Resources — Hub 4: Governance & security
What Copilot can actually see in your files
Oversharing is a permissions problem that predates AI. Here's how to lock it down before rollout, not after.
5 min read
The most common security question about Copilot has a boring answer: it can see exactly what the person using it can already see. That's reassuring until you look closely at what your employees can already see. AI doesn't create an oversharing problem it makes an existing one instantly searchable.
01
Inherited permissions are the real exposure
Years of 'share with everyone in the organization' links, open team sites and inherited folder permissions mean the average tenant has far more broadly readable content than leadership assumes. Before AI, finding it required knowing it existed. Now a plain-English question surfaces it.
Try this
Run a sharing report on your top ten most active sites and look specifically for org-wide links on anything containing HR, finance or client contract material.
02
Classification beats blanket restriction
Locking everything down kills the value you paid for. Labeling the genuinely sensitive material and letting the rest stay findable is both safer and more useful, because the restriction is precise instead of reflexive.
Try this
Define three labels — public, internal, restricted and apply them to the containers that hold your most sensitive data first, not to individual files.
03
Know where the data goes
Prompts and responses inside your commercial tenant stay within your service boundary and aren't used to train foundation models. That distinction matters, and it's worth being able to state in one sentence to your board along with which consumer-grade AI tools your staff are pasting things into instead.
Try this
Write a one-page policy: which tools are approved, what data may never be pasted anywhere, and who reviews AI-drafted work before a client sees it.
What this actually means for you
Do the permissions work first. A four-week cleanup before rollout costs a fraction of what it costs to discover the salary spreadsheet through a chat window in week two and it turns your security posture from an objection into part of the pitch.
Sources: Microsoft Purview and Microsoft 365 Copilot data protection documentation (2026).
Copilot sitting mostly unused?
That's exactly what a licensing and AI-readiness assessment is for: what you actually have, where the real bottleneck is, and which one workflow is worth fixing first.
Book the assessment