Getting your Microsoft 365 ready for Copilot: fix oversharing first

Why permissions suddenly matter more

In most offices, plenty of files are technically open to more people than intended. A salary spreadsheet sits in a library everyone can read, a board paper was shared with a link that works for the whole organisation, or an old HR folder inherited permissions from a site everyone belongs to. Nobody noticed, because nobody went looking, and finding those files required knowing where they were.

Copilot changes that. A staff member who asks it to summarise everything about pay rates or upcoming restructures may get an answer drawn from documents they never knew they could open. Copilot is not breaking any rules when this happens; it is respecting permissions that were wrong all along. So readiness work is mostly about fixing access that should have been fixed anyway.

Finding the oversharing

Start with the sites and libraries most likely to hold sensitive material: finance, payroll, HR, management, client personal information and anything containing contracts or pricing. Check who has access to each one. Look in particular for the Everyone and Everyone except external users groups, which grant access to all staff and are often added by default or for convenience.

Then look at sharing links. Links that work for anyone in the organisation spread access widely without anyone being added to a group. SharePoint admin reports and data access governance tools, available with some licences, list sites with broad access or many sharing links. Even without those, an hour going through the sensitive libraries by hand is time well spent.

Fixing the problems you find

Remove broad groups from sites that should be restricted and replace them with a specific group of the people who need access. Delete organisation-wide sharing links on sensitive files and reshare with named people if needed. Where a folder inside a general library holds sensitive material, move it into a properly restricted library rather than breaking inheritance on the folder.

Do this in order of risk, not alphabetically. Payroll and HR come first, then management and board material, then client personal information. Some tools can temporarily exclude particular sites from Copilot and organisation-wide search while you work through the clean-up, which buys time without delaying the whole project indefinitely. Note each fix as you go so the same mistake is not repeated on the next new site.

Labels, retention and old content

Sensitivity labels let you mark documents as confidential or highly confidential and apply protections such as encryption that travel with the file. Copilot respects those protections, so labelling your most sensitive material adds a further layer beyond site permissions. Even a simple label scheme, applied to the obviously sensitive libraries, is a useful step for a small business.

Old content is the other quiet risk. Copilot can draw on outdated policies, superseded price lists and drafts from years ago, giving answers that are confidently wrong. Archiving or deleting stale material in line with your record-keeping rules improves the quality of what Copilot produces as well as reducing what can be overshared.

Running a sensible pilot

Start with a small group of people who will use Copilot regularly and give honest feedback, such as a manager, someone in accounts and someone in a client-facing role. Choose a few real tasks for them: summarising long email threads, drafting replies, preparing meeting notes in Teams or analysing a spreadsheet. Measure whether it saves time on those tasks.

Ask the pilot group to report anything Copilot shows them that they think they should not have seen. Treat each report as a permissions fix, not a Copilot problem. After a month or two you will know whether it is worth the licence cost for each role, and your permissions will be in better shape whether or not you roll it out further. Check current Copilot pricing and licence requirements before committing.

Policies and staff guidance

Write a short acceptable use note covering what staff may use Copilot for, the need to check its output before sending anything to a client, and what not to paste into consumer AI tools outside Microsoft 365. Under the Privacy Act 2020 the business remains responsible for how personal information is used, including when an AI tool helps process it, so a sentence on client data is worth including.

Readiness is not a one-off project. New sites, new teams and new sharing links appear every week. Build a quarterly permissions review into normal IT housekeeping and keep the sensitive libraries locked down. If you want an outside view before you start, a Copilot readiness check from Office IT looks at who can open what across your tenant and lists the fixes in order of risk.