Before you switch on Microsoft 365 Copilot, one job is worth doing first: find out who can open what in SharePoint. Copilot does not open anything up. It shows you how open things already were.
This post explains why that matters, where to look and how to work through what you find. For the full version, with a worksheet and a sign-off form, use our free 10-point SharePoint check before Copilot.
What Copilot changes, and what it does not
Microsoft's Copilot privacy documentation says Copilot only surfaces organisational data that a person has at least view permission for. Your existing permissions still apply, and nobody gains access they did not already have.
What changes is the effort involved. Without Copilot, someone had to know a file existed, or stumble across it, before they could read it. With Copilot, they can ask a question in plain English and get an answer drawn from everything they can reach. Picture a pay review saved on a site that was opened to the whole company some time ago. It may have sat unnoticed for a long while. Once anyone can ask about pay, it is much easier to find.
That makes your permissions the thing to review, rather than Copilot itself.
Five places to look first
You do not have to review everything at once. These five cause the widest exposure, so they come first.
| What to look for | Who can reach the content | The usual fix |
|---|---|---|
| "Everyone except external users" on a sensitive site | All internal staff | Replace it with a named group |
| "People in your organisation" links on private files | Any colleague who has the link | Swap it for a link to specific people |
| "Anyone" links with no expiry | Anyone holding the link, with no sign-in | Remove the link or set an expiry date |
| Public teams | Any colleague who chooses to join | Make the team private if its files are not for everybody |
| Guests who never left | Former contractors and partners | Remove the guest's access |
Apply these first to the sites that would hurt most if the wrong person read them: HR, payroll, finance, legal, and anything holding customer records or board papers.
How to find it
The main tools are the data access governance reports in the SharePoint admin centre. Snapshot reports show today's permissions, including the sites with the broadest access. Activity reports show recent behaviour, such as new sharing links and content shared with "Everyone except external users". Microsoft suggests running snapshot reports quarterly and activity reports monthly, so plan this as a routine, not a one-off.
These reports belong to SharePoint Advanced Management. You get its Copilot-related tools once one person in your organisation has a Copilot licence, provided you are on a base plan Microsoft lists: Office 365 E3, E5 or A5, or Microsoft 365 E1, E3, E5 or A5. On a Business plan, check your eligibility before you build a plan around them. Without those tools you can still go through site permissions, sharing settings and guest accounts by hand in the admin centres. It takes longer, but the questions stay the same.
A sensible order of work
- List your risky sites. Note what each one holds and how wide its access is.
- Give every site an owner and a date. A fix with no name against it tends to stay on the list.
- Close the widest access first. Company-wide groups and open links on sensitive sites come before any general tidying.
- Bring in site owners. They know who ought to be there. A site access review lets an admin send the request straight from the reports and track the replies.
- Record a sign-off. Ask each owner to confirm the site is right, so the decision is written down.
- Run the reports again. People keep sharing after launch, so keep checking.
If a site cannot be fixed in time
Restricted Content Discovery hides a chosen SharePoint site from company-wide search and from Copilot's answers while you work on it. It also needs SharePoint Advanced Management, and it has limits. Permissions stay as they were, so anyone with access can still open the files directly. It does not cover OneDrive. Microsoft describes it as a temporary control and advises using it selectively, because heavy use leaves Copilot with less to work from.
Two recent changes are worth knowing if you are reading older advice. Restricted SharePoint Search is retiring: nobody has been able to newly switch it on since 31 July 2026, and Microsoft points to Restricted Content Discovery instead. Copilot in SharePoint began rolling out to general availability on 30 September 2026, and the preview PowerShell settings stopped being honoured on 1 November 2026. Admins now use Site AI settings and Restricted Content Discovery to manage it.
Where an app can help
Working through reports by hand suits some organisations. If you would rather see everything in one place, GovernPoint, our SharePoint app on Microsoft Marketplace, grades every SharePoint Online site from A to F and puts the few fixes that matter most at the top. It finds Anyone links, company-wide links, links that never expire and wide access, down to folders and files. Each fix shows who keeps and who loses access before you approve it, and fully reversible fixes can be undone for 30 days. It runs inside your own tenant, never reads file contents and has a 14-day full trial on install with no licence key.
If Copilot is one part of a wider AI plan, our AI-readiness check for small businesses covers the rest of the picture.
Get the full check
To run this properly, ask for the free Copilot without the oversharing guide, an 11-page PDF sent by email. You finish with a risky sites list, a name and date against each fix, and a signed confirmation from each site owner. To talk through your own set-up, book a free 30-minute call with no obligation.
