Clean Up Your Cloud Storage Before Turning on Generative AI

Most small and mid-sized businesses run on an unacknowledged security model: security through obscurity.

Your SharePoint, OneDrive, or Google Workspace probably contains ten years of commercial baggage. There are payroll spreadsheets from 2019 sitting in a semi-public channel, draft redundancy plans stored in an old project folder, and customer lists sitting in documents shared with "anyone with the link". In normal operations, nobody stumbles across these files because nobody looks for them. The folder structure is so convoluted that even the person who created the file cannot find it six months later.

Generative AI destroys this informal security buffer overnight.

When you connect an enterprise engine like Microsoft Copilot to your company data, it does not browse your folders like a human. It does not get bored, distracted, or lost in subdirectories. It indexes every single document that a user has permission to read, and it surfaces that information the moment someone asks a relevant question. If a junior staff member asks Copilot for insights on company overheads, and the directors' remuneration sheet has inherited wide-open permissions from an old parent folder, the AI will summarise the salaries without hesitation.

Cleaning up your cloud storage is not an optional housekeeping task to schedule for a quiet month. It is the fundamental prerequisite for deploying generative AI safely.

The permission illusion and the internal breach risk

When business leaders worry about data security and AI, they usually worry about the wrong thing. They fret about their proprietary data leaking out to public models like the consumer version of ChatGPT. With enterprise tools like Microsoft Copilot, that specific risk is largely addressed by commercial data protection agreements; your data stays inside your tenant and is not used to train the public model.

The real danger is internal. In IT governance, this is known as over-permissioning.

Over time, businesses create folders for temporary projects and grant wide access to speed up collaboration. Team members leave, new staff join, and access rights are copied from one profile to another. The result is that an average employee in a 50-person company often has technical read-access to tens of thousands of files they do not know exist and have no business reason to see.

Because traditional search requires knowing specific keywords, this over-permissioning rarely causes immediate harm. Generative AI removes the need for precise keywords. It works on semantic search - matching concepts, intent, and context.

If your permissions are sloppy, your AI rollout will expose: - Executive compensation and performance reviews. - Unannounced restructuring or redundancy proposals. - Commercial margins, supplier pricing, and customer discount agreements. - Personal identifiable information (PII) belonging to staff or clients.

The AI is not malfunctioning when this happens. It is simply reading what you allowed it to read.

Stale data breeds confident hallucinations

The second problem with cluttered cloud storage is output quality. Generative AI tools are probabilistic: they predict the most likely correct response based on the data available to them. When your cloud storage contains contradictory versions of the truth, the AI will guess.

Consider how your business stores operational documents right now. You likely have: - An original proposal from 2021. - A revised version marked "Final". - A third version marked "Final_v2_JW". - A completely different document from 2023 with the actual contract terms.

If an account manager asks the AI to summarise the standard service level agreement for that client, which document will it pull from? It will pull from whichever document mathematically aligns closest to the prompt, which may well be the discarded 2021 draft.

When AI gives a bad answer based on outdated internal data, staff lose confidence in the tool. If the system tells them a policy that contradicts reality, they will conclude that the AI is useless and stop using it, leaving you with expensive monthly licence fees and zero productivity gains. Clean storage is not just about protection; it is about making sure the AI acts on authoritative facts.

The three-bucket clean-up framework

Remediating years of digital accumulation sounds like a project that could swallow your entire quarter. It does not have to, provided you avoid the trap of trying to reorganise every folder manually. Instead, apply a triage framework based on three distinct buckets.

### Bucket 1: The restricted zone (High risk) Identify all repositories containing finance, HR, legal, strategic, and board-level data. The goal here is containment. Remove blanket access groups like "Everyone" or "Domain Users". Enforce strict, role-based access. If an employee does not need continuous access to perform their weekly job, their access should be revoked. Move these files out of general collaboration sites and into secured, dedicated document libraries with inheritance disabled.

### Bucket 2: The active truth (High value) Identify the current, authoritative documentation your team uses to run the business today. This includes up-to-date standard operating procedures, active client files, product specifications, current pricing calculators, and the live employee handbook. These documents should be clearly signposted, kept in well-managed SharePoint sites, and tagged or named consistently. This is the primary training ground for your AI.

### Bucket 3: Redundant, obsolete, and trivial (ROT) Studies show that between 30% and 50% of the data held by average mid-sized businesses has zero operational or legal value. Old event planning spreadsheets, drafts of marketing brochures from 2018, and duplicate downloads clog search results. This data needs an aggressive archival or deletion policy. If your legal compliance rules allow it, archive files untouched for more than three years into cold, non-indexed storage or delete them entirely.

Practical steps to take before assigning licences

Before you hand out AI licences to your team, put these four technical barriers in place:

• Turn off broad sharing links. Review tenant-wide settings in your cloud platform to disable legacy links that allow company-wide or anonymous access without explicit authentication.
• Audit your SharePoint sites and Google Shared Drives. Run an administrative report showing all sites where the member list includes all employees. Target those sites first.
• Implement basic sensitivity labels. Use built-in tools like Microsoft Purview to automatically flag documents containing payment details, tax numbers, or specific confidential keywords. You can configure your AI to ignore files with specific confidentiality labels.
• Restrict Copilot search locations. If your data is too messy to fix in the short term, you can restrict the AI to search only curated, verified document libraries rather than your entire tenant while clean-up is underway.

Evaluating your options: DIY vs assisted remediation

Business leaders typically evaluate three approaches to solving this data problem:

1. The staff mandate: Asking everyone to "clean up their own drives" by Friday. This approach almost universally fails. Staff do not have the time, the perspective, or the technical understanding of inheritance permissions to do it properly. It creates friction and delivers inconsistent results.

2. The IT lockdown: Instructing your internal IT lead or managed service provider (MSP) to restrict permissions immediately. While this secures the data, doing it without consulting operational teams usually breaks daily workflows. Legitimate business processes grind to a halt because staff suddenly cannot access templates they need to invoice clients.

3. Structured data readiness: Combining technical discovery tools with an operational review. This involves using automated scanners to locate sensitive data footprints, working with department heads to confirm what is genuinely active, and implementing automated retention policies that continuously keep stale data out of the AI's reach.

The third option requires an investment of time, but it transforms AI from a gamble into a controlled, repeatable advantage.

Where to start

Do not wait for your licence procurement to finish before addressing your storage.

Start with a simple smoke test this week. Sit down with a junior team member who has average system permissions. Ask them to run a few targeted searches in your existing cloud platform: "salary", "restructure", "redundancy", "confidential", or the name of your biggest client alongside the word "margin".

If sensitive documents appear in their standard search results today, your cloud storage is not ready for generative AI. Address those access leaks now, isolate your core operational documents, and build a clean foundation before you flip the switch.