Denshin / Blog / AI
Before you roll out Microsoft 365 Copilot, look at who can see what
Copilot can only use what each person can already open, which is exactly why oversharing in SharePoint and OneDrive becomes a problem the day it is switched on. The cleanup to do first, and how to run the pilot.
Denshin Team · Technology Consulting · 26 October 2026 · 3 min read
Microsoft 365 Copilot has no special access to your company's files. It can only use what the person asking can already open. That sounds reassuring, and it is the source of most of the trouble.
In most tenants that have been running for a few years, people can open far more than anyone intended. A finance folder shared with the whole company in 2021 to get one file to one person. A project site that ended long ago with "Everyone except external users" still on it. "Anyone with the link" links pasted into an email and never expired. Nobody noticed, because finding those files meant knowing they existed and going looking. Copilot does the looking for you. Ask it about salary bands and, if a spreadsheet with salary bands is reachable, it may summarise it very helpfully.
So the work before a rollout is mostly permissions, not AI. The order we suggest:
- Find the overshared sites. Look for sites and libraries shared with "Everyone" or "Everyone except external users", and sites with large memberships that have nothing to do with their content. SharePoint Advanced Management has data access governance reports for exactly this. Microsoft has been tying it to Copilot readiness, and reports from May 2026 say it is now included for any tenant with at least one Copilot licence. Confirm what your own licensing covers before you plan around it.
- Clean up stale sharing links, "Anyone" links first, and set a default expiry for new ones.
- Restrict the genuinely sensitive sites (HR, finance, legal, board material) to named groups. Restricted access control lets an admin limit a site to a specific group regardless of what links are floating around.
- Publish sensitivity labels, even a simple set of three or four, and label the obvious material.
- Archive or delete abandoned sites, and turn on a site lifecycle policy so the pile does not grow back.
None of this is glamorous, and all of it was worth doing before Copilot existed. Copilot just removes the option of putting it off.
Then roll out small
Start with a pilot of twenty or thirty people across a few departments, picked because they will use it and tell you what they found. Ask them to report anything surprising Copilot showed them. That feedback is the best oversharing audit you will get, because it comes from real questions.
Pair the licences with training. Skip the feature tour. Teach how to ask for something clearly, how to check an answer against the documents it cites, and when a summary should not be trusted. People who click the citations get far more out of Copilot than people who take the first answer as final.
One caution on dates: Microsoft changes Copilot defaults, admin roles and licensing often, and some of the 2026 changes above come from second-hand reports. Check the current Microsoft Learn pages on SharePoint Advanced Management and Copilot readiness before committing to a plan. As of October 2026 they were still moving.
If you want help with the cleanup or the training, both sit under our Copilot and Microsoft 365 work.
Tags: Microsoft 365 Copilot, SharePoint, Data Governance, AI Adoption
All posts · Work with Denshin