AskKhamsay.
← Blog

Before You Turn On Copilot, Clean Up Who Can See What in SharePoint

· Khamsay Phimmasanh-Baig, AskKhamsay

Copilot doesn't change who can see your files. It changes how easy those files are to find.

If you're thinking about Copilot for your organization, you've probably asked a few questions already. Is it worth the cost? Will people use it? Is our data safe?

That last one is the right place to start. The answer depends less on Copilot and more on something you already have: your SharePoint and OneDrive permissions.

I've worked in IT since 1998 and with SharePoint since 2008, and the same pattern keeps showing up. Files get shared "just to be quick." Sites get created and forgotten. Someone picks "everyone" because it was easier than working out who actually needed access. None of that felt urgent when finding a file meant knowing where to look. Copilot changes that.

How Copilot decides what it can show

Here's the key point, in Microsoft's own words: Copilot "only surfaces organizational data to which individual users have at least view permissions." (Microsoft Learn: Data, Privacy, and Security for Microsoft Copilot)

That's good news. Copilot doesn't get around your permissions. It also means Copilot is only as careful as your permissions are. Here's a made-up example: a salary spreadsheet sits in a folder that "Everyone except external users" can open. A staff member who never knew the file existed could now come across it just by asking Copilot a question.

Copilot didn't create the problem. It makes an old one much easier to stumble into.

(A quick note on names: Microsoft has renamed Microsoft 365 Copilot to "Microsoft Copilot," so you may see both names in admin screens and documentation for a while.)

Why this matters more for small and mid-sized organizations

Large enterprises often have dedicated governance teams. Smaller organizations usually have one busy person, sometimes an office manager who became "the IT person" by accident. Permissions grow over time, and nobody steps back to look at the whole picture.

You don't need an enterprise-sized project to get this under control. Microsoft has published a deployment blueprint for this situation. It recommends finding overshared content, putting temporary protections in place where needed, fixing access, and then setting guardrails so the problem doesn't come back (Microsoft Learn: Secure & Governed Data Foundation for Microsoft Copilot).

Below is how I'd approach it in plain terms. One note before you start: which tools and settings you see depends on your licenses, your tenant settings, and your permissions. Some of the steps below need someone with SharePoint admin rights. If that isn't you, bring that person in early.

Step 1: Make a short list of what would hurt if it got out

Before you open a single admin screen, sit down with a notepad and list the kinds of information that would cause real trouble if the wrong person saw them. For most organizations, that list includes:

Then write down where each one actually lives: which SharePoint site, which Teams team, which person's OneDrive. This list becomes your priority order. You don't have to fix everything at once. Start with what matters most.

Step 2: Look for the "everyone" doors

Most oversharing comes from a few habits:

For each sensitive location on your list, open the site or folder, check Manage access, and look at who has access and which links exist. If anything says "Everyone," "People in your organization," or "Anyone," ask whether that's really what you meant.

Step 3: Use the reports you may already have

Once at least one person in your organization has a Microsoft Copilot license, Microsoft says your SharePoint admins get access to the SharePoint Advanced Management (SAM) features that support a Copilot rollout (Microsoft Learn: Prerequisites for SharePoint Advanced Management). SAM can do a lot of the searching for you. According to Microsoft's guidance, its assessments and reports can flag sites with oversized audiences, EEEU usage, broken inheritance, inappropriate sharing, and sites that are inactive or have no owner (Microsoft Learn: Configure a secure and governed foundation for Microsoft Copilot).

SAM also includes site access reviews, which ask site owners to confirm who should and shouldn't have access. This matters because the people who own the content usually know better than IT who needs it.

If your licenses include Microsoft Purview Data Security Posture Management (DSPM), its data risk assessments can help you spot overshared sites that contain sensitive information.

You don't need every tool. Use what your licenses include, and fill in the gaps with the manual check from Step 2.

Step 4: Put a temporary lock on the riskiest sites

Sometimes you'll find a site that needs real cleanup, and that cleanup will take a few weeks. You don't have to hold up your whole Copilot rollout while you wait.

Microsoft's guidance describes Restricted Content Discovery, a SharePoint Advanced Management setting that keeps content from a specific SharePoint site out of organization-wide search and Copilot discovery while you review it (Microsoft Learn: Restrict discovery of SharePoint sites and content). Microsoft describes it as a way to block an overshared site quickly, often as a temporary measure for high-risk content (Microsoft Tech Community: Mitigate Oversharing to Govern Microsoft 365 Copilot and Agents).

Think of it as a bandage, not a cure. It works on SharePoint sites, not OneDrive, and it doesn't change permissions. People who already have access can still open the files directly. The goal is to buy time to fix the access underneath.

Step 5: Fix the access, then name an owner

This is where the real work happens. For each high-priority site:

  1. Remove what isn't needed. Take out company-wide groups and people who no longer need access.
  2. Rescope or delete broad links. Replace "Anyone" and "People in your organization" links with links for specific people, or remove them.
  3. Reset broken inheritance where custom permissions no longer make sense.
  4. Make sensitive Teams and sites private.
  5. Confirm an owner. Every site should have at least one active person who's responsible for it. Ownerless sites are where oversharing hides.

When you're done, remove any temporary Restricted Content Discovery settings so Copilot can use that content again for the people who are supposed to see it.

Step 6: Keep it from creeping back

Cleanup is a one-time project. Staying clean is a habit. A few settings and routines help:

Start small, then roll out

Microsoft's blueprint describes an optional pilot phase. You give Copilot to a smaller group and focus on popular, lower-risk sites first, then expand (Microsoft Tech Community). For a smaller organization, that might simply mean starting with a few people who are curious about Copilot and willing to speak up when something unexpected turns up.

That feedback is worth a lot. If a pilot user says, "Copilot just showed me something I don't think I should see," you've found a permissions problem before it reached the whole company.

One more habit for your pilot group: Copilot drafts, people decide. Follow your organization's rules for AI use, keep sensitive details out of prompts unless your setup is approved for them, and check what Copilot gives back before anyone relies on it.

The bottom line

Copilot can save your team real time, but it works with whatever access you've already given people. A little time on permissions first is what makes the rollout feel safe instead of stressful. And the payoff isn't only about Copilot. A cleaner SharePoint is easier to search, easier to manage, and easier to trust.