How to Clean Up Your SharePoint Permissions Before Turning on Copilot

When you hand an employee a Microsoft 365 Copilot licence, you give them an assistant that can read, summarise, and connect information from across your entire business in seconds. Copilot does not hack your systems. It does not bypass existing access controls or guess passwords. It respects your existing security model completely.

That is precisely why so many business owners should be worried.

In most small and medium-sized firms, permissions have drifted over five, ten, or fifteen years. An old folder containing staff salaries was shared via a company-wide link during a budget review in 2021. Board meeting minutes were saved to a general "Operations" site because someone needed quick feedback. A grievance procedure document sits in a folder where "Everyone except external users" has read access.

Until now, security through obscurity kept you safe. Nobody found those files because nobody knew what keywords to type into the clunky SharePoint search bar. Copilot changes that entirely. If a user asks, "What are the key concerns about our cash flow this quarter?" or "Summarise recent management discussions about restructuring," Copilot will happily read every document that user has technical permission to view and provide a neat summary.

Before you switch Copilot on, you need to clean your data estate up. Here is a practical, step-by-step approach to fixing SharePoint permissions without bringing daily operations to a halt.

Identify and Isolate Your Crown Jewels

You cannot review every file across hundreds of gigabytes of SharePoint data before launch, and you should not try. An exhaustive review of every historical document will take months and stall your AI adoption indefinitely.

Instead, focus on your high-risk data first. For almost every SMB, this falls into four categories: - Payroll and compensation details, including bonus structures and pension contributions. - Human resources records, particularly disciplinary files, redundancy plans, and performance appraisals. - Executive and board communications, including acquisition targets, financial distress indicators, and partner disputes. - Client commercial terms, non-disclosure agreements, and sensitive intellectual property.

Map where these files live right now. In many businesses, you will find sensitive files scattered across department-level sites because people store files where it is convenient, not where it is secure.

Create dedicated, tightly restricted SharePoint document libraries for these categories immediately. Move the sensitive files into them, and strip all permissions back so that only the specific individuals who require daily access are named. If a site contains payroll information, three people in the business should have access, not thirty.

Dismantle Company-Wide Sharing Links

The single biggest source of permission leaks in Microsoft 365 is the "Share" button. By default, users looking to collaborate quickly often generate links set to "People in your organisation with the link can view" or "Everyone except external users".

Over time, this creates hundreds of open backdoors into confidential folders. A manager shares a single document, but accidentally shares the parent folder. Five years later, every new junior hire technically inherits access to that folder on their first day.

To fix this, administrators need to review and neutralise these broad sharing links: - Run a site usage and sharing audit from the SharePoint admin centre to see which sites have high volumes of company-wide shared links. - Revoke existing organisation-wide links on any site containing operational, financial, or personnel information. - Tighten tenant-wide sharing defaults so staff can only share links with "Specific people" by default, forcing intentional sharing rather than broad broadcast links.

Changing these defaults will cause minor friction for staff who are used to sending open links across Teams. That friction is healthy; sharing sensitive company data should always be a deliberate act.

Stop Breaking Permission Inheritance

SharePoint operates on a hierarchy: Site, Document Library, Folder, and File. By default, items lower down inherit the permissions of the level above them.

The trouble starts when well-meaning managers start "breaking inheritance" at the subfolder level. A department head wants their team to access a general site, but wants one subfolder hidden, so they manually modify permissions on that single folder. Two years later, that manager leaves, someone re-shares the parent site, and the custom permissions either fail or create a blind spot where nobody knows who can see what.

To prepare for Copilot, enforce a clean structure: - Minimise permissions managed at the folder or file level. If a set of files requires different access rights from the rest of the site, it belongs in a separate document library or a completely separate SharePoint site. - Use Microsoft 365 Groups or security groups to manage access, rather than naming individual users on files. When an employee changes roles, removing them from the group should instantly revoke their access across the board. - Check legacy sites for broken inheritance using the built-in "Check Permissions" tool on sensitive document libraries.

Compare Your Cleanup Options: Manual, Automated, or Phased

Depending on the size of your team and the state of your files, you have three realistic paths to tackling this work.

The first option is a manual audit conducted by department heads. This costs nothing in software licences, but it costs significant management time. You assign each team lead their own department site and ask them to verify member lists and remove legacy users. This works reasonably well for firms with fewer than 30 staff, but it is prone to human error.

The second option is using Microsoft Purview and SharePoint Advanced Management. These enterprise tools scan your tenant, flag sites with excessive sharing, and apply sensitivity labels that restrict access automatically based on file contents. For firms between 50 and 250 staff, the licensing cost is often justified because it removes the guesswork. However, setting Purview up properly requires technical expertise and careful policy planning.

The third option is a phased deployment paired with SharePoint site exclusion. You do not have to expose your entire SharePoint estate to Copilot on day one. You can use administrative controls such as Restricted SharePoint Search to limit Copilot to a vetted list of safe sites while you clean the rest of your data in the background.

For most SMBs, the third option is the most pragmatic. It allows you to start generating value from your Copilot investment with a pilot group while preventing the AI from indexing unvetted archives.

Your Immediate Next Step

Do not wait for a formal company-wide data transformation project to begin securing your files.

Pick your single most sensitive document repository this week - usually your finance or HR folder. Run an access report on that library, identify every user who currently has permissions they do not need, and strip those permissions back to a strict need-to-know group. Once you see how many legacy permissions exist in your most important folder, you will have the exact blueprint you need to tackle the rest of your tenant.