management
