How to Clean Up SharePoint Permissions Before Turning on Microsoft Copilot

Microsoft Copilot does not break your security model. It respects it completely. In fact, it respects it so thoroughly that it will happily surface sensitive payroll spreadsheets, executive minutes, and redundancy plans to any employee who asks - provided that file was accidentally saved with company-wide read access three years ago.

In most businesses with 10 to 250 staff, security has historically operated on a principle of obscurity rather than strict access control. Files were technically open to everyone, but nobody found them because SharePoint search was clunky and people rarely went digging through dormant subfolders.

Copilot ends security by obscurity. It searches across your entire Microsoft 365 tenant in seconds, connecting disparate pieces of information to answer direct natural-language prompts. If an inquisitive junior employee asks, "What are the salary bands for senior managers?" Copilot will parse whatever documents it has permission to read and provide a summary.

Before you purchase licences or flip the switch, you need a disciplined clean-up. Here is how to evaluate and fix your SharePoint permissions so you can deploy Copilot without sleepless nights.

Understand the Root Cause: Permission Debt

Over years of normal operation, every small and medium business accumulates what can be called permission debt. This happens through three common mechanisms:

• The default "Everyone except external users" group: When staff create new folders or document libraries, they frequently share them using broad defaults to avoid permission requests later.
• Company-wide sharing links: Staff routinely generate links configured as "People in your organisation with the link can view" to share a quick update, inadvertently leaving sensitive material indexable by anyone in the company.
• Broken permission inheritance: A folder deep inside an otherwise restricted site has custom permissions applied because a contractor or manager needed temporary access, and that access was never revoked.

Copilot does not generate new data out of thin air. It simply aggregates and presents what is already accessible. Cleaning this up is not about building an impenetrable fortress; it is about ensuring that common-sense boundaries actually exist in your digital workspace.

Step 1: Identify and Triage Your High-Risk Sites

Trying to audit every single file in your tenant before rolling out Copilot will lead to analysis paralysis. For a mid-sized business, that could mean tens of thousands of documents. Instead, adopt a triage approach based on risk.

Start by listing your top-tier sensitive data repositories. In almost every business, these sit across four categories:

• Finance: P&L statements, banking details, tax returns, and cash flow projections.
• Human Resources: Salaries, performance reviews, disciplinary records, and staff personal data.
• Leadership and Board: Strategy decks, acquisition targets, partner disputes, and meeting minutes.
• Legal and Client Contracts: NDAs, high-value commercial agreements, and dispute documentation.

Log into the SharePoint Admin Centre and pull an active sites report. Look closely at the "Privacy" column. Any site containing data from the four categories above must be marked as "Private". If an HR or Finance site is marked as "Public", anyone in your business can join it or view its contents, and Copilot will index it for all users immediately.

Step 2: Audit Link Types and Revoke Blanket Access

The next major culprit is link sharing. Microsoft 365 allows users to create several types of links when collaborating. The most dangerous for internal governance are organisation-wide links.

To contain this, you need to tighten tenant-wide defaults and audit existing shares:

• Check your tenant sharing settings: Ensure your default link type is set to "Specific people" rather than "People in your organisation". This forces staff to consciously select who receives access, rather than broadcasting it company-wide.
• Review site-level access: Inside sensitive sites, check the "Site permissions" panel. Check the Members group. If you see "Everyone except external users" nested inside the site Members or Visitors group, remove it immediately.
• Use built-in access reviews: If you have Microsoft 365 E5 or Entra ID Governance licences, run automated access reviews. If you are on Business Standard or Business Premium, this must be done manually by inspecting the site access panels for high-risk document libraries.

If you have folders with broken permission inheritance - where subfolders have different permissions from the parent site - consider resetting them to inherit from the parent. Simpler structures are far easier to govern than complex webs of custom folder-level rules.

Step 3: Use Restricted SharePoint Search While You Clean Up

Many leadership teams realise their data is untidy and decide to postpone their AI initiatives by six or twelve months while they conduct an exhaustive data migration. This is rarely necessary.

Microsoft recently introduced a feature called Restricted SharePoint Search (RSS). Designed specifically for organisations preparing for Copilot, RSS allows administrators to restrict Copilot's enterprise-wide search to an allowed list of up to 100 curated SharePoint sites, alongside users' personal OneDrive files and chats.

This provides an immediate, practical safety valve:

• You can turn on Copilot for an initial pilot group without exposing uncurated legacy sites.
• Staff only get AI-assisted search across verified, safe public repositories - such as company policies, product sheets, and general operational guides.
• Your IT team or managed service provider gains breathing room to audit, clean, and archive older sites in the background.

Restricted SharePoint Search is not a permanent substitute for sound data governance, but it is an effective bridge. It lets you test the operational value of Copilot without betting the house on historical folder permissions being perfect.

Step 4: Shift Accountability to Department Heads

IT administrators can configure settings, run diagnostic scripts, and enforce policies, but they do not know who should actually have access to the quarterly bonus spreadsheet. Data ownership belongs to the business, not the technical team.

Schedule a one-hour working session with each department head. Walk them through their SharePoint sites and run a simple test:

• Look at the member list: Are former employees or people who switched departments still listed?
• Look at the active folders: Are there legacy folders containing data that should be archived or deleted under your retention policies?
• Run test queries: Have an administrator run test queries using standard Microsoft 365 search to see what surfaces for a standard user account.

When department heads see that a general staff member can find commercial contract drafts through normal search, they quickly understand why permission hygiene matters.

What to Do Next

Do not let fear of data exposure stall your technology plans, but do not flip the switch blindly either.

Your immediate next step is practical: run a site permissions report across your tenant this week. Identify which sites house your most sensitive financial and personnel files, confirm they are set to Private, and eliminate the "Everyone except external users" group from those locations. If you have years of unstructured file sprawl, enable Restricted SharePoint Search so you can pilot Copilot safely while your remediation work continues.