Microsoft Copilot does not grant anyone new access. It surfaces what they could already reach. For most organisations that distinction is the whole problem, because what people can already reach is considerably more than anyone intended.
The permissions you forgot you set
A decade of SharePoint sites, shared folders and broad access groups accumulates quietly. Nobody notices that the whole-company group can read the HR site, because nobody browses to it. Copilot browses everything, instantly, on behalf of whoever asked.
The failure mode we see discussed most is an employee asking an innocuous question about salaries or restructures and receiving a well-formatted answer assembled from documents they were never meant to open.
What to do before switching it on
- Audit access on sites holding HR, finance, legal and executive material
- Find and fix anything shared with 'Everyone' or 'All Company' that should not be
- Review sharing links that were set to 'anyone with the link' and never revoked
- Apply sensitivity labels to the categories that matter most
- Pilot with a small, informed group before a general rollout
Governance is not a document
Write down who may use it, for what, and what must never be pasted into it. Then tell people. A policy nobody has read is indistinguishable from no policy, and staff will use these tools regardless — if not the sanctioned one, then a personal account on an unmanaged device.
The safest deployment is the one people do not feel a need to work around.
Done properly this is a few weeks of preparation, not a few months. Done improperly it is an incident that is difficult to explain.