Microsoft 365 Copilot does not create new access to your data. It uses the access people already have. That is reassuring until you remember how many files in a typical business are shared far more widely than anyone intended. This guide explains how to find and fix that oversharing before Copilot finds it for you.
The short answer
Copilot shows each person what they can already open. If the payroll spreadsheet or the board papers are shared with everyone, Copilot will happily use them in an answer. Fix the sharing first, label what is confidential, then roll Copilot out to a small group before everyone.
Why Copilot makes oversharing visible
Microsoft states that Copilot only surfaces organisational data that individual users have at least view permission to, and that it honours the access rights on files protected by sensitivity labels. So Copilot does not leak anything a person could not already open.
The difference is discovery. Before Copilot, an overshared file sat quietly in a folder nobody looked in. With Copilot, anyone who asks the right question can get its contents summarised in seconds.
Where oversharing hides
- SharePoint sites and Teams shared with everyone in the organisation.
- Sharing links that anyone with the link can open, created years ago and never expired.
- Old project and department sites that nobody owns any more.
- OneDrive files left behind by people who have left.
- Guests who still have access to Teams and sites after the work finished.
- Confidential files with no sensitivity label.
How to find it
If your organisation has at least one Microsoft 365 Copilot licence, SharePoint administrators get SharePoint Advanced Management features designed for this. They include data access governance reports on sharing links, sites shared with everyone except external users and permission states, site access reviews, and restricted content discovery, which keeps chosen sites out of Copilot and organisation wide search while you fix them.
Microsoft Purview adds the other half: finding where sensitive information sits and labelling it, so the most important files are protected whoever can reach them. See what Microsoft Purview is.
A clean up plan that works
- Run the sharing reports and list the sites and links that are open to everyone.
- Fix the highest risk first: HR, finance, board and client sites.
- Expire or tighten old links that anyone can open.
- Give every site an owner who confirms who should have access.
- Label confidential information, starting with the folders the reports flagged.
- Turn on Copilot for a pilot group, watch what it surfaces and keep tidying before a wider rollout.
We do this work before every Copilot rollout. See AI security and Microsoft 365 Copilot, or call us on 1300 787 429.
Copilot oversharing questions
Does Copilot change who can see our files?
No. Copilot only surfaces information a person already has at least view permission to. What changes is how easy it becomes to find. A file nobody would have stumbled across can now turn up in an answer.
What is oversharing?
Files, sites and folders shared with more people than need them, usually by accident and usually years ago. Common causes are sites open to everyone in the organisation, links that anyone can open, and project sites nobody tidied up.
Do we need extra licences to find oversharing?
If you have at least one Microsoft 365 Copilot licence, SharePoint admins get SharePoint Advanced Management features that help, including data access governance reports and restricted content discovery. Some reports need E5.
Should we wait to roll out Copilot until everything is tidy?
No. Fix the obvious risks first, such as sites shared with everyone and links anyone can open, then pilot Copilot with a small group while the rest of the clean up continues. See Microsoft 365 Copilot.
Sources
- Microsoft Learn, Data, privacy and security for Microsoft 365 Copilot.
- Microsoft Learn, SharePoint Advanced Management features included with Microsoft 365 Copilot licences.
