Somewhere in your SharePoint right now, a folder from years ago is waiting for someone to ask it the wrong question.
Copilot permissions work from whatever Microsoft 365 file permissions your business already has in place, so old sharing habits become visible the moment Copilot goes live.
Cloud Geeni’s earlier guide on shadow AI covered staff using unapproved AI tools outside of IT’s visibility. This piece looks at Copilot data security inside an approved, business-grade tool used by many Manchester businesses and the permissions gaps sitting inside it long before Copilot arrived.
The Problem Nobody Warns You About: Copilot Only Knows What Your Permissions Already Allow
Copilot only works with files a user can already open. It doesn’t bypass a single permission you’ve set.
The risk comes from how those permissions built up over time. Sharing a SharePoint site or OneDrive folder “with my organisation” defaults to Everyone Except External Users, a group that includes every employee.
It’s the easiest option to click, and folders shared this way often stay that way for years, long after the original reason for sharing has passed. Copilot is simply the first tool fast enough to surface that drift.
A Realistic Example of Oversharing Most Businesses Don’t Know They Have
A Manchester manufacturing business shared a folder of salary review spreadsheets with the whole organisation back in 2021, instead of two specific colleagues.
The folder stayed that way. This year, a marketing assistant asks Copilot to summarise recent team changes for a staff newsletter, and Copilot surfaces salary figures for people she has never met, using Microsoft 365 file permissions the business had already granted.
This is what Copilot permissions gaps look like in practice, and Cloud Geeni sees the same pattern across most SME reviews for Copilot data security. Common risk categories include:
HR folders shared broadly for one appraisal cycle and left open
Client contracts shared with a wider team for a single project
Finance spreadsheets shared for a sign-off, never revisited
IT credentials shared during a one-off migration
How to Audit Your SharePoint and OneDrive Permissions Before Rollout
Microsoft has built specific tools for exactly this problem, and running them before Copilot goes live takes a fraction of the time a manual review would. A sensible audit usually covers the following ground:
Pull a site permissions report from the SharePoint admin centre to see your organisation’s overall access exposure across sites and OneDrive accounts in one place.
Search specifically for anything shared with Everyone Except External Users, since this is where most accidental oversharing tends to live.
Review sharing links created with edit access rather than view-only access, particularly on anything containing financial, HR or client data.
Check whether leavers from the past few years still have live access to anything, since account deactivation doesn’t always clean up folder-level permissions that were granted separately.
Flag the sites containing your most sensitive content, such as HR, payroll, legal and executive folders, so these can be locked down first while the wider review is still underway.
Microsoft 365’s data access governance reporting flags high-risk sites automatically, and SharePoint Advanced Management adds site-level access reviews on top of that for businesses running Copilot at scale. Deciding what to do with the results is where an IT support partner earns its keep.
Governance Steps to Take Alongside a Copilot Rollout
While an audit fixes what’s already overshared, Copilot rollouts pair that one-off clean-up with a small number of ongoing governance habits, most of which take less effort to maintain than to set up in the first place.
Apply sensitivity labels to your most important folders, so HR, finance and legal content carries protection that travels with the file.
Set a review cadence, ideally every quarter, for sharing links and group memberships on your highest-risk sites.
Give someone in the business clear ownership of permissions decisions, so requests to share something broadly get a second opinion.
Build a short, easy-to-understand policy covering what Copilot can and can’t be used for, alongside the technical controls.
Pilot Copilot with a small group first, so any permissions gaps surface in front of five people.
Most of these steps run in parallel with licensing and setup. That means a business with tidy permissions from the outset tends to get through them considerably faster than one starting with years of accumulated sharing to untangle.
Why This Has to Happen Before You Switch Copilot On
A 2026 report from data security firm Concentric AI found that 16% of business-critical data across the organisations it studied was overshared, working out to an average of around 802,000 files at risk per organisation.
That level of exposure looks like the ordinary state of a Microsoft 365 tenant that’s been growing and sharing files for years without a permissions review, and it means Manchester SMEs are likely carrying similar risk today.
Copilot data security starts with the file permissions you already have. Getting Copilot permissions right before rollout typically involves:
Reviewing Microsoft 365 file permissions across your highest-risk SharePoint and OneDrive sites.
Fixing overshared folders with a simple re-share and a sensitivity label.
Giving someone in the business clear ownership of Copilot permissions decisions.
Building this check into your Copilot rollout plan from the start.
Cloud Geeni works with Manchester businesses to review Copilot permissions and build this governance into a Copilot rollout, so the tool adds value from day one.
FAQs
What is Copilot data security, and why does it matter for a Microsoft 365 rollout?
Copilot data security covers everything involved in keeping Copilot’s access to your Microsoft 365 content appropriate. Since Copilot works from your existing permissions rather than a separate access system, tightening data security before rollout matters more than any setting inside Copilot itself.
What are Copilot permissions, and how do they differ from a typical software licence?
Copilot permissions aren’t a separate setting inside the app. Copilot inherits whatever SharePoint and OneDrive permissions a user already has, so reviewing those permissions is effectively the same as reviewing what Copilot can see and summarise on that person’s behalf.
How do Microsoft 365 file permissions affect what Copilot can surface?
Microsoft 365 file permissions are the entire basis for what Copilot returns. If a file, folder or site is accessible to a user through SharePoint or OneDrive, Copilot can search it, summarise it and quote from it. Tidying up Microsoft 365 file permissions before rollout is one of the most effective steps a business can take to control what Copilot surfaces.
Can Copilot access files a user wouldn’t normally be able to open?
Copilot cannot access files a user wouldn’t normally be able to open. It only works with files a user already has permission to access through the standard Microsoft 365 permission model, and it doesn’t grant new access or bypass any existing control. Fixing the underlying permissions solves the oversharing risk.
How long does a SharePoint and OneDrive permissions audit take before a Copilot rollout?
For most Manchester SMEs, an initial audit using Microsoft’s own reporting tools takes a matter of days rather than weeks. The bigger time investment usually goes into deciding what to do with the results, particularly around long-standing sharing links and leaver access, which is where an experienced IT support partner can speed things up considerably.
Ready to Find Out What Your Permissions Have Been Hiding?
Get in touch with the Cloud Geeni support team to book a permissions review before you switch Copilot on.
