A new starter asks Copilot to "summarise what we pay our senior staff" as a joke. Copilot answers, with names. Nobody hacked anything. The salary spreadsheet sat in a SharePoint site that someone shared with the whole company in 2019, and nobody noticed because nobody went looking.
That's the oversharing problem in one scene. Microsoft 365 Copilot (which Microsoft has renamed Microsoft Copilot) only shows people content they already have at least view access to. Microsoft is clear on that point. The catch is that most organisations have granted far more access over the years than they realise, and search was never good enough to expose it. Copilot is.
The good news: the tools to find and fix it are already in your tenant, and some of them come with your Copilot licences.
Why Copilot finds what search didn't
Copilot reads through Microsoft Graph, which covers email, OneDrive, SharePoint, Teams chats and meetings. It respects permissions exactly. What it doesn't do is respect obscurity. A file buried four folders deep in a site nobody visits is, as far as Copilot is concerned, just as available as the one on your desktop.
The usual causes of oversharing are boring:
- Sites or libraries shared with "Everyone except external users", a built-in SharePoint group that includes every internal account.
- Sharing links of the "People in your organization" type, created because it was the default and it was quick.
- Teams and Microsoft 365 groups set to public, so anyone in the organisation can join and read the files.
- Old project sites nobody owns any more, with permissions nobody has looked at since they were made.
Step 1: find the overshared sites
Start with the data access governance reports in the SharePoint admin centre (under Reports). Microsoft splits them into two kinds.
The snapshot reports show where things stand today. The site permissions report ranks sites by how widely they're shared, including sites open to thousands of users, guests or "Everyone except external users". There's also a report on the sites and files shared through those special everyone groups, which lists the exact items and how access was granted, and a report of the sites holding files with particular sensitivity labels.
The activity reports cover the last 28 days: the sites where people created the most sharing links, and the sites where content was recently shared with everyone. Microsoft suggests running the snapshot reports quarterly and the activity reports monthly, which is a sensible rhythm.
Step 2: fix what you can, delegate the rest
IT can't judge every folder. The finance team knows whether the finance site should be open to all staff. So split the work:
- Remove "Everyone except external users" from sites and libraries that don't need it. Most intranet home pages do; most department sites don't.
- Change the default sharing link type to "Specific people", at the organisation level or site by site, so new links are narrow by default.
- Set Teams that hold sensitive work to private, and review who's in them.
- Use site access reviews to send the overshared sites to their owners. They get a list and a request to confirm or trim access, and you get a record that it was done.
- For a site that needs locking down now, restricted access control limits it to members of a chosen group, whatever the file-level permissions say.
Step 3: buy time with Restricted Content Discovery
Cleaning up permissions across a whole tenant takes weeks. Restricted Content Discovery lets you start the Copilot rollout without waiting for all of it. You turn it on per site (in the SharePoint admin centre, Active sites, Settings, "Restrict content from Microsoft Copilot"). The site's content then stops appearing in organisation-wide search and Copilot answers, and the Copilot buttons and AI menus disappear from that site.
Be clear about what it isn't. Microsoft says it doesn't change permissions: anyone who already had access can still open the files directly. It only works on SharePoint sites, not OneDrive. And Microsoft describes it as a temporary control while you right-size access, not a permanent fix. Use it on the handful of sites that worry you most (HR, finance, the board), not on everything, or Copilot becomes much less useful.
Step 4: label what matters most
Permissions answer "who can open this". Sensitivity labels in Microsoft Purview add "and what can they do with it". Microsoft says that when content is encrypted by a label, Copilot honours the usage rights the label gives each person. A label that encrypts board papers for the executive group keeps them out of everyone else's Copilot answers, even if the file ends up somewhere it shouldn't.
Start small. Four or five labels, applied first to the documents that would hurt most if they got out, is better than a scheme of twenty that nobody uses. Purview's Data Security Posture Management can then show you AI activity touching sensitive data, if your licences include it.
What licences do you need?
Less than people expect. Microsoft's documentation says your SharePoint admins get the SharePoint Advanced Management features that support a Copilot rollout as soon as at least one user in the organisation has a Copilot licence. That includes the data access governance reports, site access reviews, restricted access control and Restricted Content Discovery. Some other features need the separate SharePoint Advanced Management Plan 1 add-on. Without Advanced Management at all, you can still run some activity reports once you switch on data collection. Purview features vary more by plan, so check yours before you design around them.
A sensible order of work
- Run the site permissions report and the everyone-groups report.
- Put Restricted Content Discovery on the few sites that alarm you.
- Fix the "Everyone except external users" grants and the default link type.
- Send the rest to site owners through site access reviews.
- Roll out labels for your most sensitive material.
- Start Copilot with a pilot group, and widen it as the reports come back clean.
This is also the best defence against attacks like EchoLeak, where a hostile email tries to talk Copilot into leaking what the user can see. The less each person can see, the less there is to leak. If you're still deciding whether to start, is your business ready for AI? covers the questions to ask first.
Where Geidi fits
Geidi AI offers practical AI and automation, built safely on the Microsoft 365 environments, infrastructure and security Geidi already manages, and its work includes SharePoint build and governance. If you want your permissions sorted before Copilot goes live, get in touch.
Sources
- Microsoft Learn: Data, privacy and security for Microsoft Copilot (opens in a new tab)
- Microsoft Learn: Data access governance reports for SharePoint sites (opens in a new tab)
- Microsoft Learn: Restrict discovery of SharePoint sites and content (opens in a new tab)
- Microsoft Learn: Initiate site access reviews for data access governance reports (opens in a new tab)
- Microsoft Learn: Prerequisites for SharePoint Advanced Management (opens in a new tab)
- Microsoft Learn: SharePoint Advanced Management features included with Microsoft Copilot licences (opens in a new tab)
- Microsoft Learn: Change the default link type for a site (opens in a new tab)
- Microsoft Learn: Privacy and protections for Microsoft Copilot Chat (opens in a new tab)
- Microsoft Learn: Learn about Data Security Posture Management (opens in a new tab)
