The short answer
Copilot grants no new access, but makes everything a person can open easy to find, including files overshared years ago. So find the sites, groups and links exposing sensitive content, fix them with owners and hold back sites not yet clean. Then pilot with a small group, train on real work and measure before extending licences.
Why oversharing becomes a Copilot problem
Copilot surfaces only data the user can at least view, and prompts, responses and Microsoft Graph data do not train the foundation models, says Microsoft (Microsoft Learn). The risk is your sharing history:
Organisation-wide sites
Sites and teams open to all, often via "Everyone except external users".
Broad groups
All-staff lists with access to HR, finance or board libraries.
Old links
Organisation-wide and "Anyone" links made for a one-off need, never removed.
No current owner
Nobody reviews who has access.
Obscurity used to protect overshared files. Now "what are we paying the new managers?" can surface one.
How to find oversharing
| Method | What it gives you |
|---|---|
| Data access governance reports (SharePoint admin centre) | Broadest-permission sites, labelled files, recent sharing-link and "Everyone except external users" activity (Microsoft Learn); permission snapshots quarterly, activity monthly, per Microsoft |
| Site access reviews | Owners, who know their content, get the findings and fix them (Microsoft Learn); SharePoint only, not OneDrive, for now |
| Content owners | HR, finance, legal, leadership: they know where the never-share files live |
| Ordinary-user test | Before licensing, search as a typical user for salary, termination, board, acquisition |
The reports belong to SharePoint Advanced Management, included with the Microsoft Copilot licence per Microsoft's deployment blueprint (Microsoft Learn).
How to fix it
| Problem | Fix | Microsoft feature |
|---|---|---|
| No owner, or the owner has left | At least two current owners | Site ownership policy |
| Org-wide or all-staff groups on sensitive sites | Specific groups the owner approves | Site access review |
| Old organisation-wide and "Anyone" links | Remove stale links, expire "Anyone" links, narrower default link | Sharing settings |
| A sensitive site must stay with one group | Restrict the site to that group | Restricted access control |
| Sites still being cleaned up | Hide from Copilot and organisation-wide search for now | Restricted Content Discovery |
| Highly sensitive files | Classify and encrypt; Copilot respects the user's usage rights | Sensitivity labels in Microsoft Purview |
| Labelled content Copilot should not use; sensitive data in prompts | Block by policy (some options in preview) | Data loss prevention for Copilot |
Design a pilot that answers a question
- Right peopleDrafting, summarising, meeting-heavy roles across teams, plus doubters; not only IT.
- Clean firstRemediate the sites and teams pilot users reach before licensing.
- Scenarios and measuresA few tasks per role, agreed up front.
- Web searchDecide whether Copilot may send generated queries to Bing.
- AI use policyUsers check outputs before sharing. See our policy guide.
- Data protection officerBrief them; record the transfer basis and any DPIA.
- End dateThen decide: extend, adjust or stop.
More detail
A DLP rule can block web search when prompts contain sensitive information. Example pilot scenarios: summarising a long email thread, drafting a proposal from past documents, turning meeting notes into actions, analysing a spreadsheet. Include one or two doubters in the group.
Train on real work, then measure
Generic videos rarely change habits; short role-based sessions on people's own documents and meetings do. Cover strengths, mistakes and checking answers (Microsoft tells users to review outputs before sending). Name team champions, share prompts that worked, hold drop-in sessions early.
Copilot usage report
Admin centre: enabled users, active users, adoption by app (Microsoft Learn).
Copilot Dashboard
Viva Insights: readiness, adoption, impact and sentiment (Microsoft Learn).
Your own measures
Matter most: survey before and after, task time, quality, "would you keep the licence?"
Usage is not value. Copilot licences are usually billed in US dollars, so their naira cost moves with the exchange rate: extend them role by role where evidence supports it.
Rather talk it through? If you are planning Copilot, or your rollout has stalled, we can review your tenant's sharing and tell you what to fix before more licences go out. Talk to a Promatics specialist
What usually goes wrong
- Licences first, clean-up later: one awkward discovery sets adoption back badly.
- Hiding everything: so much restricted that Copilot has little to work with.
- Sharing drifts back: reports never rerun, new organisation-wide links appear.
When to bring in help
A small tenant with a few well-owned sites and a capable administrator can do this in-house. Bring in help when SharePoint and Teams grew for years without a permissions model, many sites lack owners, HR, finance, health or client data is involved, or leadership wants evidence before buying more licences.
Our Microsoft 365 Copilot service runs the readiness review, fixes oversharing with your content owners, applies labels and DLP where licensed, and runs the pilot, training and adoption reporting. Because we also manage Microsoft 365 for clients, the controls hold as people, sites and teams change.
Sources and further reading
Product capabilities and guidance change. These are the primary sources this article relies on, checked on the review date above.
- Data, privacy and security for Microsoft Copilot, Microsoft Learn
- Data access governance reports for SharePoint sites, Microsoft Learn
- Initiate site access reviews for data access governance reports, Microsoft Learn
- Restrict discovery of SharePoint sites and content, Microsoft Learn
- Microsoft Purview DLP for Microsoft 365 Copilot and Cowork, Microsoft Learn
This article is general information, not legal, accounting or security advice for your specific situation. Examples are hypothetical unless stated otherwise.