How to Clean Up SharePoint Permissions Before Turning on Copilot

Most small and medium-sized businesses have a silent permissions crisis in Microsoft 365. It usually stays hidden because nobody has the time or inclination to click through nested folders looking for files they should not see. Your staff rely on "security through obscurity." If a spreadsheet called `Executive_Salaries_2024.xlsx` is buried four subfolders deep in a general company site, chances are the junior accounts assistant will never stumble across it.

Microsoft Copilot ends that obscurity instantly.

Copilot respects existing permissions. It will never show a user a file they do not have technical access to view. But that is precisely where the danger lies. If your SharePoint permissions are messy, Copilot will treat that mess as an open invitation. If an employee asks Copilot a general question about company performance, and the director pay review folder was accidentally left open to "Everyone except external users" five years ago, Copilot will happily synthesise that data into its answer.

If you are evaluating Copilot, cleaning up SharePoint is not an optional housekeeping task. It is the single most important prerequisite. Here is how to tackle it systematically without grinding daily operations to a halt.

Why Copilot Makes Messy Permissions Dangerous

In an ordinary working environment, search engines in SharePoint are relatively passive. Employees search for specific filenames or exact keywords. If they do not know what to look for, they rarely find it.

Copilot is active and relational. It does not just look for matching keywords; it looks for semantic context. When an employee asks, "What are our biggest operational risks right now?" Copilot scans emails, chats, meeting transcripts, and every SharePoint file that person has read access to. It might pull insights from an unredacted disciplinary file, an acquisition target list, or an internal restructuring memo that was saved in the wrong folder.

The software is not malfunctioning when this happens. It is doing exactly what you paid it to do: retrieving accessible knowledge to answer a question. The failure belongs entirely to your data governance. Before you assign a single Copilot licence, you need to understand who can see what.

Step 1: Identify Your "Everyone" Exposure

In almost every business with 10 to 250 staff, someone has at some point clicked "Share with Everyone" to solve a quick access problem. Over five or ten years, this creates an enormous baseline of overshared data.

Start your cleanup by auditing three common problem areas:

• The default "Everyone except external users" group: This built-in Microsoft group gives access to every licensed user in your tenant. Search for any document libraries or folders where this group has "Read" or "Edit" permissions.
• Public Teams channels: When an employee creates a new Microsoft Team, the default setting is often "Public," meaning anyone in the company can join and view the files. Check your Teams admin centre for teams containing sensitive discussions that were never marked as "Private."
• Company-wide communication sites: Sites meant for general notices (like the staff intranet) frequently contain sub-libraries that hold old operational documents, contracts, or vendor invoices.

Ask your IT provider or internal systems administrator to generate a SharePoint permissions inventory. You do not need a multi-million-pound enterprise discovery tool to start; the native SharePoint Admin Centre reports or basic PowerShell scripts can flag sites where wide-open inheritance is active.

Step 2: Ring-Fence High-Risk Data

Trying to review every single document in your business before turning on Copilot is unrealistic. You will get bogged down in minutiae and abandon the project. Instead, apply the Pareto principle: secure the 20 percent of data that represents 80 percent of your risk.

High-risk data generally falls into four categories:

• Payroll, remuneration, and bonus structures
• HR files, including disciplinary records and grievances
• Executive board packs, strategy decks, and financial management accounts
• Regulated personal information (PII) belonging to staff or clients

The fastest, cleanest fix is isolation. Rather than trying to fix broken permissions on a thousand individual files inside an existing site, create dedicated, locked-down SharePoint sites for these specific functions.

Move the sensitive files into these dedicated sites. Ensure that membership is strictly restricted to named individuals, not broad groups. Break inheritance completely: if a file is in the "Finance and Executive" site, no one outside that core team should have access, period. Once these documents are isolated, Copilot will simply ignore them when responding to queries from the wider team.

Step 3: Tame Anonymous and Company-Wide Links

SharePoint allows users to share documents via links. Over time, staff generate thousands of these links to collaborate on projects, and those links rarely expire.

The most dangerous of these are "Anyone" links (which allow anyone with the URL to view the file without logging in) and "People in your organisation" links (which effectively turn a private file into an open-access document for the entire business).

To regain control before turning on Copilot:

• Disable "Anyone" links at the tenant level if your business does not strictly require anonymous public file sharing. If you do require it, enforce an automatic expiration date of 7 to 14 days.
• Change the default sharing link type in your SharePoint admin settings from "People in your organisation" to "Specific people." This forces employees to consciously choose who receives access, rather than opening the file to the whole company by default.
• Run a report on existing active sharing links and revoke company-wide links on folders that have been inactive for more than six months.

This single administrative adjustment stops the ongoing generation of accidental oversharing while you work through historical cleanup.

Step 4: Establish Simple, Sustainable Ownership

Permissions cleanup is not a one-time project; it is an ongoing operating rhythm. If you tidy your data in January, it will be messy again by July unless you assign clear ownership.

For an SMB, governance does not need to mean endless committees. It means every SharePoint site must have an identified business owner - an actual human being, not an IT ticket queue.

• The Head of Operations owns the Operations site.
• The Sales Director owns the Commercial site.
• The Office Manager or HR Lead owns the People site.

Every quarter, ask these site owners to review the member list for their respective sites. When someone leaves the business, or shifts roles internally, their access should be updated. IT can provide the tools and enforce the baseline policies, but the people who create the data must be accountable for who can see it.

Your Immediate Next Step

Do not let the fear of permissions sprawl stop you from adopting Copilot, but do not ignore it either. The productivity gains of AI are real, yet they depend entirely on the integrity of your underlying platform.

Before you buy licences, pick one department - finance or HR is usually best - and run a test. Ask a non-admin employee to search SharePoint for terms like "salary," "redundancy," or "director expenses." If those searches return documents they should not see, you have your answer. Fix that department first, refine your process, and work outward from there.