Copilot can see everything your staff can see

If your company is about to roll out an AI assistant on Microsoft 365, check who can open what first. The assistant does not add access. It makes the access you already granted far easier to use.

The surprise in week one

A common story goes like this. A new hire asks a plain question, such as how bonuses work, and the answer quotes a spreadsheet nobody meant to share.

Nothing was hacked. Microsoft says Microsoft 365 Copilot only surfaces data a person already has at least view permission to. The file was always open to that person. They just never would have found it.

Why old permissions turn into new risk

Permissions in Microsoft 365 build up over the years.

• A folder shared with “Everyone except external users” for one project stays shared.
• A link created for a vendor is never removed.
• A team site is set to open for convenience, then grows into a place for sensitive files.
• People change roles and keep the access from their old job.

Before an assistant, this mostly did not matter. Search buried those files. An assistant reads them, summarizes them, and puts them in an answer.

Microsoft’s own guidance says that content shared with broad groups like Everyone becomes part of what Copilot can draw on for any licensed user.

Where to look first

Start with the files that would hurt most if the wrong person saw them.

• HR: pay, reviews, discipline, terminations
• Finance: bank details, forecasts, audit files
• Legal: contracts, disputes, advice
• Anything with customer or patient information

For each, ask two questions. Who can open it today? Should they be able to?

A simple check

Use a test account with ordinary staff permissions, and get leadership approval before you do this. Search for terms like salary, termination, and confidential. Note what comes back.

You are not looking for a perfect result. You are looking for anything that would make you uncomfortable if a new employee found it on their first day.

The tools that help

Microsoft provides reports that show where access is broad. SharePoint Advanced Management includes data access governance reports, including a site permissions report that gives a snapshot of who can reach what. Check what your licenses include, since these features depend on your plan.

Sensitivity labels, through Microsoft Purview, let you mark content as confidential and control how it is shared. Some label settings can also keep an assistant from reading a file.

What done looks like

A permissions review is finished when:

• Sensitive libraries are identified and labeled.
• Access matches job roles, not whoever happened to be added.
• “Everyone” sharing is removed, or someone has written down why it stays.
• Someone owns a regular review, so it does not drift back.

This work does not slow anyone down. It closes doors that should never have been open.

Where this shows up in the assessment

It is sub-score 1.4, security and access control, in the Information & Data Foundation pillar. Most organizations find at least a few surprises the first time they look.

If you want to know where you stand, see how the assessment grades it.

Sources

• Get ready for Microsoft Copilot with SharePoint Advanced Management (Microsoft Learn)
• Microsoft 365 Copilot best practices with SharePoint (Microsoft Learn)
• Mitigate oversharing to govern Microsoft 365 Copilot and agents (Microsoft Community Hub)