Microsoft Copilot does not have its own security layer. It respects the permissions you have already set across your Microsoft 365 environment, specifically within SharePoint, Teams, and OneDrive. If a staff member has permission to view a file, Copilot can find it, read it, and summarise it for them. The problem is that most UK SMEs have messy permissions they have ignored for years. When you turn on Copilot, that mess becomes a visible liability because the AI makes it incredibly easy for people to find things they were never meant to see.
What Copilot permissions actually mean
When we talk about Copilot permissions, we are really talking about the underlying SharePoint and Entra ID (formerly Azure AD) security model. Copilot acts like a search engine on steroids. It uses a process called Just-In-Time (JIT) access to retrieve information the user is authorised to see at the moment they ask a question. It cannot see files the user cannot access. However, in many organisations, users have access to far more than they realise.
This usually happens because of "oversharing". This is where files or folders are shared with groups like "Everyone except external users" or through "Company-wide" links. In the past, these files were buried in deep folder structures where nobody bothered to look. With Copilot, a simple prompt like "What is the average salary in this company?" could pull data from a payroll spreadsheet that was accidentally saved to a public SharePoint site three years ago. The AI is not breaking into your files: it is simply using the keys you already gave out.
The commercial risk of AI oversharing
For a UK business, the risks of mismanaged permissions are not just technical: they are commercial and regulatory. The Information Commissioner’s Office (ICO) takes a dim view of internal data breaches where staff can access sensitive personal information they do not need for their role. A payroll leak is the classic example, but it could also be disciplinary records, strategic acquisition plans, or client contracts with sensitive pricing.
If an employee discovers they are being paid less than a peer by asking Copilot a casual question, the HR fallout is significant. Beyond internal friction, there is the risk of data exfiltration. If a disgruntled employee knows that Copilot can help them find every sensitive document in the business in seconds, your intellectual property is at much higher risk. Preparing for AI is the best excuse you will ever have to finally fix your data governance. We recommend starting with a Microsoft 365 security review to see exactly where your gaps are before you hand out licences.
How to audit your SharePoint environment
The first step in any Microsoft Copilot readiness project is an audit. You cannot fix what you cannot see. You need to identify which sites are "public" (meaning anyone in the company can join them) and which files have been shared using links that are too permissive.
- Check for Public Sites: In the SharePoint Admin Center, go to Active Sites and filter by "Privacy". Any site marked as "Public" is visible to every single person in your organisation. If your Finance or HR site is public, Copilot will index everything inside it for every user.
- Review "Everyone except external users": This is a default group in Microsoft 365. Many staff members add this group to files when they want to share something quickly. You need to identify where this group has been granted access to sensitive libraries.
- Audit Sharing Links: Users often create "People in your organisation with the link" sharing links. These are dangerous because they are searchable. If a user creates one of these links for a sensitive folder, Copilot can find it and offer it up to others.
- Identify Sensitivity Labels: If you have Microsoft 365 Business Premium, you should be using sensitivity labels. These can be used to exclude certain data from being used by Copilot entirely, providing an extra layer of defence beyond simple permissions.
A pattern we see on most tenants we take on is the "General" or "Company" site having the "Everyone except external users" group as a member, often meaning every historical payroll spreadsheet or director-level memo is searchable by the new apprentice.
The remediation workflow: Cleaning up the mess
Once you have found the overshared data, you need a logical way to clean it up without breaking the business's ability to work. We suggest following this order of operations.
1. Close the widest gates first
Change Public sites to Private. This immediately limits the scope of what Copilot can see for the average user. You can do this in the SharePoint Admin Center. Once a site is private, only the specific members you have added can access the content, and therefore only those members can use Copilot to query that content.
2. Kill the "Company-Wide" links
Using PowerShell or third-party tools, you can identify and remove sharing links that are open to the whole organisation. It is better to force users to share files with specific people or groups. This follows the principle of least privilege: users should only have the access they need to do their jobs, and no more.
3. Implement Sensitivity Labels
This is a more advanced step but highly effective. You can create a label called "Highly Confidential" and apply it to your most sensitive folders. You can then configure Copilot to respect these labels. If a document is labelled as such, you can even set policies that prevent it from being used to generate AI responses at all, even for people who have permission to read the file.
4. Move data to the right place
Often, the reason for oversharing is that the file structure is confusing. Staff put files in the wrong place because the right place is too hard to find or access. Ensure your SharePoint architecture makes sense. Have a dedicated, restricted site for HR, another for Finance, and another for Management. Use Microsoft Intune device management to ensure that only managed, secure devices can access these high-value sites in the first place.
The cost of doing nothing
Consider a hypothetical UK firm with 30 employees. They deploy Copilot without checking permissions. An employee asks Copilot about upcoming redundancies or company bank balances. The AI provides a summary of a document left in a "Public" project folder.
The financial impact is not just the potential ICO fine, which can be up to 4% of global turnover or £17.5 million (whichever is higher), though for an SME, the fine would likely be smaller. The real cost is the 60+ hours of senior management and HR time spent dealing with the internal fallout, the loss of staff trust, and the potential for legal claims regarding data privacy. At an average cost of £50 per hour for management time, that is £3,000 in lost productivity alone, before you even consider the reputational damage.
Three common mistakes we see
- Assuming "Private" means "Secure": A site can be private but still have 50 members who do not need to be there. Just because the general public cannot see it does not mean your data is safe from internal oversharing.
- Relying on "Security by Obscurity": Many managers think that because a folder is five levels deep, nobody will find it. Copilot does not care how many folders deep something is: it sees the flat permissions layer.
- Ignoring OneDrive: Staff often store sensitive company data in their personal OneDrive and then share it with the whole team. These individual shares are much harder to track than site-level permissions and are a major source of AI data leaks.
Frequently Asked Questions
Does Copilot learn from my data to train its public models? No. For Microsoft 365 Business subscribers, your data stays within your "tenant". Microsoft does not use your internal SharePoint files or Copilot prompts to train the global AI models used by other companies. Your data remains your own.
Can I turn off Copilot for specific SharePoint sites? Yes. You can use SharePoint's "Search and Offline Availability" settings to exclude specific sites or libraries from search results. Since Copilot relies on the search index, excluding a site here will effectively hide it from Copilot's view as well.
What is the fastest way to check my permissions? Run a "Sharing Report" from the SharePoint Admin Center. This generates a CSV file showing every unique permission and sharing link across your sites. It is a lot of data to sift through, but it is the most comprehensive native way to see who has access to what.
How Black Sheep Support helps
We don't just sell licences: we make sure your environment is actually ready for them. Our team can audit your SharePoint structure, identify overshared data, and implement the sensitivity labels and permissions needed to keep your business secure. We also handle hardware, broadband, mobile and networking, not just security.
If you are planning to roll out AI and want to ensure your private data stays private
and we will help you map out a secure Copilot roadmap.
Not ready to talk yet? Run our free IT Health Check to assess your business risk and security posture in minutes, no commitment.
Want this handled for you? See Copilot and AI adoption.
Based in Brighton or Hove? We are too: see IT support in Brighton.
