Copilot readiness: SharePoint permissions clean-up
Copilot can only show people what they already have access to. In a tenant a few years old, that’s usually far more than anyone realises.
We find what’s overshared in the client’s SharePoint and OneDrive, fix it with the people who own it, and change the defaults so new sharing starts narrow, before Microsoft 365 Copilot starts answering questions from it.
The draft proposal merges Sales and Operations and lists the roles affected. The salary review has proposed changes for each person, and the leadership offsite notes cover timing and how it will be announced.
- Restructure proposal – draft 3.docx Leadership site › Board papers Folder shared with “Everyone except external users”
- Salary review FY27.xlsx Finance manager’s OneDrive Company-wide link, opened from a forwarded email
- Offsite notes.docx Leadership team › Files Team created as Public
Copilot shows people what they could already open
Microsoft 365 Copilot answers from the files, chats and email the signed-in person already has permission to open. It doesn’t get around SharePoint permissions and it doesn’t grant new ones. That sounds reassuring until you look at what a tenant collects over a few years.
Sites made for a project and never closed. A folder shared with the whole company to get something done on a Friday afternoon. Links forwarded well past the person they were made for. Search could always have surfaced these, but people search for things they already know exist, so the exposure sat there unnoticed.
Copilot does the looking for them. A question asked in plain English draws on everything that person can reach and summarises it in seconds. So most of the readiness work is on permissions: making them match what everyone assumed they were.
Where the oversharing builds up
It rarely comes from one bad decision. It builds up at every level of SharePoint and OneDrive, and each level needs a different fix.
-
The tenant Sharing settings and guests
The defaults decide what every new link looks like. If the default is a link anyone in the organisation can use, that’s what most people send. Guests invited for one project keep their access long after it ends.
-
Sites and teams Who counts as a member
A team created as Public lets anyone in the organisation open its files. Older sites often had
Everyone except external users
added to give the whole company read access, sometimes at the top of the site and sometimes deep inside it.-
Libraries and folders Broken inheritance
One folder needed different access, so its permissions were split from the site. Years later nobody remembers why, and the site’s membership no longer tells the whole story of who can get in.
-
Files Sharing links
Company-wide links and
anyone with the link
links get pasted into chats, forwarded in email and kept long after the reason they were made.
-
-
-
OneDrive Shared from one person’s account
People share from OneDrive the same way they share from sites, but a OneDrive has one owner and no one else looking at it. It’s often where the most sensitive spreadsheets end up.
-
Fixing it without stopping people working
Any admin can produce a list of overshared content. Most of our effort goes into fixing it without cutting off access that people need.
-
The tempting fix: Remove “Everyone” from every site in one sweep.
What works: Find out who relies on it first. A broad permission is often how a whole department reaches its forms and templates. We replace it with the right group, agreed with the site owner, so nobody loses access they need.
-
The tempting fix: Hand the client a report with thousands of rows.
What works: A report isn’t a fix. We start with the broadest access to the most sensitive content and work through it with the people who own each site, because they’re the only ones who know who should be there.
-
The tempting fix: Lock everything down so Copilot has nothing to read.
What works: Then Copilot can’t help anyone, and people go back to emailing attachments, which is its own problem. The aim is that people can find what their job needs, and nothing else.
-
The tempting fix: Create a sensitivity label for every kind of document.
What works: People pick a label in a second or not at all. A short set they understand gets used. A long one gets ignored, or everything ends up with whichever label is first in the list.
-
The tempting fix: Delete every guest who hasn’t signed in lately.
What works: Some guests only turn up once a year, like the external accountant at tax time. We check with the owner, keep the ones still needed and remove the rest.
-
The tempting fix: Clean up once and move on.
What works: If the defaults stay the same, everyday sharing builds the problem up again. Adjusting the default sharing settings means new links start narrower than the whole organisation.
Then ask the same question again
Afterwards, Copilot gives each person useful answers from what their job needs, and keeps what it doesn’t out of reach.
I couldn’t find anything about a restructure in the files you have access to.
- Board papers Leadership members only, agreed with the site owner
- Salary review FY27.xlsx Labelled Highly confidential, company-wide link removed
- Leadership team Changed to Private
- A sharing report
- The sites, files and links shared with everyone, the whole organisation or external users, and the guest accounts that can reach them.
- Oversharing fixed, with the site owners
- Overshared sites and links narrowed to the people who need them, and stale guest access removed.
- Sensitivity labels in place
- A short set of labels for confidential information, where the client’s licence supports them.
- Sharing settings that start narrow
- Default sharing settings adjusted so new links start with the narrowest sensible access.
Getting a client ready for Copilot?
We do this remotely as a white-label project, under your brand or as your named partner, and quote you a fixed price for the agreed scope. It’s just as useful if the client has already switched Copilot on.
See the other Microsoft 365 & data projects.