Microsoft 365 Copilot: the oversharing your permissions were hiding until now
Microsoft 365 Copilot respects existing permissions: it grants access to no document the user could not open themselves. That is reassuring, and it is exactly the problem. Years of overly broad sharing, protected until now by obscurity, become reachable through a simple natural-language question.
The end of security through obscurity
Before Copilot, a salary spreadsheet accidentally shared with the whole company often went unnoticed: you still had to know it existed and look for it. With an assistant that can answer "what are the sales team's salaries?", that file surfaces in seconds. Copilot does not create a vulnerability; it reveals the ones that were already there.
The usual sources of oversharing
- "Everyone except external users": this built-in group, added to a site or library, grants access to every internal account.
- "People in your organization" links, often offered by default when sharing, and "Anyone" (anonymous) links.
- Public teams and Microsoft 365 groups, whose content is open to every member of the tenant.
- Broken inheritance: unique permissions on a folder or file that nobody tracks any more.
- Sites with no active owner, after a departure or reorganisation.
Start with tenant settings
Before fixing site by site, stop new oversharing from coming in:
- Set the default link type to "Specific people".
- Limit or disable "Anyone" links, and enforce an expiration date.
- Consider hiding "Everyone except external users" from the people picker.
- Make new teams private by default, for example through container labels.
Reviewing access to existing sites
Through SharePoint Advanced Management, Microsoft provides data access governance reports that identify the most widely shared sites, as well as site access reviews delegated to site owners. Other features let you restrict a site to a specific group or exclude certain sites from Copilot results. The licensing scope and names of these features have changed over recent years: check what is available in your tenant at the time of your project.
Restricted SharePoint Search, which limits organisation-wide search to a list of approved sites, was presented as a temporary measure. It can help during clean-up but does not fix the underlying permissions: files remain reachable by other paths.
Principle. Search and discovery restrictions reduce what Copilot surfaces; only fixing permissions reduces what users can actually open. The two complement each other, but the second is essential.
Add classification
Sensitivity labels with encryption restrict what Copilot can do with a document based on the rights granted to the user. Combined with DLP policies, whose Copilot coverage is still evolving, they protect the most sensitive content even when a permission is too broad.
What an audit checks
- The default sharing link type and the use of anonymous links.
- Sites and libraries open to "Everyone except external users".
- Public teams and groups, and sites without an owner.
- Whether sensitive content carries sensitivity labels.