Tools
Microsoft 365 Copilot: what to fix before you turn it on
Copilot inherits every permission mistake in your tenant and makes it searchable. The oversharing problem, and the work that has to happen first.
Microsoft
Copilot does not grant access. It reveals it
Copilot respects existing permissions. Everything it surfaces to a user is something that user could already have opened. This is stated correctly by Microsoft and it is the source of most of the trouble, because it is heard as reassurance.
What changes is discoverability. A salary spreadsheet in a SharePoint site shared with Everyone Except External Users has technically been readable by the whole organisation for years. Nobody found it because nobody searched for it. Copilot searches for it, in natural language, on behalf of anyone who asks a related question.
The work that has to happen first
Find the oversharing
SharePoint sites shared organisation-wide, files with anyone links, and the Everyone Except External Users group used as a convenience. This is the single biggest source of Copilot surprises.
Deal with stale sites and abandoned Teams
Content from projects that ended years ago, still permissioned to whoever was involved and forgotten. It is now in scope for every prompt.
Apply sensitivity labels where they matter
Labels with encryption keep content out of Copilot responses for users who lack rights. Labelling everything is not the goal, labelling the material that must not surface is.
Turn on Purview DSPM for AI before the rollout
It reports on what Copilot is actually surfacing and which sensitive material is being touched. Deploying without it means you find out from a user rather than a dashboard.
Where the readiness effort actually goes
Our view of the proportions on a typical readiness project.
- Permission and oversharing cleanup45
- Lifecycle for stale content22
- Labelling and DLP20
- Copilot configuration itself13
An argument about proportions, not measured data.
The verdict
Run a permissions and oversharing assessment before buying licences
The readiness work is almost entirely SharePoint governance, it takes months, and licences bought before it is done sit unused or cause incidents.
Do not run a broad pilot as a way of finding the oversharing. You will find it, and so will the pilot users, and that conversation is much harder afterwards.
Disclosure. Some links on this site are affiliate links. Scoring weights are published before any programme is joined, and commission is never a ranking input. Full policy, and the method behind this guide.