How to Clean Up Your SharePoint Data Before Launching Copilot

Most business owners assume their internal files are reasonably secure simply because nobody has complained. Then they test Microsoft 365 Copilot. Within the first week, a junior staff member asks a casual question about operational plans and receives an answer referencing senior executive salaries, a pending disciplinary case, or an unannounced redundancy plan.

Copilot does not bypass your security controls. It does not hack your systems. It respects your existing Microsoft 365 permissions to the letter.

The real issue is that your permissions are almost certainly a mess.

Over five to ten years of normal operation, small and medium businesses accumulate vast amounts of digital debris. Teams channels get spun up and forgotten. Staff share folders using company-wide links because it is faster than managing access requests. Sensitive HR documents get saved in general project directories.

When humans search SharePoint, they use clumsy keyword searches and rarely dig past the first three results. Copilot, however, searches exhaustively. It reads, synthesises, and surfaces everything a user has permission to view. If you are preparing to roll out Copilot, cleaning your SharePoint data is not optional. It is the single most important technical prerequisite.

Here is a practical, phased approach to get your SharePoint data clean, secure, and ready for AI.

Step 1: Run an Honest Permissions Audit

Before you delete or move a single file, you need to understand who can see what. In most SMBs with 20 to 150 staff, the biggest risk comes from two default groups: "Everyone" and "Everyone except external users".

For years, well-meaning employees have clicked "Share" on a document and selected "Anyone in your organisation with the link can view". Over time, those links accumulate. The result is hundreds of sensitive files sitting in plain sight, waiting for an AI to index them.

To address this, start with your SharePoint and Microsoft 365 Admin Centers:

• Run a Data Access Governance report in the SharePoint Admin Center. This report highlights sites with the highest number of company-wide sharing links or open permissions.
• Look specifically for your most sensitive data pools: Finance, Human Resources, Board papers, and client contracts. Check the membership of the underlying Microsoft 365 Groups.
• Look for broken permission inheritance. When managers create subfolders inside open libraries and try to restrict access manually, inheritance breaks, creating blind spots that standard site audits miss.

The goal here is not perfection. The goal is to identify your high-risk sites and strip back broad access before Copilot maps them.

Step 2: Use Restricted SharePoint Search as a Shield

Many SMB leaders stall their Copilot deployment because the prospect of auditing ten years of SharePoint files feels overwhelming. They worry they will need to spend six months reorganising file trees before anyone can use a single license.

Microsoft recently introduced a feature specifically designed to solve this dilemma: Restricted SharePoint Search.

Restricted SharePoint Search allows administrators to turn off tenant-wide indexing for Copilot. Instead of letting Copilot read every SharePoint site across the organisation, you supply a curated list of up to 100 approved sites.

Copilot will only reference: - Files in the user's personal OneDrive. - Files and chats the user has actively opened or participated in. - The approved SharePoint sites you explicitly whitelist.

This feature is a sensible middle ground for smaller businesses. It allows you to pilot Copilot with leadership or specific departments immediately, using tightly controlled reference libraries, while you clean up the rest of the company file system in the background.

Step 3: Tackle the ROT (Redundant, Outdated, and Trivial Data)

Copilot does not just surface private data; it also surfaces wrong data. Large language models struggle when faced with conflicting information. If your SharePoint holds five different versions of an employment policy or three different templates for a master services agreement, Copilot will guess which one to use. Often, it guesses incorrectly.

This is the problem of ROT: Redundant, Outdated, and Trivial data.

To clean this up without drowning in manual file reviews:

• Archive inactive sites. If a project completed three years ago, move the entire SharePoint site to "Read-Only" or export it to an cold archive that is excluded from search.
• Clean up duplicate file trees. SMBs often have legacy network shares that were migrated wholesale into SharePoint, sitting right next to newer Teams-based file libraries. Delete or disconnect the legacy copies.
• Standardise active documentation. Maintain a single "Source of Truth" document library for policies, templates, pricing, and client-facing materials. Train staff that if a document is superseded, the old version must be moved to an archive folder, not left sitting beside the new version with "_v2_final" appended to the filename.

Step 4: Segment High-Risk Data into Dedicated Site Collections

Folder-level security inside a shared SharePoint site is fragile. It takes one distracted administrator or site owner to change parent permissions and expose an entire sub-tree of confidential records.

The safest architecture for Copilot readiness is physical site separation:

• Move sensitive functions into dedicated, private SharePoint sites. Finance, HR, Executive Leadership, and Legal should each have their own private site collections backed by private Microsoft 365 Groups.
• Disable sharing links outside of site members for these high-risk areas. If someone wants to share a payroll file, they should not be able to generate a link that works for the wider company.
• Avoid multi-purpose sites. If a project involves an external subcontractor or junior staff, do not host internal budget forecasts inside the same site library.

When access is controlled at the site level rather than the folder level, managing Copilot's boundaries becomes dramatically simpler. You can inspect site membership in seconds and know with certainty who has access to the content within it.

Step 5: Establish Simple Rules Staff Will Actually Follow

Technical controls will fail if your team does not understand how their day-to-day habits affect AI search. You do not need a forty-page compliance policy, but you do need three baseline operational rules:

• OneDrive is for drafts; SharePoint is for published work. When a document is unfinished or sensitive, keep it in personal OneDrive storage until it is ready for the team.
• Stop using "Organisation-wide" sharing links. Default your tenant sharing settings to "People with existing access" or "Specific people" to force deliberate sharing decisions.
• Assign an owner to every team site. Every active site must have an identified person responsible for reviewing membership lists once a quarter.

What to Do Next

Do not let SharePoint clean-up indefinitely delay your adoption of modern tools. Equally, do not roll out Copilot across your business assuming your current file security is sufficient.

Start small. Run the Data Access Governance report in your SharePoint Admin Center this week to identify your top five most exposed sites. If the results look chaotic, enable Restricted SharePoint Search and run your pilot inside a controlled environment.

You will get the productivity benefits of Copilot straight away, without the risk of an embarrassing data leak on day one.