Before you turn on Copilot, check who can see what

How Copilot finds information

Copilot does not get special access. When someone asks it a question, it searches the emails, chats, meetings and files that person is already allowed to open, and writes an answer from them.

That sounds safe, and it is, if permissions are right. In most businesses they are not quite right:

• A salary spreadsheet was shared with “everyone in the company” years ago.
• A SharePoint site for leadership is open to all staff.
• A former manager’s OneDrive is still shared with their whole team.

Before Copilot, these mistakes were hidden because nobody went looking. Copilot goes looking for you. Ask it about bonuses, and it may cheerfully summarize that spreadsheet.

What to do first

1. Find the oversharing. Review sites, folders and links open to everyone in your organization or to anyone with the link.
2. Fix the sensitive areas first: HR, finance, leadership and client data.
3. Decide on rules for AI tools: which ones are approved, and what information must never go into them.
4. Start with a small group, learn what works, then expand.

The good news

The cleanup Copilot needs is cleanup your business benefited from anyway. Fewer people with access to sensitive files is safer with or without AI.