How to Clean Up SharePoint Permissions Before Rolling Out Copilot

Most small and medium businesses run on an unwritten security policy called security by obscurity.

You have a folder called "Confidential" buried five layers deep in a shared drive. You have an Excel spreadsheet containing staff salaries sitting in a general finance document library. You have director meeting minutes saved in a Teams channel that was accidentally set to "Public" three years ago. Nobody has stumbled across these files because nobody spends their workday clicking through hundreds of obscure subfolders.

The moment you switch on Microsoft Copilot, security by obscurity evaporates.

Copilot does not hack your system. It does not bypass your security boundaries. It simply indexes everything a user has permission to view and answers questions based on that data. If an entry-level employee asks Copilot for the latest company financial forecasts, and someone gave "Everyone except external users" read access to the board pack folder back in 2021, Copilot will summarize the document in seconds.

Cleaning up SharePoint permissions is not an optional IT maintenance task. It is the primary prerequisite for rolling out Copilot safely. Here is a pragmatic, step-by-step approach to auditing and fixing your data access before giving your team access to AI.

Understand How Copilot Surfaces Data

Before you touch a single folder, you need to understand the mechanism at work. Copilot uses the Microsoft Graph API. Graph sees whatever the individual user account can see across SharePoint, OneDrive, Teams, and Exchange.

When a user prompts Copilot, the system runs a search behind the scenes using that user's identity. It retrieves matching text snippets and feeds them into the large language model to generate an answer. If permissions are loose, the search perimeter is wide open.

Three common SharePoint habits create 90 percent of the exposure risk in SMBs: - Broken inheritance: Folders inside a library that have unique permissions detached from the parent site, making them invisible to standard folder audits. - "Anyone" or "Company-wide" sharing links: Links created by staff to share a single document that inadvertently grant persistent access to the entire organization. - Over-provisioned Teams: Microsoft Teams creates a SharePoint site behind every team. If a team is set to Public, every single document inside it is readable by all internal staff.

Your goal is not to lock down every document until work grinds to a halt. Your goal is to eliminate indiscriminate broad access to sensitive information.

Step 1: Identify and Quarantine Your Sensitive Zones

Attempting to audit every single file in your organization before deploying Copilot will lead to analysis paralysis. For a company of 20 to 200 staff, you likely have tens or hundreds of thousands of documents. Auditing them one by one is impossible.

Instead, take a triage approach. Identify the specific categories of data that would cause commercial, legal, or cultural damage if exposed internally: - Payroll records and staff remuneration details - Disciplinary records, performance appraisals, and HR notes - Board papers, strategic plans, and acquisition discussions - Bank details, tax filings, and detailed management accounts - Sensitive customer data or intellectual property under strict non-disclosure agreements

Once identified, check where this information lives. If it lives inside a broader departmental site (for example, payroll spreadsheets sitting inside a general "Human Resources" site that all staff can access for leave forms), move it immediately.

Create dedicated, restricted-access SharePoint sites for high-risk functions. An executive team site, an HR-restricted site, and a finance-confidential site. Keep membership of these sites strictly limited to the individuals who require daily access to perform their roles.

Step 2: Eliminate Company-Wide Sharing Links

Sharing links are the silent killer of data governance in Microsoft 365. When a team member clicks "Share" on a document to send it to a colleague, the default option in many unconfigured tenants is "People in your organization with the link".

This creates a hidden permission grant. The document now shows up in organization-wide searches, and Copilot will happily read it to answer queries from any employee.

To address this: - Review tenant sharing defaults: Change your default link sharing setting in the SharePoint Admin Center from "People in your organization" to "Specific people". This forces staff to name the exact individuals who need access. - Audit existing links: Use the SharePoint Admin Center to run a data access governance report on sharing links. Identify documents with wide-open sharing links and revoke them. - Clean up OneDrive: Remind managers that OneDrive is intended for personal drafts, not long-term storage of business-critical or sensitive files. Check that personal OneDrives do not contain shared company assets with broad access grants.

Step 3: Shift from Individual Permissions to Group-Based Access

A common failure mode in growing businesses is assigning permissions directly to individuals. John leaves, Sarah takes over, but John was explicitly added to thirty-five individual folders over four years. Sarah is given access to some, forgotten on others, and John's account remains a tangled web of direct permissions until he departs.

Direct permissions make auditing nearly impossible. You cannot see at a glance who has access to what.

Standardize on group-based access: - Use Microsoft 365 Groups or Security Groups: Grant access to SharePoint sites and libraries exclusively via groups (such as "Finance-Members" or "Leadership-Team"). - Stop breaking folder inheritance: When someone needs access to a single file inside a secure folder, do not break inheritance on that subfolder. Either move the file to a location they can already access, or re-evaluate why they need that specific document. - Audit site members, not file permissions: When access is managed strictly by group membership, an audit becomes as simple as reviewing the 5 to 10 members of a group once a quarter.

Step 4: Use Restricted SharePoint Search While You Clean Up

If you are eager to roll out Copilot to a small pilot group but know your SharePoint environment requires several months of deep cleaning, Microsoft offers an interim safety measure called Restricted SharePoint Search.

Restricted SharePoint Search allows administrators to turn off organization-wide search for Copilot and standard enterprise search. Instead, you specify an allowed list of up to 100 SharePoint sites that Copilot is permitted to index and search.

This feature is particularly useful for SMBs: - It limits Copilot's reach exclusively to curated, vetted sites (such as your intranet, product documentation, and public company policies). - It completely cuts off access to unreviewed, legacy sites where sensitive data might be lurking. - It allows users to gain value from Copilot across their emails, calendar, chats, and approved files without risking an accidental leak of sensitive corporate data.

Restricted SharePoint Search is not a permanent substitute for good data hygiene, but it is an effective tool to control risk during an initial deployment phase.

The Clear Next Step

Do not wait until licenses are purchased to look at permissions. Run a discovery audit this week.

Have your Microsoft 365 administrator log into the SharePoint Admin Center and generate an "Active sites" report. Filter by site visibility: look specifically for any site marked "Public" that contains the words HR, Finance, Executive, Management, or Operations.

Fixing those public sites and removing wide-open sharing links will solve the majority of your immediate risk, giving your organization a secure, stable foundation for AI adoption.