Cleaning Your Company Files Before Turning on Copilot: A Practical Checklist

Before you hand your team access to Microsoft Copilot, consider a common scenario. An employee asks Copilot a harmless question: "What is our policy on compassionate leave?"

The tool does not just look at the official staff handbook. It scans every document that the employee has technical access to across SharePoint, Teams, and OneDrive. If a director saved an unredacted spreadsheet containing salary reviews, redundancy scenarios, or grievance notes into a folder marked "General" five years ago, Copilot can read it. Worse, Copilot might summarise that exact spreadsheet to answer the question, because the file matched the semantic search criteria and the user technically had read permissions.

Copilot does not create security breaches. It honours existing permissions. The problem is that most businesses with 10 to 250 staff have chaotic, porous permissions that have accumulated over a decade of quick fixes, staff departures, and hurried migrations.

If you turn on Copilot without tidying your estate, you will not get an intelligent assistant. You will get a magnifying glass held up to your worst data management habits.

Here is a practical checklist to clean your files and secure your environment before rolling Copilot out to the business.

Audit Broad Permissions and "Everyone" Access

The single biggest risk factor with Copilot is oversharing. In a typical Microsoft 365 environment, users create teams and SharePoint sites without realising that the default setting often allows anyone inside the company to view the contents.

Run an audit focusing on three common problem areas:

• The "Everyone except external users" permission: In many tenants, staff share files or entire document libraries by selecting this option because it is quick and avoids permission requests. Search for sites and folders where this group has read or write access, and revoke it where sensitive operational, financial, or personnel data exists.
• Broken permission inheritance: When a manager breaks inheritance on a subfolder to hide private files, but leaves the parent folder open, mistakes happen during future reorganisations. Wherever possible, keep sensitive files in dedicated, restricted SharePoint document libraries rather than hidden inside subfolders of open sites.
• Stale guest access: Review the external users who still have access to your client files, project boards, or internal notes. While Copilot only runs for licensed internal users, external sharing links often muddy internal permission inheritance.

If you do not have dedicated IT staff to run PowerShell scripts for this, look at the built-in access review tools in the Microsoft Purview portal, or work with a partner to generate an oversharing report across your top ten most critical SharePoint sites.

Clear Out the ROT (Redundant, Obsolete, and Trivial Data)

Copilot is an index-based engine. If you ask it to write a proposal for a prospective client, and your file system contains six different versions of a similar proposal from 2018, 2021, and last month, Copilot might combine out-of-date pricing with current service descriptions.

AI cannot automatically distinguish between historical context and current policy unless you give it clear signals. You must tackle "ROT" data:

• Redundant files: Multiple duplicate copies of the same document saved across three different department folders. Pick one source of truth, archive the rest, or delete them.
• Obsolete files: Old strategy decks, outdated terms of business, and superseded employee policies. If a document is no longer active, move it to an archived site that is excluded from everyday indexing, or apply retention labels that dispose of files after a set period.
• Trivial files: Drafts with names like "Proposal_v2_final_final_edit.docx", meeting recordings from three years ago, and automated report exports that nobody reads.

You do not need to clean every single file in the business before deploying Copilot. Focus on the core operational hubs: Finance, HR, Executive Leadership, and Sales. A smaller volume of high-quality, current data will yield vastly better results from Copilot than a sprawling archive of digital clutter.

Relocate Business Data Trapped in Personal OneDrives

One of the quietest productivity killers in mid-sized businesses is the habit of using personal OneDrive accounts as primary project storage.

When an employee drafts a critical standard operating procedure or an account plan in their personal OneDrive and shares it via a direct link, two problems occur. First, if they leave the business, that knowledge is at risk of being deleted during offboarding. Second, Copilot struggles to weigh the authority of a file stored in a personal drive compared to one stored in an official, structured SharePoint library.

Establish a firm operational rule: - Personal OneDrive is for personal drafts, working notes, and temporary scratchpads. - SharePoint and Microsoft Teams are for shared company assets, client work, operational guidance, and finalized policies.

Migrating shared work out of individual OneDrives and into well-managed SharePoint document libraries ensures that Copilot indexes the right documents for the right teams.

Apply Sensitivity Labels to Block Indexing Where It Matters

You do not have to rely solely on folder permissions. Microsoft Purview allows you to create sensitivity labels (such as "Confidential" or "Highly Confidential") that apply encryption and strict access controls to specific files.

For SMBs, keeping Purview simple is critical. Avoid designing ten different tiers of classification that staff will ignore. Instead, start with two or three simple rules:

• Restrict sensitive libraries entirely: If your Board or HR team has a site, you can configure SharePoint settings to exclude that entire document library from organisation-wide search. If standard search cannot index it, Copilot cannot use it to generate answers for unauthorised users.
• Apply basic encryption: A "Confidential - Executive" label can be applied to merger discussions, payroll files, and director-level correspondence. Even if a file is accidentally moved into a public folder, the encryption prevents unauthorised accounts from opening it or Copilot from reading its text.

Run a Controlled Pilot Before Turning the Switch

Never turn Copilot on for all staff simultaneously. A phased deployment lets you catch permissions gaps quietly before they turn into internal incidents.

Select a pilot group of five to ten staff across different seniority levels, including at least one person who is not technically minded. Ask them to spend their first week asking deliberate, probing questions: - "What are our staff salaries?" - "What disciplinary actions were taken this year?" - "What are the notes from the last board meeting?"

If Copilot surfaces information that those users should not see, you have exposed an overshared file or an incorrectly configured library. You can fix the underlying permission issue immediately, with zero reputational damage.

Once your pilot users can run standard daily workflows without uncovering sensitive surprises, you can expand access to the wider team with confidence.

If you are currently evaluating Copilot licences, pause the purchase order for two weeks. Use that time to audit your top SharePoint sites, remove open access to legacy files, and set up your core folder boundaries. The return on your software investment will be substantially higher, and your business data will stay where it belongs.