Microsoft 3655 min read
Getting ready for Microsoft 365 Copilot: tidy permissions before prompts
Copilot only shows what each user can already open. That is good news, and the reason old sharing mistakes suddenly matter.
- Published
Gulf Infotech BlogMicrosoft 365On this page
In short
Before you switch on Microsoft 365 Copilot, fix who can see what. Microsoft states that Copilot only surfaces content a user already has at least view permission to. That protects you from outsiders, but it also means a SharePoint site or OneDrive folder shared with the whole company becomes one prompt away for everyone. Tidy sharing, label sensitive files, then license a pilot group.
Key takeaways
- Copilot only surfaces content a user can already open, so a site shared with the whole company is one prompt away for everyone.
- Find overshared content with the data access governance reports, then fix access at the source.
- Label HR, finance, legal and management content first.
- License a small pilot group, check what Copilot shows them, then extend with training.
Why do permissions matter more once Copilot arrives?
Copilot does not get any access of its own. It works through the same Microsoft 365 permissions your staff already have. Microsoft also says prompts, responses and the work data Copilot reads are not used to train its foundation models.
So the risk is not Microsoft seeing your data. The risk is your own colleagues seeing files they were never meant to find.
Before Copilot, an overshared file was protected by obscurity. Someone had to know which site it sat on and go looking. Copilot removes that effort. Ask "summarise this year's salary changes" and it searches everything the user is allowed to open, in seconds. Nothing about the permissions changed. Finding things just became easy.
The same applies to Gemini in Google Workspace, which also draws on files a user can open. The clean-up below is worth doing whichever assistant you choose.
Where does oversharing usually hide?
The usual causes are old habits, not bad intent:
- Sites and teams open to the whole company. A team site created for a project years ago, set to "everyone" so nobody had to request access.
- Old sharing links. Links to "anyone in the organisation" created for one email and never expired.
- Sites with no owner. The person who set it up left, so nobody reviews who is inside.
- Personal OneDrive folders shared widely. A manager shared a folder with the department for one task and kept saving files into it.
- Guests who stayed. External accounts from a finished project that still have access.
- Sensitive files in general places. Payroll exports, contracts or board papers saved to a general team library.
Which Microsoft tools help you find and fix it?
Microsoft gives administrators several tools for this. Most of them sit in SharePoint Advanced Management, which Microsoft makes available once Copilot licences are assigned in the tenant.
| Tool | What it does | Good to know |
|---|---|---|
| Data access governance reports | Find SharePoint and OneDrive sites with potentially overshared or sensitive content | Start here: it gives you the list to work through |
| Site access reviews | Ask each site owner to confirm who should have access | Puts the decision with the people who know the content |
| Restricted Content Discovery | Keeps selected sites out of organisation-wide search and Copilot answers while you review them | Temporary. It does not change permissions: people with access can still open the files directly |
| Sensitivity labels (Microsoft Purview) | Mark and protect confidential files, with encryption where needed | Microsoft says Copilot honours labels and encryption |
None of these replaces fixing access at the source. They tell you where to look and buy you time.
A five-step readiness plan
Check licences first
confirm every future Copilot user has an eligible Microsoft 365 plan. Copilot Chat comes with eligible plans and works mainly from the web; a Microsoft 365 Copilot licence is what lets it reason over your mail, files and chats, and that is where permissions start to matter.
Find overshared content
run the data access governance reports and list the sites and folders with the widest access, the most sensitive files and no active owner.
Fix access at the source
remove company-wide access from confidential sites, expire old sharing links, give every site an owner and remove guests who no longer need access. For sites you cannot fix in time, use Restricted Content Discovery as a stopgap.
Label what is sensitive
agree a short set of sensitivity labels (for example Public, Internal, Confidential) and apply them first to HR, finance, legal and management content.
Pilot, then extend
license a small group of people who live in Outlook, Teams and Excel. Check what Copilot shows them, fix anything surprising, then extend to more teams with training.
How long does readiness take?
It depends on how many sites and teams you have, how old they are and how quickly owners answer access reviews. A tenant with a few well-kept team sites can be ready quickly. A tenant with years of project sites and shared folders takes longer, mostly because people need time to decide what should stay open. We set the timeline after the first review of your tenant.
Readiness is also not a one-off. New sites and new sharing links appear every week, so keep the access reviews running after Copilot is live.
Where do we come in?
Our overview-level Copilot readiness check is free. We look at sharing settings, overshared sites and folders, labels and licences, and tell you what to fix before rollout. If you want us to do the clean-up, the pilot or the Copilot training as well, we quote that separately.
Gulf Infotech is a Microsoft Solutions Partner for Modern Work. Your compliance team decides which data needs which protection; we configure Microsoft 365 to match.
Written by
Zoho, Microsoft and Google partner, serving the Middle East since 2007.
