Microsoft 365 Copilot doesn’t break your permissions, it makes them searchable. This checklist walks through the sharing settings, reports and fixes to run in your own tenant, in priority order, before Copilot goes to everyone.<\/p>\n\n\n\n
Related guides<\/strong><\/p>\n\n\n\n Microsoft’s wording is precise: Copilot "only surfaces organizational data to which individual users have at least view permissions." It doesn’t get special access, and Microsoft says prompts, responses and the data Copilot reads through Microsoft Graph aren’t used to train its foundation models.<\/p>\n\n\n\n The catch is that most Microsoft 365 tenants are more open than anyone realises. Nobody goes looking through a SharePoint site they’ve never heard of, so a folder shared with the whole organisation five years ago never caused a problem. Copilot changes that. A staff member asking "what are we paying the operations team?" gets an answer built from whatever they can technically open.<\/p>\n\n\n\n A common example: an HR site created for a restructure, shared with "Everyone except external users" so a few managers could see a draft, then forgotten. Nothing about that site changed when Copilot arrived; it just became findable.<\/p>\n\n\n\n That’s why oversharing is a permissions problem you fix before rollout, not a Copilot setting you flip.<\/p>\n\n\n\n Copilot in SharePoint.<\/strong> Microsoft says general availability began rolling out on 30 September 2026. Everyday capabilities come with the Microsoft 365 Copilot licence and "no opt-in step is required". The PowerShell controls used to opt sites in or out during the preview were honoured until 1 November 2026. Microsoft now points admins to Site AI settings<\/strong> on each site and to Restricted Content Discovery instead. If you relied on the old opt-out, check your sites again.<\/p>\n\n\n\n Restricted SharePoint Search is retiring.<\/strong> It was a temporary 100-site allow list. Microsoft blocked new enablement from 31 July 2026 and points customers to Restricted Content Discovery.<\/p>\n\n\n\n SAM comes with Copilot, with a caveat.<\/strong> Microsoft documents that SharePoint admins get the SAM features that support a Copilot deployment once at least one user in the organisation has a Microsoft Copilot licence, and its feature page says this applies to "enterprise and business commercial customers". Its SAM prerequisites page, however, lists the required base subscriptions as Office 365 E3, E5 or A5, Microsoft 365 E1, E3, E5 or A5, and the government clouds. Microsoft 365 Business Basic, Standard and Premium aren’t on that list, so if that’s what you run, confirm with Microsoft or your licensing partner which of the reports below you’ll get. Where SAM is available, a practical sequence for a small organisation is: licence a pilot user or two, run the reports below, fix what you find, then expand.<\/p>\n\n\n\n You’ll need the SharePoint Administrator role. Paths below are in the SharePoint admin center unless noted.<\/p>\n\n\n\n Go to Policies > Sharing<\/strong>.<\/p>\n\n\n\n Check:<\/strong> a new share from a test account defaults to "Specific people", and an "Anyone" link (if allowed) shows an expiry date.<\/p>\n\n\n\n Fix:<\/strong> change the settings above. They don’t touch existing links; steps 2 and 3 deal with those.<\/p>\n\n\n\n Go to Reports > Data access governance > Sharing links<\/strong>. This activity report shows the sites where people created the most "Anyone", "People in your organization" and "Specific people" links over the last 28 days. If your tenant doesn’t have SAM yet, Microsoft says you must first enable data collection, and reports become available 24 hours later.<\/p>\n\n\n\n What to look for:<\/strong> "Anyone" links on finance, HR, legal, board or client sites; "People in your organization" links on anything containing personal information.<\/p>\n\n\n\n Check:<\/strong> you have a list of sites with "Anyone" links and a named owner for each.<\/p>\n\n\n\n Fix:<\/strong> ask site owners to remove or replace links (the Site access review<\/strong> feature sends the request for you), or remove them centrally for the riskiest sites.<\/p>\n\n\n\n "Everyone except external users" (EEEU) is a built-in group containing every internal account. Grant it access once, at site, folder or file level, and that content is open to every staff member, and so to their Copilot.<\/p>\n\n\n\n Run two snapshot reports under Data access governance<\/strong>: Site permissions across your organization<\/strong>, which shows the sites with the broadest access (thousands of users, guests, EEEU), and Sites and files shared via special SharePoint groups<\/strong>, which names the exact sites, folders and files shared with EEEU or Everyone and how.<\/p>\n\n\n\n What to look for:<\/strong> EEEU or Everyone on anything that isn’t genuinely meant for all staff, such as intranet news or policies.<\/p>\n\n\n\n Check:<\/strong> no site holding personal, financial or commercially sensitive information has EEEU or Everyone in its permissions.<\/p>\n\n\n\n Fix:<\/strong> replace EEEU with a proper Microsoft 365 group or security group of the people who need access.