What to Fix First in SharePoint, Teams and OneDrive Before Copilot

Copilot finds what your permissions already allow

Microsoft Copilot (formerly Microsoft 365 Copilot) answers from the files, sites, chats and mail a person can already open. Microsoft's privacy and security page for Copilot says it only surfaces organizational data that the user has at least view permission for. Permissions stay as they were. A file shared too widely years ago, though, no longer sits unnoticed, because one plain question can now bring it to the top of an answer.

Most rollouts that pause, pause here. In a July 2026 survey by CoreView, a vendor of Microsoft 365 management software, two-thirds of organizations said they had delayed or cancelled Copilot, and 73 percent of those feared it would surface confidential internal information, as Infosecurity Magazine reported on 23 July 2026. Microsoft's own blueprint for a secure and governed Copilot deployment puts oversharing first as well, ahead of guardrails and regulation.

Below is the order we take the work in, sorted by how much harm one exposed file could do. Each step names the Microsoft control and the evidence a compliance lead can check without opening an admin center. The paper Copilot after rollout picks up where this list ends, with the agent controls that come next.

First: sensitive sites open to the whole company

Start with access granted to everyone. In SharePoint this usually means a site or library shared with the built-in group "Everyone except external users", or a team in Teams created as public, which anyone in the organization can join. On a site with lunch menus that does no harm. On the sites that hold payroll, contracts, board papers or regulatory submissions it is the exposure that matters most, so search those first and remove the company-wide grants before anything else.

You do not have to find them by hand. Microsoft Learn says that once one Copilot license is in your Microsoft 365 environment (the tenant), SharePoint administrators get the SharePoint Advanced Management features for Copilot, which include data access governance reports that show sites with broad permissions and heavy sharing. The page does not name Copilot Business explicitly, so Copilot Business tenants should confirm in the SharePoint admin center. The version of the report that works from sensitivity labels needs E5.

Second: hide the sites that cannot wait

Some sites cannot be fixed before the pilot starts, often because nobody is sure who needs access. For those, SharePoint can hide a site from company-wide search and from Copilot without changing who can open it, which Microsoft calls Restricted Content Discovery. Microsoft describes it as a discoverability control, and it leaves access alone: anyone who already has access can still open the site, and Copilot can still work on a document the user has open in front of them. It does not cover OneDrive, and on a site with more than 500,000 items a change can take more than a week to show in search and Copilot, per the same page, so test it from a normal account once it has taken effect. Treat it as a stopgap with an owner and an end date.

Older guides recommend Restricted SharePoint Search for the same job. Microsoft's documentation for it says new enablement has been blocked since 31 July 2026, that it was capped at 100 sites, and that it "isn't a security boundary". It is retiring, so new plans should use Restricted Content Discovery instead.

Third: sites that nobody owns

A site without an owner cannot be reviewed, because there is nobody to ask who should be in it. SharePoint Advanced Management includes ownership and inactive-site policies that find these sites and ask for an owner or an archive decision. Its site access reviews send the question of who should have access to the site owner rather than to IT. We run these after the company-wide grants are gone, when the lists are short enough for site owners to answer.

Fourth: sharing links and guests

Years of collaboration leave links behind. A link that works for anyone in the organization widens a file's audience inside the company, an Anyone link widens it outside, and a guest added to a team for one project often stays after the project ends. CoreView's chief executive put the cause of delayed rollouts down to "a decade of sharing links and permissions nobody cleaned up", in the same Infosecurity Magazine report. Remove them on the sensitive sites first, then set expiry defaults for new links so they do not pile up again.

Fifth: default labels on the libraries that matter

Labels come after the access fixes, because a label on a file everyone can open protects little. Microsoft 365 Business Premium includes sensitivity labels that people apply by hand, mandatory labeling, and a default label set in the label policy for a group of users, according to Microsoft's Purview service description. A default label on a whole SharePoint library is a separate feature that the same page lists under E5 and the Purview Suite. On Business Premium alone, label the sensitive files in those libraries by hand and set a policy default for the teams that use them.

A label on its own does not keep a file out of Copilot. That takes a data loss prevention (DLP) policy on the location Microsoft names "Microsoft 365 Copilot and Copilot Chat", with sensitivity-label conditions, as Microsoft's DLP for Copilot documentation describes. The policy needs E5-level rights (Microsoft 365 E5, the Purview Suite, or the Purview Suite for Business Premium), and a matching file can still appear as a citation while its content stays out of the answer. Without those rights the hard backstop is encryption, because Copilot needs both the view right and the extract right (permission to take content out of the file) to use an encrypted file, per Microsoft's Purview guidance for AI.

Layers matter because single controls fail. From about 21 January 2026, a Microsoft bug tracked as CW1226324 let Copilot Chat summarize labeled emails in Sent Items and Drafts even though a DLP policy was configured, until a fix was mostly deployed by 20 February, as BleepingComputer reported. We treat DLP as one layer among several, and never as the only thing between a sensitive file and an answer.

Last: the archive

Old project sites and the files of people who left years ago make up most of a large tenant, and they tempt teams into a cleanup project with no end. Leave them for last, but only once the data access governance reports show they hold nothing sensitive with broad access, because the age of a site says nothing about what it contains. The inactive-site policies keep working on them in the background while the pilot runs.

How to show the work is done

A compliance lead should not have to take IT's word for it. The evidence is a before-and-after pair of data access governance reports for the sensitive sites, plus the list of sites under Restricted Content Discovery with an owner and an end date for each, and label coverage on the named libraries. Purview Data Security Posture Management (DSPM), which now sits alongside the classic DSPM for AI experience, surfaces where sensitive data is exposed and recommends policies, as Microsoft's DSPM overview describes.

The same permissions carry over to agents. An agent that retrieves data with the signed-in user's credentials answers with what that user can see, so clean permissions make every later agent safer to publish. Before sharing one, check whether its tools use the maker's credentials instead, which Microsoft's page on maker-provided credentials warns can let users reach data only the maker could. Our guide to knowledge and retrieval for AI agents explains how agents find company data with the right permissions. The SharePoint implementation guide covers the permission model in detail, and the how-to on a knowledge hub Copilot cites correctly shows the target state for one site.

The case for not waiting on a perfect tenant

There is a fair objection to all of this. A full cleanup of a decade of sharing can take longer than the business will wait, and staff who are told to wait may turn to public AI tools instead. Older numbers point the same way. In a Gartner survey of 132 IT leaders from June 2024, reported by Computerworld, now two years old, 40 percent had delayed Copilot by three months or more over oversharing, and 57 percent had limited it to low-risk users.

We side with the second group. A pilot with people whose access has already been reviewed, plus Restricted Content Discovery on the sites you could not fix in time, is a defensible start. The later steps still have to happen before Copilot reaches the whole company. Once the first two are tested from a normal account and the decision group has approved the pilot's scope, the rest can run alongside it.

Where QueryNow fits

QueryNow does this cleanup for companies on Microsoft 365 as the data part of our Copilot AI Foundation service. We run the reports, remove the company-wide grants on sensitive sites with their owners, set Restricted Content Discovery where a site cannot wait, and set up labels and the other controls your licenses include. Before the work starts we tell you whether the Copilot exclusion policy needs an upgrade. IT gets a runbook with the before-and-after evidence. We have set up data and AI foundations for Tillotts Pharma and Burckhardt Compression, both of which started with no labels, DLP or AI policy.