Copilot Readiness Checklist: Fix SharePoint Oversharing Before You Roll It Out

Microsoft 365 Copilot answers questions using the files, emails, chats and meeting notes each person can already open. It doesn't break through permissions. It does make old permissions much easier to stumble into.

A folder shared with the whole company five years ago used to sit quietly where nobody went looking. With Copilot, anyone can ask a question that happens to pull from it. Microsoft says this plainly in its Copilot privacy documentation: Copilot only shows people data they already have at least view access to.

Below is the readiness work we do before turning Copilot on for a team. It's the step before our Copilot training plan, and the order matters more than any single setting.

Why oversharing becomes a problem the day Copilot goes live

SharePoint is where Microsoft 365 stores shared files and team sites, and OneDrive is each person's own file space. Over the years, sites get shared more widely than anyone intended, and that permission sprawl builds up quietly. The common culprits are a site opened to "Everyone," a link set to "People in your organization," or a quick "Anyone with the link" share for a vendor.

A pattern we see often: a team site gets shared with everyone in the company, and over time the team starts storing files there that were only ever meant for that team. Nothing bad happens, and nobody notices. It would still fail a security audit, and Copilot can now surface those files to people who were never meant to see them.

The fix behind this whole checklist is simple: people get access to what their job needs, and nothing more. IT teams call this least privilege, and it's the standard security principle every step below puts into practice.

Here's a scenario worth thinking through before rollout. A manager writes up meeting notes while preparing to negotiate budget or headcount with another department, and the notes land on a site the other department can open. Weeks later, someone in that department asks Copilot to summarize recent planning discussions, and the notes come back in the answer.

Step 1: Talk to each team before touching settings

We start every readiness project with short interviews, one per team. We ask what each team stores, who should see it, and which files would cause trouble if they showed up in someone else's Copilot answer. Those conversations tell us where to look first and save hours of guessing inside the admin center.

Then we compare what people said with what the permissions actually allow. The gap between the two is your cleanup list.

Step 2: Find what's open too widely

Microsoft gives admins reports built for this. In the SharePoint admin center, the data access governance reports list sites with sharing links, sites shared with "Everyone except external users," and sites shared with more people than a number you choose. Microsoft's Copilot oversharing blueprint notes that SharePoint Advanced Management, the add-on that includes these reports, comes with Microsoft 365 Copilot licenses.

Run the reports and sort the results by risk. HR, finance, payroll, legal and leadership sites go to the top of the list.

Step 3: Give every team its own group

An Entra ID group is a named group of people in your company's Microsoft account directory, such as "Finance team." You give a site access to the group instead of to people one at a time. When someone joins or leaves the team, you update the group and every site that uses it follows along.

If a team doesn't have its own group yet, we create one. Then we swap "Everyone" and "Everyone except external users" on that team's site for the team's group.

Step 4: Fix sharing links and site access

With groups in place, work through the report results one site at a time:

• Remove "Everyone" and "Everyone except external users" from sites that hold team-only files.
• Review "Anyone" links and "People in your organization" links, and remove the ones nobody needs.
• Move sensitive files out of broadly shared sites, or delete old copies that shouldn't exist anymore.
• Confirm every site has at least one current owner who knows what's stored there.

Site owners usually know their content better than IT does. The SharePoint admin center can send them a site access review, which asks each owner to check who has access and tighten it.

Step 5: Protect your most sensitive files with labels

Sensitivity labels come from Microsoft Purview, Microsoft's set of data protection tools. A label such as "Confidential - HR" can mark a file and limit who can open it, and Copilot respects those limits. SharePoint Advanced Management is included with Microsoft 365 Copilot licenses, and basic Microsoft Purview features like sensitivity labels come with Microsoft 365 E3, with more advanced options in higher tiers. Check your plan before you count on them.

Start with a short list of labels people will actually use. Two or three clear choices go further than ten that nobody remembers.

Step 6: Hide sensitive sites while cleanup finishes

Some sites take longer to sort out. Restricted Content Discovery, part of SharePoint Advanced Management, keeps chosen sites out of company-wide search and Copilot answers while you finish the review. Microsoft's guide to Restricted Content Discovery describes it as a temporary control.

It doesn't change who has access, so people with permission can still open files directly. Treat it as a short-term cover, and remove it once the permissions are fixed.

Step 7: Start with a small Copilot pilot group from one team

We recommend giving Copilot licenses to a pilot group of about 10 people from a single team first. Keeping it to one team keeps the cleanup scope small, since you only need that team's sites in good shape before the pilot starts.

Build the group with a mix of people:

• A few heavy Outlook and Teams users, since they'll test Copilot hardest on email and meetings.
• One straight shooter, who will tell you plainly what doesn't work.
• Someone who likes sharing wins, so good results travel to the rest of the company.

How long readiness takes

Plan on anywhere from a week to a month or more, depending on company size and how many sites you have. A 20-person company with a handful of sites can often finish in a week. A larger company with years of sites and departments will take longer.

Governance before implementation is the rule we hold to. It's much easier to fix permissions before Copilot goes live than to explain afterward why a sensitive file showed up in someone's answer.

Who should do the cleanup

For smaller companies, we often do the cleanup alongside the owner or office manager. The site count is manageable, and the interviews and fixes fit in the same project.

Mid-market companies usually have more sites than one person can review well. At that size, bring in your MSP (managed service provider, the outside IT company that runs your systems) or a Microsoft partner. We can run the team interviews and pilot planning while they handle the admin-side changes.

Agents raise the stakes

Microsoft's Work IQ is the layer that lets Copilot agents built in Copilot Studio pull from your email, Teams chats, SharePoint and OneDrive. An admin has to turn it on for the organization, and agents only see what the person using them can already open.

So the same permission cleanup protects you when your team starts building agents, not just when they use Copilot chat.

The Copilot readiness checklist

Use this as a quick scan before your first Copilot license goes out:

• Interview each team about what they store and who should see it
• Run the SharePoint data access governance reports
• List HR, finance, payroll, legal and leadership sites first
• Create an Entra ID group for every team that doesn't have one
• Remove "Everyone" and "Everyone except external users" from team-only sites
• Review and remove unneeded "Anyone" and company-wide sharing links
• Move or delete sensitive files stored in broadly shared sites
• Confirm every site has a current owner
• Send site access reviews to site owners
• Tighten company-wide sharing settings
• Apply sensitivity labels to HR and finance files
• Use Restricted Content Discovery for sites still in review
• Pick a pilot of about 10 people from one team
• Set a recurring check of the data access governance reports
• Plan training before licenses go to the wider company
• Before anyone builds Copilot agents, confirm the permission cleanup is done and decide who can turn on Work IQ.

How we help with Copilot readiness

Our AI implementation work starts with this readiness step: team interviews, a permission audit and a pilot plan. Once the pilot team is set, our AI training sessions teach them Copilot on their own files and email.

Still deciding between tools? Our comparison of Copilot and Claude for teams can help. We work on-site around Rochester and Western New York and remotely with companies anywhere.