Microsoft 365 Copilot readiness: the permissions problem nobody mentions

Microsoft 365 Copilot does not have its own permission model. It inherits yours. Everything a user could already find through search, Copilot can surface, summarise and quote — instantly, and without the friction that kept it buried.

For most organisations that is the entire risk, and it has nothing to do with AI.

Why permissions have drifted

SharePoint and OneDrive make sharing easy, which is the point. Over a decade the result is predictable: sites shared with "everyone in the organisation" for a project that ended years ago, files inheriting permissions nobody reviewed, and links passed around that never expired.

None of that hurt while finding a document required knowing it existed. Copilot removes that requirement. A question like "what are we paying our senior engineers" now returns an answer if a spreadsheet was ever shared too widely.

A pre-rollout checklist

1. 01Run a sharing report across SharePoint and OneDrive and list every site shared organisation-wide.
2. 02Identify sites holding HR, finance, legal or client-confidential material and confirm their membership explicitly.
3. 03Expire or revoke anonymous sharing links; set a default expiry for new ones.
4. 04Turn on sensitivity labels for the categories that matter most, and apply them to the highest-risk sites first.
5. 05Check that departed staff have actually lost access, rather than merely being disabled.
6. 06Pilot with one department and ask them to try to surface something they should not see.

That last step is the one people skip and the one that finds problems. Give a small group an afternoon and an incentive to break it.

What good looks like afterwards

Sensitivity labels applied where they matter. Sharing links with expiry by default. A quarterly review of organisation-wide sites with a named owner. And, importantly, a rollout that continues — the goal is not to delay Copilot but to deploy it without discovering your permission history in public.

How long it takes

For an organisation of a hundred people with a decade of SharePoint behind it, four to six weeks of part-time work. Considerably less if sharing was governed from the start, and considerably more if the tenancy has been through a merger.