Switch on Microsoft Copilot without surfacing files nobody should see

Copilot is ready to switch on, and your folders aren’t

You’ve decided to try Microsoft Copilot, or you’ve already bought a few seats. Then someone mentions that Copilot can find anything a person has access to. You think about the SharePoint folder from three years ago that everyone could open, the payroll spreadsheet someone shared by link, and the client files a casual still has access to. Suddenly it’s not clear what a simple question might bring up.

Why Copilot on its own doesn’t keep you safe

Copilot follows the permissions you already have. It doesn’t break into locked files. But it makes open files much easier to find. Before Copilot, a file shared too widely sat unnoticed in a folder nobody opened. With Copilot, someone asks “what are we paying staff this year?” and the answer comes back.

Copilot can’t tell which of your files are sensitive. It doesn’t know that one spreadsheet is payroll and another is a price list. Fixing who can open what is a job for you, before Copilot starts answering questions.

How we set it up with Copilot

We start with a sharing check across your OneDrive, SharePoint, and Teams. We look for folders shared with everyone, links that let anyone with the link open a file, and old staff or contractors who still have access. You get a plain list of what’s open and who can see it.

Then we fix it with you, starting with the files that matter most, like payroll, HR notes, and private client work. We don’t lock everything down, because a team still needs to share. We make sure the private things are private.

Next, we write a one-page guide for your team. It covers what Copilot is good for in your business, what to keep out of it, and which drafts need a second read before they go out. Copilot then goes to one or two people first. A month later we check how it’s being used and whether any sharing has crept back open.

When a Copilot safety check is the right call, and when it isn’t

It’s worth doing before anyone on your team gets Microsoft 365 Copilot, and it’s most urgent if your business has run on Microsoft 365 for years with lots of shared folders.

If you only use the free Copilot chat and never connect it to your work files, the main risk is what people paste in, and plain rules cover most of it. And a sharing check is a snapshot. New files get shared every week, so someone needs to keep an eye on it, whether that’s you or us.

Where to go next

See the wider using AI safely service, or read about Microsoft Copilot and Microsoft 365. For getting real work out of Copilot, see AI for your business with Microsoft Copilot. See how we work with real estate and not-for-profits. When you’re ready, get your AI Starter Plan.