Microsoft 365 Copilot Readiness: Fix Oversharing First

1. Understand what Copilot can see

Microsoft 365 Copilot only returns content the signed-in person already has permission to open. It does not bypass SharePoint, OneDrive, Teams or Exchange permissions.

So the real question is not whether Copilot is safe. It is whether your permissions are what you think they are. Years of shared links, old Teams and broad groups mean most tenants have files that more people can reach than anyone intended.

2. List your sites and who owns them

Start in the SharePoint admin center under Sites, then Active sites. Export the list. For each site note the owner, the last activity date, the sensitivity (HR, finance, legal, client work) and whether it is connected to a Microsoft 365 group or Team.

Sites with no owner, or with owners who have left, are the first to fix. Nobody can approve access for a site nobody owns.

3. Find broad access

These are the usual causes of oversharing, roughly in the order I find them:

• Sites or folders shared with Everyone except external users, which means every internal account.
• Sharing links set to People in your organization, which anyone inside the company can use once they have the link.
• Old Anyone links that were never expired.
• Microsoft 365 groups or Teams that are Public, so any employee can join and read the files.
• Large groups, such as an all-staff group, added to a site's Members or Visitors by mistake.
• Individual folders with unique permissions that nobody remembers setting.

If you have SharePoint Advanced Management, which Microsoft includes with Microsoft 365 Copilot licences, use the Data access governance reports in the SharePoint admin center. They show sites with broad sharing and sites shared with Everyone except external users. Without it, you can still review each important site through Settings, then Site permissions, and Advanced permissions settings.

4. Fix permissions at the right level

Do not fix files one by one. Change access at the highest level that solves it.

1. Remove broad groups from site Members and Visitors, and replace them with named groups for the people who really need access.
2. Use three groups per site: Owners, Members and Visitors, and manage people through the group instead of per file.
3. Stop inheritance on a folder only when it is truly different, and write down why.
4. Switch public Teams and groups to Private where the content is not meant for everyone.
5. Delete or expire Anyone and organization-wide links that are no longer needed.

Tell the site owners what you change and give them a way to ask for access back. Quiet changes that break someone's work make people distrust the project.

5. Set safer sharing defaults

Cleaning up once is not enough if people keep creating broad links. In the SharePoint admin center, under Policies, then Sharing, set the default link type to Specific people, and set an expiry for Anyone links if you allow them at all.

You can also limit sharing on the most sensitive sites individually, so a client folder cannot be opened up by one careless click.

6. Label and protect sensitive content

Sensitivity labels in Microsoft Purview let you mark content as Confidential or Highly confidential and apply protection that travels with the file. A label can also control site-level settings such as external sharing and access from unmanaged devices.

You do not need a perfect labelling scheme on day one. Start with three or four labels and apply them to the sites and libraries that matter most. Check your licence covers the features you want before you promise them.

7. Reduce what Copilot can reach on sensitive sites

For sites that must stay accessible to their members but should not feed Copilot answers, SharePoint Advanced Management offers Restricted Content Discovery. It limits what shows up in tenant-wide search and Copilot for that site. It does not change permissions, so treat it as a safety net while you fix access, not a replacement.

Where only a defined group should ever reach a site, Restricted Access Control limits access to that group, even if the site was shared more widely before.

8. Pilot with a small group, then widen

Give Copilot licences to a pilot group of 10 to 20 people from different teams. Ask them to test normal work prompts and to report anything they see that surprises them. Surprises are your best audit.

• Check each team has the right licence and a supported Microsoft 365 apps version.
• Run prompts against HR, finance and client folders as an ordinary user, and confirm the answers respect who should see what.
• Fix what you find, then add the next group.
• Review Microsoft Purview and SharePoint reports regularly after launch. Permissions drift over time.

A readiness review like this takes far less time than cleaning up after a leak, and it makes the rollout calmer for everyone.