Microsoft 365 Copilot is an easy thing to say yes to. It summarises meetings, drafts emails and finds that document you half remember. But before you switch it on, there's one question worth asking: who can open what in your tenancy today?
Copilot doesn't create new access. It makes existing access much easier to use. If a payroll spreadsheet has quietly been shared with the whole company for three years, nobody may have stumbled across it. Once staff can ask an assistant a plain-English question, stumbling becomes a lot more likely.
This post is a defensive, practical checklist for tidying permissions first.
What Microsoft says Copilot can see
Microsoft is clear on this point. Its Copilot privacy documentation describes Copilot as coordinating large language models with "Content in Microsoft Graph, such as emails, chats, and documents that you have permission to access." It goes on:
- "Microsoft Copilot only surfaces organizational data to which individual users have at least view permissions."
- "It's important that you're using the permission models available in Microsoft 365 services, such as SharePoint, to help ensure the right users or groups have the right access to the right content within your organization."
- That "includes permissions you give to users outside your organization through inter-tenant collaboration solutions, such as shared channels in Microsoft Teams."
Microsoft's deployment guidance for securing Copilot says the same thing from the other side: Copilot works by "grounding responses in the data users already have permission to access", and the first step it lists is "remediating oversharing".
That's good news. Copilot isn't a back door. But it means your permissions are the main fence, so they need to be right.
Why oversharing becomes a Copilot problem
Most oversharing in small businesses isn't malicious. It builds up over years:
- Company-wide links. "People in the organization" links are convenient, so they get used for everything, including HR and finance files.
- "Anyone" links. Shared once with a supplier or client, never expired.
- "Everyone except external users". Added to a SharePoint site or folder to stop people asking for access.
- Teams guests and shared channels. Contractors and old clients who were added for a project and never removed.
- Inherited permissions. A folder created inside a broadly shared site picks up that site's access, whether or not that was intended.
- Leavers and role changes. Access that made sense for someone's old job, still sitting there.
Before Copilot, much of this was hidden by obscurity. With Copilot, a staff member asking "what were the salary changes last year?" may get a confident answer drawn from a file they were never meant to see. Microsoft's own data access governance reports page describes the issue as "sprawl and oversharing of SharePoint sites".
A Copilot readiness checklist for Australian SMEs
You don't need a huge project. You need a deliberate review, in roughly this order.
1. Know where your sensitive content lives
List the handful of places that hold the material that would hurt if widely seen: payroll, HR files, contracts, client financials, board papers, tax file numbers. Usually it's a few SharePoint sites, a couple of Teams and some OneDrive folders.
2. Review SharePoint site permissions
For each sensitive site, check who the members and visitors are, and look for "Everyone except external users" or very large groups. Break inheritance only where it's genuinely needed, and remove it where it's accidental.
3. Run Microsoft's oversharing reports, if you're licensed
Microsoft's data access governance reports "let you discover sites that contain potentially overshared or sensitive content." The sharing links reports identify "sites where users recently created the most sharing links (including "Anyone," "People in the organization," and "Specific people" links)", and there's a report for content shared with "Everyone except external users".
These reports are part of SharePoint Advanced Management. Microsoft notes that admins with Microsoft 365 E5 licensing can access the data access governance reports without the wider SharePoint Advanced Management feature set. Check your licensing before you plan around them.
4. Ask site owners to clean up their own sites
The site access review feature lets IT "delegate the process of reviewing data access governance reports to site owners of overshared sites", on the basis that "Site owners are best positioned to review and address oversharing issues for their own sites." In a small business that might be the office manager, the finance lead and the operations lead, each owning their own area.
5. Tidy OneDrive and sharing links
Look for old "Anyone" and "People in the organization" links on sensitive files and replace them with "Specific people" sharing. Set expiry on external links where your settings allow.
6. Check Teams membership, guests and shared channels
Remove guests from finished projects and review who's in shared channels. Remember Microsoft's note that cross-organisation access through shared channels counts as permission too.
7. Label your most sensitive content
Microsoft's sensitivity labels "let you classify and protect your organization's data", and Microsoft says "Copilot and agents recognize and integrate sensitivity labels into the user interactions to help keep labeled data protected." Start small: two or three labels (for example General, Confidential, Highly Confidential) applied to the sites from step 1.
8. Use a temporary guard rail while you finish
If the review will take a while, Microsoft offers two stop-gap controls:
- Restricted Content Discovery "helps you limit discovery of content from specific SharePoint sites ... in organization-wide search results and Microsoft Copilot responses while those reviews are taking place." Microsoft describes it as "a temporary governance control".
- Restricted SharePoint Search lets an administrator "decide which SharePoint sites appear in search results across your organization and Copilot chat or agentic experiences." With it on, "users can interact with files and content they own or previously accessed in Copilot." Microsoft frames this as a temporary measure too.
Neither replaces fixing permissions. They buy you time.
9. Roll out to a small group first
Start with a few staff whose access you've already reviewed, ask them to try the sort of questions that would expose a problem, and widen from there.
10. Make it a routine
Permissions drift again. Put a quarterly reminder in the calendar to rerun reports, review guests and check new sites.
What OrionX would build
For a 10–100 person business on Microsoft 365, this is the kit we'd put in place:
- Permission and sharing-link inventory. A Microsoft Graph script (or the data access governance reports, where you're licensed) that lists every SharePoint site, Team, guest and sharing link, and ranks them by how broadly they're shared: "Anyone" links, "People in the organization" links, "Everyone except external users" grants, broken inheritance.
- Sensitive-content map. Where payroll, HR, client and finance files actually live, and who can reach each location today.
- Copilot test-question pack. A saved set of risky questions ("salary changes", "termination", "bank details") run as pilot users before and after cleanup, so you can see what Copilot would surface rather than guess.
- Scripted, reversible cleanup. Remove org-wide grants, expire stale "Anyone" links, remove old guests, move sensitive folders to restricted sites, with every change logged so it can be rolled back.
- Guard rails while the work happens. Restricted Content Discovery or Restricted SharePoint Search on the riskiest sites, plus a starter set of sensitivity labels.
- Drift alerts. A scheduled job that flags new org-wide links, new guests and new broadly shared sites, and sends a quarterly review list to each site owner.
Where OrionX fits
Copilot readiness is less about AI and more about housekeeping in your Microsoft 365 tenancy: knowing what you have, who can see it, and setting it up so it stays tidy. That's the overlap between our cloud solutions and AI automation work.
Start with a free 20–30 minute chat about whether Copilot makes sense for your business and how your permissions look today. If it's a good fit, we'll follow up with one free demo tailored to your setup (one per business). No pressure, just a clear picture of what to do before you switch it on.
Sources
- Microsoft Learn, Data, privacy, and security for Microsoft 365 Copilot
- Microsoft Learn, Secure and govern Microsoft Copilot: foundational deployment guidance
- Microsoft Learn, Data access governance reports for SharePoint and OneDrive sites
- Microsoft Learn, Site access reviews for data access governance reports
- Microsoft Learn, Learn about sensitivity labels
- Microsoft Learn, Restrict discovery of SharePoint sites and content
- Microsoft Learn, Restricted SharePoint Search
