How to Clean Up Your File Permissions Before Turning on Copilot

Microsoft Copilot does not bypass your security controls. It honours every single one of them to the letter. And that is precisely why so many small and medium-sized business leaders pause their rollout plans right before hitting the purchase button.

In a normal work environment, poor file permissions stay hidden beneath the surface. If an executive leaves an unencrypted spreadsheet called "Bonus Allocations 2024.xlsx" in a shared drive with broad read access, the odds of a junior staff member stumbling across it are relatively low. Finding it requires browsing into obscure subfolders or typing the exact keyword into a sluggish search bar. The data is unprotected, but obscurity provides a false sense of security.

Copilot shatters that obscurity. Because Copilot works via natural language and cross-references your entire Microsoft 365 tenant, it surfaces information based on contextual relevance rather than exact matches. If an employee asks, "What are the company priorities for executive retention this year?", Copilot will cheerfully pull data from that forgotten spreadsheet if the user has read access.

The tool has not malfunctioned. It has simply done what you asked it to do, using the files you told it the user was allowed to read.

Before introducing Copilot to your team, you must bring your permissions up to standard. Here is how to audit, clean, and structure your file estate without bringing daily operations to a standstill.

Why Copilot Makes Hidden Data Suddenly Visible

Most business owners assume their IT systems are structured like a set of locked filing cabinets. In reality, after five or ten years of growth, an SMB tenant looks more like an open warehouse where people have dropped boxes wherever they liked.

Traditional search engines in SharePoint index keywords. If a user does not search for the exact terms found in a confidential file, they never see it. Copilot indexes meaning. It uses vector embeddings to map concepts, allowing it to connect disparate documents, email threads, and Teams chats.

When you activate Copilot, you remove the friction of discovery. Any document marked with default permissions like "Everyone except external users" or shared through an all-company link becomes fair game.

This is not a technical flaw in Copilot. It is an operational flaw in how files have been stored. Fixing it requires moving away from accidental oversharing and moving toward explicit, deliberate access.

The Four Common Culprits of Oversharing

Before you begin altering file structures, you need to know where the vulnerabilities typically live. In businesses with 10 to 250 staff, permissions break down in four specific ways:

• "Everyone except external users" on sensitive libraries. This default group is frequently added to SharePoint sites when people get tired of managing access requests. If your HR or management team used this shortcut, those files are open to all staff.
• Company-wide view links. When employees share a link to a file, the default option in many tenants is "People in your organization with the link". Over several years, thousands of these links accumulate, turning private documents into open-access assets.
• Abandoned Teams and channels. When a project finishes, the Microsoft Team created for it usually remains active. Sensitive strategy documents, budget calculations, and performance notes linger in the background with broad membership lists that are never reviewed.
• OneDrive sprawl. Staff members often draft high-impact material in their personal business OneDrive, then share it casually with colleagues. When those colleagues leave or change roles, those access grants persist indefinitely.

A Practical Three-Step Clean-Up Process

Attempting to review every single document in your business before turning on Copilot is unrealistic. It leads to analysis paralysis. Instead, focus on a risk-based clean-up that targets high-liability data first.

### Step 1: Run an Inventory of High-Risk Sites Start in the SharePoint Admin Centre. Pull a report of all active sites, their assigned owners, and their current sharing settings. Identify the repositories containing data that would harm the business if exposed internally: - Payroll, bonus schemes, and staff reviews. - Board packs, investor updates, and acquisition notes. - Customer payment records, contracts, and pricing exceptions. - Disciplinary records and legal correspondence.

Check the permissions on these specific sites first. Remove any universal groups, revoke tenant-wide sharing links, and ensure site ownership belongs to the department head rather than an IT mailbox.

### Step 2: Establish "Restricted SharePoint Search" Microsoft recently introduced a feature called Restricted SharePoint Search. This allows administrators to limit Copilot to searching a curated list of up to 100 SharePoint sites, alongside users' personal files (like their individual OneDrive and emails).

This is an invaluable safety valve for SMBs. Instead of waiting months for a total clean-up of 500 legacy sites, you can restrict Copilot's indexing to a small group of verified, low-risk sites (such as standard operational templates, public company policies, and active departmental hubs). You can then clean legacy archives at a manageable pace while staff begin using Copilot safely.

### Step 3: Replace Folder-Level Permissions with Dedicated Sites A common mistake in growing businesses is managing permissions at the folder or file level inside a single monolithic document library. Someone creates an "Operations" site, drops a "Management Only" folder inside it, and breaks permission inheritance.

Folder-level permissions are brittle. They break during migrations, they confuse users, and IT staff cannot easily audit them.

The rule for Copilot readiness is straightforward: structure security at the site level, not the folder level. If a group of files requires restricted access, move those files into a separate, private SharePoint site with its own explicit group of members. Do not rely on nested folder permissions to keep confidential data safe.

Deciding Between Manual Fixes and Automated Tools

As you evaluate how to tackle this work, you have two primary options: manual triage or automated governance via Microsoft Purview.

Manual triage works well if your business has fewer than 50 staff and a relatively tidy file structure. Your leadership team can review their own departmental folders, reassign site owners, and archive inactive data over a couple of weeks. It requires time, but it carries no extra software licensing costs.

Automated governance makes sense if you have over 100 staff, a high volume of client files, or compliance obligations like ISO 27001 or Cyber Essentials Plus. Microsoft Purview allows you to set up Sensitivity Labels (such as "Confidential" or "Internal Only"). These labels enforce encryption and access restrictions automatically, regardless of where a file is saved.

However, sensitivity labels require Microsoft 365 E5 licensing (or specific add-ons) and take deliberate configuration. If you choose this path, treat it as a dedicated governance project. Do not hold up productivity improvements for half a year just to design the perfect automated labeling framework; use site-level isolation and Restricted SharePoint Search in the interim.

The Next Step: Run a Permissions Pilot

Do not roll out Copilot across your whole business in a single day hoping your permissions hold up.

Pick a single department - marketing, operations, or product development are usually safe starting points - and run a two-week pilot with three to five users. Ensure their daily work sites are isolated, verify that your sensitive management directories are excluded, and observe how they use the tool.

Ask the pilot group to deliberately test the boundaries. Have them ask Copilot questions about sensitive operational topics to confirm that your access boundaries are functioning as expected.

Once you confirm that confidential files stay quiet, you can expand access to the wider team with confidence. Data clean-up is rarely exciting, but doing it now ensures Copilot becomes an engine for productivity rather than an accidental disclosure tool.