How to Clean Your Shared Drives Before Turning on Copilot

Microsoft Copilot does not create security flaws. It simply exposes the ones you have ignored for the past decade.

In most businesses with 20 to 150 staff, the file storage system is held together by good intentions and digital dust. When a company moves from an on-premises server to Microsoft 365, migration tools typically lift and shift years of legacy permissions into SharePoint and OneDrive. Folders labeled "Confidential" sit inside document libraries where the default access level was set to "Everyone except external users" back in 2018.

Until now, you relied on security through obscurity. An intern technically had read access to the executive director pay review spreadsheet, but they would never find it because it was buried seven subfolders deep inside a generic commercial directory.

Copilot strips that obscurity away in seconds. When a team member asks, "What are the latest decisions on staff bonuses?" or "Summarise recent performance issues," Copilot searches every single file that user has technical permission to read. If that file is unlabelled and shared broadly, Copilot will read it, extract the figures, and present them in a polite, bulleted summary.

Before you buy licenses, you need to fix your file permissions. Here is a practical, four-step process to get your shared drives ready for deployment without bringing business operations to a halt.

Stop Trying to Reorganise Folders

The biggest mistake leadership teams make when preparing for Copilot is attempting a full-scale folder cleanup. They ask department heads to go through every folder, delete old documents, and build a neat, logical directory tree.

This approach fails almost every time. It takes months, staff hate doing it, and file organization has zero impact on Copilot. The language model does not care whether a document is stored in a folder called "Current Projects" or one called "Archive 2019 - DO NOT TOUCH". It only cares about two things: - Does the user prompting Copilot have technical read access to the document? - Is the content relevant to the prompt?

Your data hygiene project should focus entirely on permissions and boundaries, not on filing systems. A tidy folder structure with open permissions is still a severe data leak waiting to happen. An untidy archive with strictly locked permissions is completely safe.

Step 1: Audit and Close "Over-Permissioned" Sharing Links

The fastest route to accidental data exposure in Microsoft 365 comes from company-wide sharing links.

Over years of day-to-day collaboration, staff routinely click "Share" on a file and choose "People in your organisation can view and edit" because it is the path of least resistance. That single click turns a private project into a company-wide resource.

Before rolling out Copilot, your IT administrator or managed service provider (MSP) should run a permissions inventory across your SharePoint environment. Look specifically for: - "Anyone with the link" links (anonymous external access, which should generally be blocked at tenant level). - "People in your organisation" links on sensitive folders, financial models, board papers, and HR directories. - SharePoint sites where the default member group includes the entire tenant.

Once identified, break the inheritance on sensitive libraries and replace sweeping tenant-wide links with specific security groups. If a document relates to director remuneration, only the board security group should have access. If a user does not have that explicit permission, Copilot will behave as though the document does not exist.

Step 2: Deal with Redundant, Obsolete, and Trivial Data (ROT)

While Copilot does not care about folder aesthetics, it does care about data quality. If your shared drive contains five versions of your core service agreement spanning eight years, Copilot will struggle to know which one represents your current business practice.

When staff ask Copilot to draft a proposal or generate an answer for a client, an outdated 2017 pricing matrix or a discarded contract draft can easily pollute the response.

You do not need to read every document to tackle ROT: - Move historical archives out of the primary SharePoint sites. Create a dedicated "Cold Storage" or archive site for closed projects older than three years. - Exclude the archive site from search indexing. You can turn off search indexing on specific SharePoint document libraries with a few clicks in the library settings. The files remain safe and retrievable for compliance purposes, but Copilot will ignore them entirely. - Establish a clear policy for current files. Ensure teams work from a single live version rather than generating endless copies named "v2_final_approved_actual.docx".

Step 3: Apply Basic Sensitivity Labels

You do not need to deploy a complex, six-tier classification policy with automated watermarks and rights-management encryption on day one. For most small and medium businesses, simple controls work best.

Set up Microsoft Purview with three basic sensitivity labels: - General: Default status for standard business operations. - Confidential - Internal: Business-sensitive materials such as margins, internal strategies, and non-public commercial terms. - Restricted (or Executive): Strictly segregated files containing payroll, board discussions, legal disputes, and HR records.

Once labels are defined, use Purview to block files with the "Restricted" label from being queried or cited by general staff licenses. This creates a hard programmatic boundary that does not rely on individual folder permissions remaining intact forever.

Step 4: Use SharePoint Advanced Management or Restricted Search

If you discover that your SharePoint sprawl is too extensive to clean up before your planned rollout date, Microsoft provides technical guardrails to mitigate the risk.

One option is Restricted SharePoint Search. This allows administrators to limit tenant-wide search (and therefore Copilot indexing) to a curated list of approved SharePoint sites - typically up to 100 sites that have been vetted and verified as safe.

Everything outside that list is excluded from Copilot's reach, even if a user technically has access, until the site owner can review and certify its permissions. Users can still access their files directly through their normal applications, but Copilot will not proactively pull information from unverified locations.

This feature allows you to pilot Copilot with a specific department or leadership group without waiting six months for a company-wide data cleanse to finish.

What to Do Next

Data cleaning for AI is not an IT project; it is a governance decision. The software can only respect the boundaries you explicitly configure.

Take this week to sit down with your IT lead or outsourced provider. Ask them for a report on two things: how many SharePoint sites currently allow tenant-wide access, and whether any HR or finance folders contain broad sharing links.

Reviewing that report will tell you immediately whether you are ready to license Copilot next month, or whether your business needs a four-week permissions remediation sprint first. Fix the access controls now, and you can roll out AI with confidence instead of anxiety.