<\/p>\n\n\n\n Sorting out permissions on a big site takes time. While you work through it, you have two interim controls:<\/p>\n\n\n\n Restricted Content Discovery doesn’t change permissions; people who can open a file still can. Microsoft describes it as "a temporary governance control", it works on SharePoint sites only (not OneDrive), it needs a Copilot licence and SAM, and on very large sites (over 500,000 items) a change can take more than a week to apply.<\/p>\n\n\n\n Check:<\/strong> your top five riskiest sites from steps 2 and 3 are either fixed or under one of these controls, with an owner and a date to remove it.<\/p>\n\n\n\n Fix:<\/strong> use Site access review<\/strong> to get owners to right-size membership, then lift the interim control.<\/p>\n\n\n\n Old project sites, departed staff’s team sites and abandoned Teams are where forgotten permissions live. SAM’s site lifecycle policies help:<\/p>\n\n\n\n Each can run in simulation mode<\/strong> first, which gives you a report without emailing anyone. In active mode, unanswered sites can be set to read-only, then archived. Microsoft notes the policies never delete sites directly.<\/p>\n\n\n\n Check:<\/strong> a simulation report lists inactive and ownerless sites, and each has a decision: keep (with owners), archive or delete.<\/p>\n\n\n\n Fix:<\/strong> archive what nobody needs, and give every remaining site at least two owners.<\/p>\n\n\n\n Sensitivity labels let Copilot respect protection that travels with the file. Microsoft’s Purview guidance has three points that matter here:<\/p>\n\n\n\n Start small: three or four labels (for example Public, Internal, Confidential, Highly confidential), auto-apply where you can, and encrypt only the top tier. The sensitivity labels report in Data access governance shows where labelled files live, but Microsoft notes it needs E5 or G5.<\/p>\n\n\n\n Check:<\/strong> your most sensitive document types (payroll, board papers, client health or financial records) carry a label that either blocks EXTRACT or is covered by a Copilot DLP policy.<\/p>\n\n\n\n Fix:<\/strong> publish the labels, set a default label on sensitive libraries, and add the DLP policy.<\/p>\n\n\n\n Now that the preview PowerShell controls have gone, site owners manage the experience under Settings > Site AI<\/strong>, where they can hide the Copilot button from site visitors. Restricted Content Discovery from step 4 also removes Copilot in SharePoint from a site regardless of other settings.<\/p>\n\n\n\n Check:<\/strong> owners of your sensitive sites have reviewed Site AI settings, and any site you previously opted out with PowerShell has been re-checked.<\/p>\n\n\n\n Give Copilot to a small group across departments first, including someone from finance or HR who’ll notice if something surfaces that shouldn’t. Ask them to try the questions an over-curious colleague might ask. Re-run the reports in steps 2 and 3 on a regular schedule after rollout, because new sharing links appear every day.<\/p>\n\n\n\n Check:<\/strong> pilot users have tried to find salaries, board papers and client files through Copilot, and found nothing they shouldn’t.<\/p>\n\n\n\n Switching on Copilot?<\/strong> Our Copilot readiness work finds and fixes oversharing first, so Copilot only shows people what they should see.<\/p>\n\n\n\n\n\n
TL;DR<\/h3>\n\n\n\n
\n\n
In this post<\/h3>\n\n\n\n
\n\n
What does Copilot actually see?<\/h2>\n\n\n\n
\n\n\n\nWhat changed in 2026?<\/h2>\n\n\n\n
\n\n\n\nThe readiness checklist, in priority order<\/h2>\n\n\n\n
1. Tighten the defaults so the problem stops growing<\/h3>\n\n\n\n
\n\n
2. Find "Anyone" and company-wide sharing links<\/h3>\n\n\n\n
3. Remove "Everyone" and "Everyone except external users" from sensitive content<\/h3>\n\n\n\n
4. Lock down overshared sites while you fix them<\/h3>\n\n\n\n
\n\n
5. Deal with stale and ownerless sites<\/h3>\n\n\n\n
\n\n
6. Label what’s genuinely sensitive<\/h3>\n\n\n\n
\n\n
7. Decide where Copilot in SharePoint appears<\/h3>\n\n\n\n
8. Pilot, then widen<\/h3>\n\n\n\n
\n\n\n\nQuick reference<\/h2>\n\n\n\n
\n\n
\n \nReport or setting<\/th>\n What it finds<\/th>\n First fix<\/th>\n<\/tr>\n<\/thead>\n \n Policies > Sharing<\/td>\n Loose defaults for new links<\/td>\n Specific people by default; expiring, view-only Anyone links<\/td>\n<\/tr>\n \n Sharing links report<\/td>\n Sites with many Anyone or org-wide links<\/td>\n Owners remove links via Site access review<\/td>\n<\/tr>\n \n Site permissions report<\/td>\n Sites with the broadest access<\/td>\n Restricted access control or Restricted Content Discovery while you fix<\/td>\n<\/tr>\n \n Special SharePoint groups report<\/td>\n Exact files and folders shared with EEEU or Everyone<\/td>\n Replace with a named group<\/td>\n<\/tr>\n \n Inactive site and ownership policies<\/td>\n Stale and ownerless sites<\/td>\n Archive or assign two owners<\/td>\n<\/tr>\n \n Sensitivity labels and Copilot DLP<\/td>\n Sensitive files Copilot could summarise<\/td>\n Label, encrypt the top tier, add DLP<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n