SharePoint permissions and Copilot: tidy them up first
Microsoft 365 Copilot is good at finding things. That is the point of it. But it finds them using the permissions people already have, so any file someone can technically open, Copilot can surface in an answer. If your SharePoint is a decade of “share with everyone” decisions, you may be about to find out.
How Copilot sees your data
Copilot does not bypass security. It respects the same access rights a person has in Microsoft 365. Ask it for “the latest salary review” and, if you happen to have access to that file, it may find it, even though you never knew it was there.
Until now, a badly shared folder was hidden by obscurity. Nobody found it because nobody searched. AI search removes that cover. This is often called “oversharing”.
Typical problems
- “Everyone except external users” access. A broad group that lets any member of staff open a site or file
- Links set to “Anyone” or “People in your organisation”. They are easy to create and rarely reviewed
- Old project sites. Teams and sites nobody owns, still full of sensitive documents
- Broken inheritance. Individual files given unique permissions, so nobody can see the full picture
- Guests who never left. External users with continuing access long after a project ended
- Personal OneDrive sharing. Files shared from OneDrive that never moved into a managed place
A practical clean-up
You do not need to fix everything before you switch Copilot on. Prioritise.
1. Decide what matters most
List the content that would cause real harm if it was seen by the wrong person: HR, finance, board papers, legal, customer data. Make that your first target.
2. Find the sites and links
Microsoft provides tools in SharePoint and Microsoft Purview that report on sharing, sensitive content and site activity. Some deeper controls, such as SharePoint Advanced Management, come with certain licences, including Copilot licences. Check what your plan includes. confirm current Microsoft licensing for SharePoint Advanced Management and data access governance reports before publishing
3. Give every site an owner
Each site or team needs at least two named owners who are responsible for who has access. If no one owns it, archive it or delete it.
4. Use groups, not individuals
Manage access through Microsoft 365 groups or security groups. Add people to the group, not to each file. It is easier to review and easier to remove people when they leave.
5. Reduce broad sharing
Switch default sharing links from “Anyone” to “Specific people”. Remove “Everyone except external users” from sensitive sites. Set expiry dates on guest access.
6. Label sensitive content
Sensitivity labels let you mark documents as confidential and apply protections that travel with the file. They also help Copilot and your data-loss rules treat those files appropriately.
7. Review regularly
Access drifts. Schedule a regular review, such as every quarter, and tie it to your joiners-and-leavers process.
Roll out in stages
A sensible approach is to start with a small pilot group, on tidied sites, before widening. Ask the group to report anything they see that surprises them. Surprises are the clean-up list.
Link with your AI policy
Permissions are one half of the picture; the other is what people do with AI. If you have not already, read our piece on shadow AI and write a short policy people can follow. More practical guides are collected under cyber security services.
We can help
Permissions tidy-ups are tedious, but they are among the most valuable security jobs you can do, with or without Copilot. They also line up with the access-control requirements in Cyber Essentials. Our team can review your set-up and help you make the changes safely, as part of our managed IT services.
Talk to us about managed IT if you would like a review before you roll out Copilot.
