How to Clean Up SharePoint Permissions Before Launching Copilot

You hand a new Microsoft 365 Copilot licence to a project manager. Ten minutes later, they type a casual prompt into Word: "Summarise recent discussions about staff overheads." Copilot reads three board memos, two spreadsheet tabs from an abandoned restructuring plan, and a draft redundancy letter from 2023. It produces a clear, accurate, and completely catastrophic summary.

Copilot did not hack your system. It did not bypass security. It simply searched the files that the project manager technically had permission to read, but would never have stumbled across using standard Windows search or SharePoint navigation.

This is the reality of rolling out Copilot in an organisation between 10 and 250 staff. For years, small and mid-sized businesses have relied on security through obscurity. Sensitive files sat five folders deep inside a general document library. Nobody found them because nobody looked for them.

Copilot looks everywhere it is allowed to look, instantly. Before you assign your first batch of licences, you need to understand where your SharePoint permissions are broken and how to fix them without grinding everyday work to a halt.

Why Copilot Breaks Security Through Obscurity

Microsoft makes a point of advertising that Copilot respects user permissions. If an employee does not have read access to a document, Copilot cannot use it to generate an answer.

That statement is technically accurate, but it gives business leaders a false sense of security. It assumes that your current permissions reflect your actual business policy. In most SMBs, they do not.

Over years of growth, platform migrations, and staff turnover, permissions degrade:

• Staff create "Anyone with the link" or "People in your organisation" sharing links to bypass friction on tight deadlines.
• SharePoint sites created through Microsoft Teams inherit broad, flat access structures that include every member of the team.
• Former project folders contain sensitive pricing models or client dispute notes that remain readable by entry-level staff who joined years later.
• The default "Everyone except external users" group gets added to top-level document libraries to solve a temporary file-locking complaint, and is never removed.

Under normal conditions, these mistakes hide in plain sight. When Copilot arrives, it indexes that content and surfaces it in natural conversation. The fix is not to cancel your AI plans, but to treat data permissions as a mandatory precursor to deployment.

The Three High-Risk Areas to Inspect First

You do not need to audit every single file your business has produced since 2018. That approach is unrealistic for an SMB with limited IT resource. Instead, focus on the three areas where permission sprawl causes genuine commercial damage.

### 1. Finance, Payroll, and Leadership Files Start by identifying where sensitive files live right now. If your finance director stores budgets inside a folder called "Financials" within the company-wide "General" SharePoint site, you have an immediate problem. Move that data into a dedicated, private SharePoint site with restricted membership. Inherited permissions are the enemy here: permissions should be managed at the site level, not broken folder by folder within a shared library.

### 2. Organisation-Wide Sharing Links When staff share documents internally, the default option in Microsoft 365 is often set to allow anyone within the organisation to view or edit the file. Over three or four years, this creates thousands of unmanaged pathways into sensitive documents. You must change the default tenant sharing settings so that links only share with specific individuals, and review existing shared links using the SharePoint admin centre.

### 3. Orphaned or Dormant Microsoft Teams Every team created in Microsoft Teams generates a connected SharePoint site collection behind the scenes. When a project finishes, the team is rarely deleted or archived. It sits unattended, still populated with old client files, subcontractor agreements, or internal reviews, accessible to everyone who was originally added to the group.

Evaluating Your Clean-Up Options

Fixing permissions requires time, software, or outside help. Depending on your internal capability, there are three common paths to consider.

### Option A: The Native Microsoft Route (Manual & Admin Centre) If you have a dedicated internal IT manager and fewer than 50 staff, you can tackle this using the built-in Microsoft 365 Admin Centre and SharePoint Admin Centre.

• How it works: You run out-of-the-box data access reports, check site ownership, disable company-wide sharing links at the tenant level, and manually move sensitive folders into restricted document libraries.
• The upside: No additional software costs. You use the tools already included in your Business Standard or Business Premium licences.
• The downside: It is labour-intensive. Native reports can be clunky, and identifying individual permission anomalies across dozens of sites takes hours of manual checking.

### Option B: Dedicated Governance Software For businesses with 50 to 250 staff, third-party governance tools (such as ShareGate, AvePoint, or Syskit) offer automated reporting on orphaned sites, excessive sharing, and external access.

• How it works: These tools scan your tenant and provide a visual dashboard showing which sites have broad permissions, which links are shared company-wide, and who has access to what.
• The upside: Massive time savings. You can revoke open links in bulk and set automated policies that prevent permission drift in the future.
• The downside: Added cost. These platforms require ongoing subscriptions that can be hard to justify if you only plan to use them for a one-off pre-Copilot tidy-up.

### Option C: Partner-Led Readiness Audits If your internal team is already stretched maintaining day-to-day operations, bringing in a specialist consultancy to conduct a pre-AI data audit is often the fastest route.

• How it works: An external specialist runs targeted permission scans, identifies high-risk exposure points, restructures your SharePoint architecture, and establishes basic data governance policies before licences are assigned.
• The upside: You avoid the trial-and-error phase and eliminate blind spots your internal team might miss. It also creates accountability for getting the work completed quickly.
• The downside: An upfront professional services cost, though this is usually offset by avoiding the productivity drain on your own staff.

Practical Steps to Take This Week

Cleaning up your environment does not require a six-month IT transformation project. You can make substantial progress in a few days by taking a structured approach:

• Turn off company-wide link sharing as the default option in the SharePoint admin centre. Change it to "Specific people" instead.
• Run a search for sensitive keywords (such as "salaries", "redundancy", "confidential", or "board minutes") across your primary SharePoint libraries using a standard user account to see what surfaces.
• Create restricted, separate SharePoint sites for HR, management, and finance, and migrate files out of general folders.
• Review your active Microsoft 365 groups and delete or archive project teams that have been inactive for more than six months.
• Restrict Copilot rollout initially to a small pilot group of senior staff while you complete the broader permission review.

Copilot delivers genuine productivity gains when staff can trust the information it retrieves, and when leaders can trust that private data stays private. The tool works best when your house is in order.

If you are evaluating Copilot licences for your team, your next step should not be buying the software. It should be opening your SharePoint admin console, reviewing your site permissions, and deciding which clean-up route makes the most sense for your operational capacity.