The short answer
Microsoft 365 Copilot works inside each person's existing permissions. It does not grant new access, but it makes everything a person can already open easy to find, including files shared far too widely years ago. So readiness starts with oversharing: find the sites, groups and links that expose sensitive content, fix them with their owners, and hold back sites that are not yet clean. Then pilot with a small group, train them on real work and measure adoption before you extend licenses.
A note on names: Microsoft has renamed Microsoft 365 Copilot to Microsoft Copilot (and Copilot Chat likewise), and says some screens and licenses will keep the old names during the transition (Microsoft Learn). We use the familiar name here.
Why oversharing becomes a Copilot problem
Microsoft states that Copilot only surfaces organizational data that the individual user has at least view permission for, and that prompts, responses and data accessed through Microsoft Graph are not used to train the foundation models (Microsoft Learn). The risk is not the model; it is your sharing history. The usual patterns:
- Sites and teams open to the whole organization, often through the built-in "Everyone except external users" group.
- Broad groups, such as all-staff lists, given access to libraries holding HR, finance or board material.
- Organization-wide and "Anyone" links created for a one-off need and never removed.
- Sites with no current owner, so nobody reviews who has access.
Before Copilot, an overshared file was protected by obscurity: you had to know it existed. With Copilot, a plain question such as "what are we paying the new managers?" can surface it.
How to find oversharing
- Data access governance reports. In the SharePoint admin center, these show the sites with the broadest permissions, files with sensitivity labels, and recent sharing-link and "Everyone except external users" activity (Microsoft Learn). Microsoft suggests permission snapshots quarterly and activity reports monthly.
- Site access reviews. These send findings to site owners, who see which items are overexposed and fix them (Microsoft Learn). Owners, not IT, know what their content is. Reviews currently cover SharePoint sites, not OneDrive.
- Your content owners. HR, finance, legal and leadership know where the files that must never be broadly visible live.
- A test as an ordinary user. Before licensing anyone, search with a typical account for words like salary, termination, board or acquisition, and see what comes back.
These reports belong to SharePoint Advanced Management, which Microsoft's Copilot deployment blueprint says is included with the Microsoft Copilot license (Microsoft Learn).
How to fix it
| Problem | Fix | Microsoft feature |
|---|---|---|
| No owner, or the owner has left | Assign at least two current owners | Site ownership policy |
| "Everyone except external users" or all-staff groups on sensitive sites | Replace with specific groups the owner approves | Site access review |
| Old organization-wide and "Anyone" links | Remove stale links, make "Anyone" links expire, set a narrower default link | Sharing settings |
| A sensitive site must stay limited to one group | Restrict the site to that group | Restricted access control |
| Sites still being cleaned up | Hide them from Copilot and organization-wide search for now | Restricted Content Discovery |
| Highly sensitive files | Classify and encrypt; Copilot respects the user's usage rights | Sensitivity labels in Microsoft Purview |
| Labeled content Copilot should not use, or sensitive data typed into prompts | Block processing by policy (some options are in preview) | Data loss prevention for Copilot |
Two cautions. Restricted Content Discovery does not change permissions: anyone who can open a file still can, so it buys time rather than fixing anything, and Microsoft warns that overusing it makes Copilot's answers less complete. And which Purview features you can use depends on your licenses, so check Microsoft's licensing guidance for your plan rather than assuming.
Design a pilot that answers a question
- Pick the right people. Roles that draft, summarize, search and sit in many meetings, across several teams, including one or two doubters. Not only IT.
- Clean their world first. Remediate the sites and teams pilot users can reach before they get licenses.
- Agree scenarios and measures up front. A few tasks per role, such as summarizing a long email thread, drafting a proposal from past documents, turning meeting notes into actions or analyzing a spreadsheet.
- Decide on web search. Copilot can send generated search queries to Bing (Microsoft Learn). Decide whether that suits you; a DLP rule can block web search when prompts contain sensitive information.
- Update your AI use policy so users check outputs before sharing them. Our guide to writing an AI acceptable use policy can help.
- Brief your privacy or compliance lead. State privacy laws, HIPAA and other sector rules still apply to personal information Copilot can reach; if it will touch protected health information, confirm how Microsoft's business associate agreement applies first (see AI and HIPAA). Core Microsoft 365 data for US tenants is usually stored in Microsoft's United States datacenter geography, depending on the service and tenant setup. Microsoft says Copilot is covered by the data residency commitments in its Product Terms, and that customers outside the EU may have queries processed in the US, the EU or other regions (Microsoft Learn). Document it. This is general information, not legal advice.
- Set an end date and a decision. Extend, adjust or stop.
Train on real work, then measure
Generic videos rarely change habits. Short, role-based sessions using each person's own documents and meetings do. Cover what Copilot does well, what it gets wrong and how to check an answer; Microsoft itself tells users to review outputs before sending them to others. Name champions in each team, keep a shared library of prompts that worked and hold drop-in sessions in the first weeks.
Make one message clear: if Copilot shows someone a file they should not see, that is an oversharing finding to report, not a reason to stop.
To measure adoption and value:
- The Microsoft Copilot usage report in the Microsoft 365 admin center shows enabled users, active users and adoption by app (Microsoft Learn).
- The Copilot Dashboard in Viva Insights groups metrics under readiness, adoption, impact and sentiment (Microsoft Learn).
- Your own measures matter most: a short survey before and after, time on the chosen tasks, quality checks, and one closing question: would you keep the license?
Usage is not value. Extend licenses role by role where the evidence supports it.
Rather talk it through? If you are planning Copilot, or your rollout has stalled, we can review your tenant's sharing and tell you what to fix before more licenses go out. Talk to a Promatics specialist
What usually goes wrong
- Licenses first, clean-up later. One awkward discovery can set adoption back badly.
- Hiding everything. So many sites are restricted that Copilot has little useful to work with.
- Sharing drifts back. Nobody reruns the reports, and new organization-wide links appear.
When to bring in help
A small tenant with a few well-owned sites and a capable administrator can follow Microsoft's guidance and do this in-house.
Bring in help when SharePoint and Teams have grown for years without a permissions model, when many sites have no owner, when HR, finance, health or client data is involved, or when leadership wants evidence before buying more licenses. Our Microsoft 365 Copilot service runs the readiness review, fixes oversharing with your content owners, applies labels and data loss prevention where your licenses include them, and runs the pilot, training and adoption reporting. Because we also manage Microsoft 365 for clients, the controls stay in place as people, sites and teams change.
Sources and further reading
Product capabilities and guidance change. These are the primary sources this article relies on, checked on the review date above.
- Data, privacy and security for Microsoft Copilot, Microsoft Learn
- Data access governance reports for SharePoint sites, Microsoft Learn
- Initiate site access reviews for data access governance reports, Microsoft Learn
- Restrict discovery of SharePoint sites and content, Microsoft Learn
- Microsoft Purview DLP for Microsoft 365 Copilot and Cowork, Microsoft Learn
This article is general information, not legal, accounting or security advice for your specific situation. Examples are hypothetical unless stated otherwise.