Key takeaways
- Copilot does not create new access. It makes existing access easy to use.
- The risk sits in broad site memberships, "everyone" groups and old organisation-wide sharing links.
- Lock down the sensitive areas first: HR, payroll, finance, board, legal.
- A focused week is usually enough to fix the worst of it in a small business.
The most common Copilot incident is not a hack. It is a staff member asking a reasonable question and getting an answer drawn from a file they were never meant to see. Copilot did nothing wrong. It used permissions that were already there. This guide is a one week plan for finding and fixing the oversharing before seats go live.
Why this happens
In most small businesses, SharePoint and OneDrive grew organically. Sites were created with broad membership because it was quicker. Files were shared with "people in your organisation" links so nobody had to manage access. Teams were set up for projects that ended years ago and still have every member. None of it mattered much when finding a file meant knowing where to look. Copilot removes that friction.
Day 1: find the sensitive content
List where your most sensitive material lives. In most businesses:
- Payroll, salaries and bonuses
- HR files, performance reviews and disciplinary records
- Board papers and shareholder information
- Finance: management accounts, forecasts, banking
- Legal matters and disputes
- Client confidential material with special handling requirements
For each, note the site, library or folder, and who owns it.
Day 2: check who can open it
- Review site membership and permissions for each sensitive location.
- Look for "Everyone", "Everyone except external users" and large all-staff groups with access.
- Check for sharing links set to anyone in the organisation.
- Check OneDrive for sensitive files that individuals have shared widely.
The SharePoint admin centre and Microsoft 365 admin reports show sharing activity and site access. Microsoft also offers more advanced reporting, including data access governance reports, through SharePoint Advanced Management. Check which of these your licences include.
Day 3: fix the sensitive areas
- Remove broad groups from sensitive sites and replace them with named groups.
- Remove or replace organisation-wide sharing links on sensitive files.
- Move sensitive files that are sitting in general sites into restricted locations.
- Where available, use controls that keep specific sites out of Copilot and organisation-wide search results while you finish the clean-up.
Day 4: tidy the obvious rest
- Archive or delete sites and Teams for projects that have ended.
- Remove former members from active sites.
- Change the default sharing link type to specific people rather than everyone in the organisation.
- Reduce the number of global and SharePoint admins to the few who need it.
Day 5: test like a user
Take a test account with ordinary staff permissions and Copilot, and ask the questions a curious employee might:
- "What are the salaries in the company?"
- "Summarise the latest board papers."
- "Who is on a performance plan?"
- "What are we planning to announce next month?"
Anything that comes back is a permission still to fix.
Do this before assigning seats. Start Copilot with a small pilot group whose access you have checked, then widen it as the clean-up progresses.
Keeping it fixed
- Make default sharing links specific to people.
- Give every site an owner who reviews membership twice a year.
- Consider sensitivity labels for your most sensitive documents.
- Include "check who can see it" in your AI usage policy.
- Re-run the user test after major reorganisations.
Google Workspace businesses face the same issue with Drive sharing and Gemini. See Gemini vs ChatGPT for Google Workspace. For the wider Copilot decision, read Copilot vs ChatGPT Business.
Frequently asked questions
Does Copilot respect SharePoint permissions?
Yes. Copilot only shows a user content they already have permission to access. The problem is that in most organisations people have access to far more than they realise, through broad site memberships and old sharing links, and Copilot makes that content easy to find.
What is Copilot oversharing?
Oversharing is when Copilot surfaces content to a user who technically has access but should not, such as salary data, HR files or board papers that were shared too widely. It is a permissions problem that Copilot exposes, not a flaw in Copilot.
How long does it take to prepare SharePoint for Copilot?
For a small business, the worst risks can usually be found and fixed in about a week of focused effort. A full tidy of every site takes longer and can continue after rollout, provided the sensitive areas are locked down first.
Do we need extra licences to fix permissions?
Basic permission and sharing reviews can be done with standard SharePoint and Microsoft 365 admin tools. Microsoft also provides more advanced reporting and controls, such as data access governance reports and restricted content discovery. Check which tools your licences include.
Get a straight answer for your business
The Clarity Package gives you a written business case and a detailed implementation plan for 500 USD. The Implementation Package does the whole build, live in 30 days, for a fixed 5,000 USD.