Clean Up Your SharePoint Before You Turn On Copilot

Most small and medium-sized businesses rely on security through obscurity.

You know the executive team's bonus plan sits in a folder somewhere in SharePoint. You know that, technically, someone created that folder five years ago with permissions set to "Everyone except external users." But nobody has stumbled across it because it is buried four subfolders deep under an innocuous directory called "Operations General 2019."

Security through obscurity works right up until the day you turn on Microsoft Copilot.

Copilot does not hack your system. It does not bypass Microsoft 365 security boundaries. Instead, it respects them with ruthless, index-searching efficiency. If a user asks Copilot, "What are the leadership team's priorities for next year?" or "Show me recent compensation reviews," Copilot will happily scan every single file that user has read access to and summarize the answer. If that user technically has read access to the bonus spreadsheet, Copilot will read it, synthesize it, and deliver it in seconds.

If your data estate is untidy, deploying Copilot will not automate your business. It will automate your data leaks.

The Reality of SharePoint in Growing Businesses

Almost every business with 10 to 250 staff has an untidy SharePoint environment. It happens naturally. You migrated away from an on-premises file server years ago, dragging over an unruly nest of directories that had accumulated since 2008. Since then, different team members have created sites, shared links with "Anyone in the company," invited contractors to view specific files, and broken permission inheritance to solve short-term collaboration roadblocks.

The result is permission drift. Over time, three common problems emerge:

• Oversharing by default: Folders created inside standard Microsoft Teams channels are accessible to everyone in that Team. If your "All Staff" team has a files tab containing financial forecasts or grievance records, every employee technically owns access to those documents.
• Broken inheritance: Managers often break inheritance on a subfolder to give a specific contractor or junior staff member access to a single file, without realizing that moving or renaming parent folders creates permanent security blind spots.
• Stale, conflicting information: Multiple versions of policies, pricing sheets, and contracts live side by side. Copilot cannot intuitively know that "Proposal_v2_FINAL_revised.docx" from 2021 is obsolete, while "Proposal_Template_2024.docx" is current. If asked to draft a quote, it might choose the older, cheaper numbers.

Copilot makes decisions based on the content you feed it. Feed it stale, unrestricted files, and you get inaccurate, insecure output.

Evaluating Your Clean-Up Options

Fixing this problem is not optional, but how you tackle it depends on your internal capabilities, budget, and appetite for operational disruption. As you evaluate your path forward, consider the three common routes businesses take.

### Option 1: The Internal IT Sweep Many business owners instruct their internal IT lead or outsourced Managed Service Provider (MSP) to "clean up permissions."

The upside is cost control; you are using existing retainers or salaries. The downside is that IT teams do not own the business context. An IT engineer cannot determine whether an old HR folder can safely be deleted, or whether a client project archive should still be accessible to sales reps.

Left entirely to IT, clean-ups tend to stall because technical staff end up chasing department heads for permission to touch files, creating friction and delay.

### Option 2: The Full Information Architecture Redesign Some businesses treat Copilot as an excuse to completely tear down their SharePoint architecture and rebuild it from scratch.

While theoretically ideal, this approach often leads to paralysis. Complete reorganizations take months, require extensive staff retraining, disrupt daily workflows, and frequently run over budget. For a business with 50 or 150 staff, pausing adoption plans for a six-month data categorization project is rarely a pragmatic use of capital.

### Option 3: Targeted, Risk-Based Remediation The most effective middle ground is a focused, risk-based audit. Instead of trying to clean every historical invoice from 2014, you systematically locate and isolate your highest-risk data assets: payroll, board papers, HR investigations, commercial contracts, and banking details.

Once high-risk assets are restricted, you apply sensible archival policies to eliminate duplicate, stale files from the main search index. This targeted method typically takes two to four weeks, does not interrupt daily operations, and creates a secure baseline for a controlled Copilot rollout.

A Four-Step Data Triage Plan

If you decide to take a pragmatic, risk-based approach, focus your effort on these four steps before assigning Copilot licenses.

• Step 1: Run a permissions inventory. Use the SharePoint admin center or PowerShell scripts to identify sites and libraries with "Anyone" sharing links or company-wide access. Look specifically for locations containing terms like "Salaries," "HR," "Board," "P&L," or "Restructure."
• Step 2: Strip broad access to sensitive sites. Move sensitive files to dedicated, restricted sites with strict membership lists. Turn off the ability for members to share the site or its subfolders without owner approval. Ensure these sites are excluded from broader organization search where appropriate.
• Step 3: Archive obsolete operational data. If your sales team has five versions of the standard client services agreement, move the older versions into a designated "Archive" library. Better yet, move them to cold storage or an offline backup if they are purely kept for compliance reasons. Copilot should only index active, authoritative templates.
• Step 4: Implement basic sensitivity labels. Microsoft Purview allows you to flag documents as "Confidential" or "General." Copilot honors sensitivity labels. If a document is labeled as "Confidential - Executive Only," Copilot will not reference its content when answering a query from someone outside that security group.

What Happens If You Skip This Work?

The temptation to skip straight to the software deployment is strong. Business owners want productivity gains immediately, and sorting out permissions feels like administrative drudgery.

However, skipping data readiness brings predictable consequences. At best, employees will lose trust in the tool because Copilot will pull outdated facts, quotes, and policies from abandoned archives. At worst, an employee will ask a harmless question and receive an answer containing executive salaries, an upcoming round of redundancies, or commercially sensitive acquisition targets.

Once sensitive information surfaces inside an AI summary, the damage is done. You cannot recall an answer that an employee has already read.

The Sensible Next Step

Do not cancel your Copilot plans out of fear, but do pause your deployment until you know what your data looks like from the inside out.

The practical next step is to conduct a discovery exercise. Ask your IT lead, your MSP, or an external specialist to run an access assessment on your primary SharePoint document libraries this week. Find out exactly which company-wide groups have access to your executive, finance, and human resources libraries.

Once you see the real permission footprint of your business, you can make an informed decision on the targeted fixes required to roll out Copilot safely, productively, and without unwanted surprises.