Before you turn on Copilot, fix your sharing
An AI assistant sees everything the user can see. Your old oversharing becomes very easy to find.
Microsoft opened Copilot for Microsoft 365 to businesses of every size in January. Many companies are switching it on now. One thing to do first.
Copilot only shows a user what that user is already allowed to open. That sounds safe. The problem is what users are already allowed to open. The salary sheet shared with “everyone” in 2019. The HR folder with broken permissions. The board deck in a public Teams channel.
Before, nobody found those files. Now anyone can ask “what are my colleagues paid?” and the assistant goes looking.
Before turning it on:
- Find files shared with everyone or “anyone with the link”, starting with HR, finance and legal.
- Fix the big sites and groups where whole departments have access by default.
- Label sensitive documents so they’re protected wherever they move.
- Start with a small pilot group, and ask them to report anything surprising they see.
This is cleanup you needed anyway. The AI just made it urgent.