Copilot and access permissions: the oversharing problem

Short answer: Copilot does not grant access to data a user does not have. It does, however, surface easily what a user already has permission to see, even if nobody knew. So the real question before turning it on is who has access to what.

What Microsoft says

• Copilot only surfaces organisational data to which each user has at least view permission.
• Microsoft stresses that you need to use the Microsoft 365 permission models, such as SharePoint, properly so the right people have access to the right content.
• Prompts, responses and data accessed through Microsoft Graph are not used to train the foundation models.

What oversharing looks like in practice

A payroll folder in a SharePoint site opened to “everyone in the company” years ago. A document with a link that opens for anyone who has it. A Teams group with far more members than it needs. Before Copilot, nobody searched for them. Now an ordinary user can find them with one question. The permissions did not change, the ease of finding them did.

What to check before enabling it (our own practical advice)

1. Find sites and groups with an oversized audience, no owner or no activity. Microsoft suggests tools such as SharePoint Advanced Management and Microsoft Purview for identification.
2. Fix the most sensitive first: HR, finance, management, legal. Reduce permissions to the right circle of people.
3. Where temporary protection is needed, Microsoft mentions Restricted Content Discovery, which excludes sites from Copilot discovery, and DLP policy for Copilot.
4. Apply sensitivity labels to content that warrants them. Microsoft lists them as a way to reduce oversharing.
5. Start with a small group of users, try questions that should not be answered and check what appears, before extending.