Before You Switch On Copilot, Fix Who Can See What

Microsoft Copilot does not give anyone access they did not already have. It does make that access far easier to use, so the SharePoint sites, Teams and folders that are open to the whole company need fixing before the licences go out.

The short answer

Copilot answers questions using the files, emails, chats and meetings each person is already allowed to open. If a payroll folder or a board pack sits in a site that everyone in the organisation can reach, Copilot will treat it as fair game for anyone who asks the right question. The fix is not to hold Copilot back forever. It is to find the overshared content, close it down or label it, and then roll Copilot out to a pilot group before the rest of the company.

Why oversharing stayed invisible until now

Most Microsoft 365 tenants have years of sharing decisions baked in. A project site was opened to the whole company so a new hire could find the template. A Team was created as public because it was quicker. A folder was shared with "everyone" for one meeting and never closed again.

None of this caused much trouble because nobody went looking. Finding a sensitive file meant knowing which site it lived in, browsing to it and opening it. That friction quietly did a lot of security work.

Copilot removes the friction. A staff member who types "summarise what we pay our sales team" gets an answer drawn from everything they can open, wherever it sits. The permissions have not changed. What has changed is how easy it is to use them.

Where oversharing usually hides

In most Microsoft 365 tenants, oversharing turns up in the same few places:

• Sites shared with "Everyone except external users". One setting that opens a site to every internal account in the tenant.
• Organisation-wide sharing links. Links that work for anyone in the company, often created years ago and still live.
• Public Teams. Any employee can join a public Team and see its files, including the ones that were meant for the project group only.
• Ownerless and inactive sites. When the person who created a site leaves, nobody is left to decide who should still have access.
• Loose default settings. Microsoft notes that SharePoint uses the most permissive sharing option by default, so tenants that never adjusted it tend to have the widest exposure.

What Microsoft gives you to find it

Microsoft's own guidance for getting ready for Copilot centres on SharePoint governance tools. Depending on your licences, these include:

• Data access governance reports, including a site permissions baseline, permissions per user, a report on content shared with "Everyone except external users", and sharing link activity.
• A content management assessment that surfaces overshared content and inactive or ownerless sites, with recommendations. Microsoft suggests running it again every 30 days.
• Site ownership and inactive site policies, which make sure every site has someone accountable for it.
• Restricted Access Control, which limits a site to a named group even if others previously had access.
• Restricted Content Discovery, which keeps high-risk sites out of Copilot and organisation-wide search without changing who can open them. It is a useful stopgap while a proper cleanup is under way.

Which of these you can use depends on your Microsoft 365 plan and add-ons. We confirm what is available in your tenant during the readiness check rather than assuming.

A readiness checklist before Copilot switches on

1. Find out who can see what. Run the permissions and sharing reports, and list the sites and Teams open to the whole organisation.
2. Fix the widest exposure first. Start with sensitive areas such as HR, payroll, finance, legal and board material that are shared company-wide.
3. Give every site an owner. Archive or close inactive sites rather than leaving them open and forgotten.
4. Tighten the sharing defaults. Make new links and new sites less permissive from now on, so the problem does not grow back.
5. Label the files that matter. Apply sensitivity labels to confidential content and add data loss prevention rules where they fit.
6. Keep high-risk sites out of Copilot results while the cleanup finishes, using Restricted Content Discovery where it is available.
7. Pilot with a small group. Give licences and role-based training to a handful of users and watch what Copilot returns for them.
8. Review and repeat. Check usage and seat counts, rerun the assessment regularly, and extend licences once the pilot works.

Why a pilot beats a company-wide switch-on

A pilot group is the cheapest way to find what the reports missed. Pilot users ask real questions about their real work, and any answer that surfaces something it should not is a permission to fix before the rest of the company arrives. It also shows whether Copilot is worth the licence for each role, so you buy seats for the people who will use them rather than for everyone at once.

Training belongs in the pilot, not after it. People who know how to ask good questions get better results, and they are also the first to notice when a result looks wrong.

What Copilot does and does not do with your data

Two points from Microsoft's documentation are worth keeping in view. First, Copilot only surfaces organisational content that the individual user already has at least view permission to access. Second, Microsoft states that prompts, responses and data accessed through Microsoft Graph are not used to train its foundation models.

That is why the work sits with permissions. Copilot respects the access you have granted. The question is whether that access is what you intended.

Microsoft Copilot, formerly Microsoft 365 Copilot, is available as an add-on to eligible Microsoft 365 and Office 365 business and enterprise plans, and the business plan is aimed at organisations with up to 300 users.

Frequently asked questions

Does Microsoft Copilot give staff access to files they could not open before?

No. Copilot works within each user's existing permissions. It can, however, make content they already had access to much easier to find, which is why overshared sites become visible once Copilot is switched on.

Is it safe to switch Copilot on for the whole company at once?

It can be, if permissions are already tight. For most organisations a readiness review followed by a pilot group is the safer route, because it finds overshared content before everyone can query it.

Do we need sensitivity labels before using Copilot?

Labels are not required to use Copilot, but they help. Labelling confidential files and pairing them with data loss prevention rules adds a layer of protection that does not depend on every sharing decision having been right.

How long does an oversharing review take?

It depends on the number of sites, Teams and years of sharing in the tenant. The reports give a clear picture quickly; the cleanup takes longer, which is why we start with the most sensitive areas and use temporary restrictions while the rest is fixed.

Can we buy Microsoft Copilot licences in pesos?

Yes. We supply Microsoft Copilot licences through our Microsoft CSP agreement, billed in Philippine pesos with official receipts.

Where to start

Onprem2Cloud IT Solutions Co. is a Microsoft CSP partner based in Muntinlupa City, Metro Manila. We supply Microsoft Copilot licences and prepare tenants for them: readiness checks, an oversharing review, sensitivity labels and data loss prevention, a pilot with role-based training, and regular usage and seat reviews.

See our Microsoft Copilot service, or contact us to plan a readiness check. If you want a broader view of your tenant first, read our guide to Microsoft 365 security posture assessments.