How to Clean Up SharePoint Permissions Before Turning on Copilot

The most common fear business owners have about Microsoft Copilot is that it will leak confidential data. They worry that a junior administrator will type a casual prompt into Word and receive the managing director's salary details, notes from last month's redundancy discussions, or an unannounced buyout plan.

That fear is entirely rational, but the diagnosis is usually wrong.

Copilot does not hack your systems, bypass your security model, or guess passwords. It respects Microsoft 365 permissions to the letter. If Copilot shows a junior administrator the payroll spreadsheet, it is because that employee already had read access to the file. The difference is that before Copilot, nobody knew the file was exposed because it was buried five folders deep in an old SharePoint site named "General Operations 2019".

In most businesses with 20 to 150 staff, data protection has historically relied on security through obscurity. If an employee did not know a document existed, they never looked for it. Copilot eliminates obscurity overnight. It indexes everything a user technically has permission to see and serves it up in seconds.

Before you purchase licenses and roll out the software, you need to clean up your estate. Here is how to evaluate your current setup and fix your permissions without bringing daily operations to a halt.

The Usual Suspects: Where Hidden Access Lurks

Over years of routine work, SharePoint permissions degrade. Staff create ad-hoc Teams channels, share files with contractors, and use shortcut settings to get work done quickly. When auditing an SMB environment, the vast majority of accidental oversharing stems from four specific configurations:

• The "Everyone except external users" group. This is the default catch-all in Microsoft 365. Well-meaning staff often use it to share a template or policy document across the company. If they apply it to a top-level folder rather than an individual document, every sub-folder inherits that permission, including sensitive working files added years later.
• Company-wide sharing links. When someone creates a shareable link and selects "People in your organisation with the link", that file becomes discoverable to Copilot queries across the entire business.
• Abandoned and unmanaged Teams. Every Microsoft Team creates a backing SharePoint site. When a project ends, the Team often sits dormant. If sensitive budget files were shared inside a public Team rather than a private one, anyone inside the company can read them.
• Broken permission inheritance. When managers attempt to lock down sub-folders manually instead of creating dedicated, private libraries, inheritance breaks. Months later, an administrator resets permissions at the top level, inadvertently exposing the private sub-folders below.

Comparing Your Options: Manual Review vs Automated Tooling

Cleaning this up does not necessarily require hiring a massive enterprise consultancy, but you must choose an approach that matches your internal technical capacity. Most businesses evaluate three paths:

### 1. The Manual Spreadsheet Audit (In-House or via MSP) In this scenario, an internal administrator or your Managed Service Provider (MSP) runs PowerShell scripts or exports site permission reports from the SharePoint Admin Centre into Excel. They review each site collection, flag public sites that should be private, and check site membership lists.

• Advantages: Lowest software cost; gives you an unvarnished look at your raw folder structure.
• Disadvantages: Extremely slow; prone to human error; difficult to detect individual file-level sharing links.
• Best for: Companies with fewer than 30 staff, relatively simple file structures, and fewer than twenty active SharePoint sites.

### 2. Native Microsoft Governance (Purview and SharePoint Advanced Management) Microsoft provides built-in tools for data governance, provided you have the appropriate licensing (such as Microsoft 365 E5 or add-on licenses for SharePoint Advanced Management). These tools offer "Data Access Governance" reports that automatically identify sites with excessive sharing links or wide-open permissions.

• Advantages: Fully integrated into the ecosystem you already use; allows you to set automated sensitivity labels that prevent Copilot from reading specific classes of files.
• Disadvantages: Complex interface; requires higher-tier licensing; requires genuine expertise to configure without locking users out of legitimate files.
• Best for: Businesses already invested in Microsoft E5 licenses with internal IT personnel who understand compliance architecture.

### 3. Third-Party Governance Platforms (e.g. AvePoint, ShareGate) Several independent software vendors specialise in Microsoft 365 migration and security management. These tools sit on top of your tenant, scan permissions continuously, and provide plain-English dashboards highlighting high-risk sites and external sharing risks.

• Advantages: Fast deployment; intuitive reporting for non-technical leadership; automated remediation workflows that ask site owners to verify who should have access.
• Disadvantages: Added annual software subscription costs.
• Best for: Fast-growing firms (50 to 250 users) that lack in-house security specialists and need a clear audit trail quickly.

A Four-Week Clean-Up Roadmap

If you want to prepare for Copilot without causing operational paralysis, avoid trying to audit every single file your business owns. Focus strictly on containment and high-risk data.

### Week 1: Triage and High-Risk Data Identification Identify the sites that hold your crown jewels: Finance, Human Resources, Executive/Board, Legal, and Mergers or Acquisitions. Verify immediately that these document libraries are strictly restricted to verified security groups. Ensure that inheritance from parent sites is severed and that no company-wide sharing links exist in these locations.

### Week 2: Disable Dangerous Sharing Defaults Change your tenant-wide sharing defaults. Set the default sharing link type to "Specific people" rather than "People in your organisation". This forces staff to consciously name colleagues when sharing files, rather than accidentally opening documents to the whole tenant.

### Week 3: Run Pilot User Access Checks Create a test account with the exact security profile of an average junior employee. Use Microsoft Search (which uses the same underlying index as Copilot) to search for terms like "salary", "bonus", "restructure", or "confidential". If that test account can see files it shouldn't, trace the location of those files and fix the site-level permissions.

### Week 4: Restricted SharePoint Search If you are eager to launch Copilot but know you have sprawling legacy sites that will take months to sort out, use Microsoft's "Restricted SharePoint Search" feature. This allows administrators to curate a list of up to 100 approved SharePoint sites that Copilot is permitted to search, completely blinding the AI to the rest of your unreviewed intranet until you have time to clean it properly.

How to Prevent Permission Drift After Launch

Permission clean-up is not a one-time project; it is an ongoing discipline. Within three months of turning Copilot on, staff will share new folders incorrectly if you do not implement basic boundaries.

Establish a quarterly review cadence where department heads - not IT - are required to review the membership of their own Teams and SharePoint sites. IT should provide the list of members; the department head should sign off on whether those individuals still need access.

Crucially, train your staff on how Copilot actually works. When employees realise that saving an unencrypted document into a general channel makes it immediately searchable by their peers, their personal data hygiene improves naturally.

Your Immediate Next Step

Do not wait until licenses are assigned to discover what your staff can see.

Tomorrow morning, ask your IT manager or MSP to provide a list of all SharePoint sites in your tenant marked as "Public", along with a report of any folder where the "Everyone except external users" group has read access. That single report will tell you precisely how much work you have to do before turning Copilot on.