Clean Up Your SharePoint Data Before Launching Microsoft Copilot

If you ask Microsoft about the security of Copilot for Microsoft 365, the official response is reassuring: Copilot only surfaces data that the individual user already has permission to see.

Many business owners hear that and assume they are safe. After all, if nobody has complained about access rights for the past five years, the system must be working.

That logic is flawed. In most small and medium businesses, internal permissions are not well-designed; they are simply ignored. People rarely stumble across confidential files because traditional SharePoint search is clunky. You have to know what you are looking for, guess the right keywords, and sift through dozens of irrelevant folders.

Copilot changes that equation completely. It does not just search; it synthesises. If an employee asks, "What are the current executive salaries?" or "Summarise the redundancy plans discussed this year," Copilot will happily scan every document that user technically has access to, pull the relevant paragraphs, and deliver a clean summary in seconds.

If your permissions are sloppy, Copilot will expose that sloppiness on day one. Here is how to audit and clean your SharePoint data before you hand out licences.

The problem with "Everyone except external users"

The single biggest data leak risk in Microsoft 365 is the default permission group called "Everyone except external users".

Over years of day-to-day work, staff share folders using the easiest path available. When a manager needs to share a document quickly, they often pick the default option: "People in your organisation with the link". That single click can grant every employee in the company view or edit rights to that file.

Common culprits hiding in open SharePoint sites include: - Spreadsheets containing payroll data, staff bonuses, or commission structures. - Board packs, investor updates, and acquisition discussions. - Disciplinary records and HR investigation notes. - Performance reviews and restructuring plans. - Unredacted customer contracts with sensitive pricing terms.

None of this is malicious. It is the natural result of busy teams prioritising speed over administrative hygiene. But Copilot treats technical access as an invitation to read. If an intern has read-access to a folder containing director remuneration details, Copilot will use that data to answer the intern's questions.

Find and fix oversharing first

You do not need to review every individual file across your entire company. That approach takes months and usually fails. Instead, focus on the boundaries.

Start in the SharePoint Admin Centre. Look at your active sites and identify which ones contain sensitive data. Finance, HR, Senior Leadership, and Operations are the obvious priorities. For each of these sites, check the group membership.

A common mistake in smaller firms is creating a Microsoft Team for a sensitive project, and then adding general staff members to it over time. Remember that every Microsoft Team is backed by a SharePoint site. If someone is a member of the Team, they can see every file stored in that Team's files tab, even files uploaded three years ago.

Take these immediate actions: - Remove "Everyone except external users" from the member lists of all sensitive sites. - Review "Anyone" and "People in your organisation" sharing links on restricted folders, and replace them with "Specific people" links. - Check the ownership of legacy sites. If a site owner left the business two years ago, assign an active senior manager to review who belongs there.

Outdated files lead to bad AI answers

Security is only half the battle. The other issue is accuracy.

Large language models like Copilot treat all the text they can access as potential ground truth. If you have three different versions of your standard terms of business sitting in SharePoint - one from 2018, one from 2021, and the approved 2024 version - Copilot cannot automatically tell which one represents company policy today.

If a salesperson asks Copilot to draft a proposal based on past contracts, the tool might pull liability caps from a deprecated 2019 agreement. If an employee asks about maternity leave, Copilot might summarise an outdated policy document stored in a personal OneDrive folder rather than the current handbook on the company intranet.

To prevent this: - Establish a single source of truth for key company policies, templates, and contracts. - Archive old versions. Move legacy project folders to a dedicated archive library and restrict access, or delete files that fall outside your statutory retention requirements. - Rename files clearly. If a document is a draft, ensure the file name or metadata explicitly says "DRAFT". If an old file must be kept for historical reference, move it into an "Archive" subfolder.

Keep sensitivity labelling simple

Microsoft Purview provides sensitivity labels, which encrypt files and restrict how they can be used or surfaced by Copilot. Purview is powerful, but many SMBs get bogged down trying to design an overly complex classification scheme.

Do not create ten different tiers of sensitivity. Your staff will not use them, and your IT support partner will struggle to enforce them.

Start with three basic labels: - Public: Marketing material, published blog posts, recruitment brochures. No restrictions. - Internal: Standard business communications, project plans, meeting notes. Visible to all staff, restricted from external sharing without approval. - Confidential: Financial ledgers, HR matters, executive strategy, legal advice. Restricted to named groups or individuals, with download and forwarding restrictions applied.

When you apply a "Confidential" label that restricts access to the leadership team, Copilot automatically respects that boundary. Even if a junior employee asks a direct question about that file, Copilot simply treats the document as if it does not exist.

The sensible sequence for deployment

Do not attempt a company-wide SharePoint overhaul in a single weekend. It creates friction, disrupts daily operations, and frustrates staff.

Instead, pause your Copilot licensing plans for two to three weeks. Use that window to run a structured preparation phase:

First, run an automated access report through the SharePoint Admin Centre to identify sites with wide-open sharing settings.

Second, sit down with department heads - particularly Finance and HR - and have them confirm who truly needs access to their folders today. Strip out legacy permissions ruthlessly.

Third, test your work with a small pilot group. Give Copilot licences to five or ten trusted managers first. Ask them to actively probe the system. Have them prompt Copilot for sensitive topics like salaries, leases, and client disputes to see what surfaces.

If sensitive material appears in their answers, you have found a permission leak without causing an internal crisis. Fix the folder permission, test the prompt again, and only expand the rollout to the wider business once your file permissions reflect your actual organisational boundaries.