Fixing Your SharePoint Permissions Before Turning on Copilot

Imagine a junior marketing executive sitting down for their first morning with Microsoft Copilot for Microsoft 365. They type a simple prompt into Teams: "Summarise the key priorities from the last board meeting so I can align our campaign messaging."

Within four seconds, Copilot returns a neat, bulleted summary. It details the company's planned expansion, two major client contract risks, and a confidential plan to restructure the finance department next quarter, complete with proposed redundancy budgets.

Copilot did not hack your system. It did not bypass Microsoft security protocols. It simply read a document stored in a SharePoint folder that an administrator marked as accessible to "Everyone except external users" three years ago.

This is the reality of AI data readiness. Copilot inherits the exact permissions of the user operating it. If your staff technically have read access to a document, Copilot can use that document to answer their questions. In most small and medium businesses, internal permissions are held together by goodwill and obscurity rather than deliberate architecture. Before you spend money on Copilot licences, you need to fix your SharePoint permissions.

The illusion of security through obscurity

Most businesses with 20 to 150 staff moved to Microsoft 365 years ago. The migration usually followed a familiar pattern: an external IT provider lifted data from an on-premises Windows file server and dropped it into SharePoint Online, or staff gradually set up Microsoft Teams channels on the fly.

Over time, structure degrades. Folders get moved. Managers create a Team for a project, invite five people, and make the underlying SharePoint site public to the whole organisation so they do not have to manage access requests. Staff share files using "Anyone with the link can view" because it solves an immediate deadline problem.

Historically, this created few visible problems because of security through obscurity. An employee in customer service might technically have permission to view the executive payroll spreadsheet, but they did not know it existed, did not know its filename, and had no reason to dig through 400 subfolders to find it.

Copilot completely destroys security through obscurity. It does not require a user to know where a file lives or what it is called. It scans the entire Microsoft Graph - the vast web of your emails, chats, meetings, and documents - looking for contextual relevance. If a sensitive file is technically accessible, Copilot will find it, read it, and present its contents directly in chat.

The three permission traps common to growing businesses

Before rolling out Copilot, you need to understand where sensitive data typically leaks within Microsoft 365 environments.

• Public Microsoft Teams: When someone creates a Team in Microsoft Teams, the default setting is often "Public", meaning anyone in the company can join and view files. We frequently find sensitive HR grievances, performance reviews, and buyout discussions stored in public Teams channels.
• Broken permission inheritance: In SharePoint, a library inherits permissions from the parent site, and folders inherit permissions from the library. When managers manually break inheritance to give a contractor access to one specific folder, they often lose track of who has access to the parent folder.
• The "Company-Wide" sharing link: Microsoft 365 allows users to generate links that work for "People in your organisation". These links grant access to anyone inside your tenant. If an employee shares a draft strategy document via this link to three colleagues, that document is now indexed for Copilot for every single employee in the business.

If you turn on Copilot without addressing these three areas, your staff will inadvertently surface payroll data, executive strategy, disciplinary files, and commercially sensitive pricing models.

Evaluating your cleanup options

Fixing permissions feels daunting, especially for business owners who do not have a dedicated internal IT department. You have three main approaches to evaluate, depending on your timeline, internal resources, and the current state of your data.

### Option 1: The manual audit and restructuring For firms with fewer than 30 staff and relatively clean document structures, a manual review is often the most cost-effective path. This involves having site owners review member lists for every SharePoint site, deleting legacy "Company-Wide" links, and moving sensitive folders (such as HR, Finance, and Senior Leadership) into strictly isolated, private sites with explicit permissions.

The downside is time. Business owners often underestimate how long it takes to review permissions across hundreds of folders. If you ask department heads to do this without clear guidance, it will sit at the bottom of their priority list for months.

### Option 2: Technical governance tools and Microsoft Purview For businesses with 50 to 250 staff, manual reviews are rarely sufficient. At this scale, you need programmatic visibility. Microsoft Purview provides features like sensitivity labels, data loss prevention (DLP) policies, and permission audits.

Purview allows you to automatically classify sensitive files - like documents containing bank details or national insurance numbers - and restrict how those files are shared or surfaced. However, Purview requires higher-tier licensing (such as Microsoft 365 E5 or specific add-ons) and specialist expertise to configure without disrupting everyday work.

### Option 3: Restricted SharePoint Search Recognising that many businesses are terrified of Copilot data leaks, Microsoft introduced a feature called Restricted SharePoint Search. This allows IT administrators to restrict Copilot from indexing your entire SharePoint environment. Instead, Copilot only indexes a curated list of up to 100 approved SharePoint sites, alongside users' personal OneDrive accounts, emails, and chats.

Restricted SharePoint Search is an excellent temporary safety net. It allows you to roll out Copilot to a pilot team immediately while your broader SharePoint cleanup happens in the background. It is not, however, a permanent substitute for good data hygiene.

The pre-rollout checklist

If you are evaluating Copilot for your business over the coming quarter, do not start with prompt engineering or staff training. Start with your data architecture.

Take these practical steps first:

• Run an inventory of all active SharePoint sites and Microsoft Teams. Identify which ones are marked Public and switch those containing business data to Private.
• Review your tenant-wide sharing settings. Turn off anonymous sharing links if you do not actively need them for client-facing work.
• Quarantine your most sensitive data. Move payroll, personnel records, and executive board papers into dedicated, permission-locked sites with restricted access.
• Deploy Restricted SharePoint Search if you want to run a quick pilot without waiting for a full six-month data governance project to finish.

Copilot can deliver remarkable efficiency gains for small and medium businesses, but it acts as a mirror to your current digital estate. If your filing system is disciplined, Copilot acts like a brilliant assistant. If your permissions are chaotic, Copilot simply automates the chaos.

The next step is straightforward: ask your IT lead or managed service provider for a permissions report on your top ten largest SharePoint document libraries. See who has access to what today, before an algorithm reveals it to your entire team tomorrow.