The One Question to Ask Before You Turn On Microsoft Copilot

Before you enable Microsoft Copilot in your business, there’s one question worth sending to whoever manages your Microsoft 365 environment: “Can you show me every file in our tenant that’s accessible to more than ten people?”

If they can produce that report within a few days, your environment has been actively managed and you’re in reasonable shape. If the answer is “we’d need to enable some things first,” that’s the real answer to your Copilot readiness question, and it means the audit needs to happen before any trial does.

How Copilot gets to your files

Copilot answers questions and drafts content by pulling from Microsoft Graph, the layer that connects everything in your Microsoft 365 tenant. When someone asks it a question, it retrieves from emails, calendar items, SharePoint documents, OneDrive files, Teams messages and meeting transcripts that the signed-in user already has permission to access.

Microsoft’s own documentation is clear on this point: Copilot can only summarise or reference content the user is authorised to access. That’s accurate, and it’s also exactly where the risk sits, because the real question is whether each person’s permissions still match what you assume they cover.

Why those permissions are usually broader than anyone thinks

For a tradie or manufacturer, most of what sits in a Microsoft 365 tenant is operational: production schedules, supplier contracts, project files. Some is sensitive, but the fallout is usually contained if the wrong staff member reads it. For a professional services firm, the files often are the business: client matters, fee arrangements, financial data. The confidentiality of that material is the whole model.

Either way, access tends to build up the same way. Someone gets added to a project folder, the project wraps up, and the access is never removed. Multiply that across years of staff changes, ad-hoc Teams channels and sharing links that never expired, and you end up with a permission environment nobody fully understands any more. If the permission exists, Copilot can use it. Whether it was ever meant to still exist isn’t part of the equation.

Microsoft now says as much directly. Its deployment guidance for Copilot rollouts is built around three pillars: fix oversharing, set up guardrails, then meet regulatory requirements. Oversharing comes first, because it’s the piece that has to be sorted before a rollout produces anything useful rather than something risky.

What Copilot can surface when permissions are broad

A few examples of what turns up when nobody’s audited access in a while. “What is everyone’s salary?” can return a compensation spreadsheet HR shared with a hiring manager over a year ago, still shared after that manager moved on. “Summarise the [client] case” can pull from a SharePoint site set up for a different team, where one leftover permission from a two-year-old project never got removed. “What deals are we working on?” can stitch together pipeline trackers in personal OneDrives, half-closed data rooms and a Teams channel that outgrew its original members, into one tidy commercial summary nobody meant to produce. “Find everything mentioning [former employee]” can bring back a termination memo and a performance review that were never meant to be findable outside HR.

None of these require a curious employee with bad intentions. They’re just what shows up when Copilot is asked a reasonable question against permissions that quietly drifted out of scope. We’ve seen the same pattern in tenants belonging to Northern Beaches firms who assumed their access model was tight simply because nobody had ever complained about it.

Why a small pilot isn’t as contained as it sounds

Running a limited pilot feels safe, but the way most businesses set them up tends to produce the highest-risk version of the trial. The handful of people picked for a pilot are usually senior, and senior staff have the broadest access in the business, so their searches carry the widest scope. A pilot with three managers is a riskier preview than a pilot with three junior staff. And once a Copilot summary has been returned to someone, it can’t be un-returned.

The cleanup worth doing before any trial

Four pieces of work make the difference between a genuinely useful test and an accidental disclosure. A SharePoint sharing audit flags sites shared more broadly than they should be. A OneDrive external share review catches files sent to clients years ago and never recalled. A Teams membership review checks that channel access still matches who should genuinely be there. And sensitivity labels through Microsoft Purview tell Microsoft 365 which content is confidential, so Data Loss Prevention policies (the settings that stop sensitive files leaving controlled boundaries) can exclude labelled items from Copilot altogether.

For a business in the 25-to-100-person range, that’s typically four to eight weeks of work. Most of it is technical and can be handled by your IT provider. Deciding which document categories deserve which label is the one part best done with input from the people who actually understand the material.

The question to send your provider this week

Ask whoever manages your Microsoft 365 environment: “Can you show me a report of every file in our tenant that’s accessible to more than ten people, and flag the ones containing client names, salary figures or financial data?” A useful answer within a few days tells you the tenant has been actively managed. “We’d need to enable some things first” tells you the audit hasn’t happened yet, and that’s the work to do before Copilot goes anywhere near a live account.

We help Northern Beaches and North Shore businesses run this kind of Microsoft 365 permissions review before a Copilot rollout, so you know exactly what it can reach before you switch it on. If you’d like a hand working out where oversharing might already exist in your tenant, or want practical help getting your team using Copilot properly once it’s safe to do so, get in touch with our team at Vaelis IT.