Getting Microsoft 365 ready for Copilot is mostly a permissions exercise. Copilot only surfaces content a user can already open, but it finds that content far faster than a person searching by hand, so files that were quietly overshared in SharePoint, OneDrive and Teams start appearing in answers. Fix the oversharing first, confirm your licensing, data residency and privacy position, and then roll out to a small pilot group before anyone else.
Why Copilot exposes oversharing
Microsoft states that Copilot presents only data that each individual can access, using the same access controls as the rest of Microsoft 365. That is reassuring, and it is also the problem. In most tenants, years of convenient sharing have left payroll spreadsheets, board papers and HR files readable by far more people than intended. Once a staff member can ask "what were the salary changes this year?", any file they can technically open is fair game.
The common causes are predictable:
- Organisation-wide sharing links. "People in your organisation" links work for anyone in the tenant who has the link, and they get forwarded well beyond their original purpose.
- "Everyone except external users". This built-in group grants access to every internal account, and it is often added to sites or folders to "just make it work".
- Public Teams and Microsoft 365 groups. A public team's files are open to the whole organisation.
- Ownerless sites. Old project sites with no active owner rarely get reviewed.
How to find overshared content
Start with what you have. Site permissions and sharing settings can be checked in the SharePoint admin centre, and for a small tenant a manual review of the sites holding finance, HR, legal and executive material is a sensible first pass.
Where licensing allows, SharePoint Advanced Management (SAM) does this at scale. According to Microsoft's SAM prerequisites (opens in a new tab), administrators get the Copilot-related SAM features once at least one user in the organisation is assigned a Copilot licence, or through the separate SAM Plan 1 add-on. Check eligibility against your own base plan. The features most useful for readiness are:
- Data access governance reports, including sharing links activity, "Everyone except external users" insights and permission state reports for sites, OneDrive sites and files.
- Site access reviews, which send a report to the owners of overshared sites so the people who understand the content decide what should stay shared.
- Restricted content discovery, which stops selected SharePoint sites from surfacing in organisation-wide search and Copilot while you review them. Microsoft describes it as a temporary control: it does not change permissions and does not apply to OneDrive.
How to fix oversharing without breaking collaboration
Remove broad access at the source. Replace "Everyone except external users" with the security group or team that genuinely needs the content. Expire or remove organisation-wide links on sensitive files, and change the tenant's default sharing link to "Specific people" so new links are narrow by default. Make sensitive teams private, and archive or delete inactive sites.
Then add a classification layer with Microsoft Purview sensitivity labels. Copilot recognises labels and, where supported, carries the highest-priority label onto new content it creates. If a label applies encryption, Microsoft documents that the user needs both the VIEW and EXTRACT usage rights for Copilot to return the content, so an encrypted "Highly Confidential" label genuinely limits what Copilot can use. Microsoft 365 Business Premium and E3 support manually applied labels; automatic, service-side labelling generally needs E5-level compliance licensing. Keep the scheme simple so staff actually use it.
Copilot licensing realities as at August 2026
Copilot Chat is available at no extra cost to users on eligible Microsoft 365 plans, but the Copilot features inside Word, Excel, Outlook and Teams that draw on your organisation's content need a paid Copilot licence added to an eligible base plan. Microsoft's licensing page lists Microsoft 365 Business Basic, Business Standard and Business Premium among the eligible plans, and Microsoft offers a Copilot Business add-on for organisations with 300 or fewer users on those plans, on an annual commitment. Product names and bundles change often (Microsoft's documentation now frequently calls the product simply "Microsoft Copilot"), so confirm current terms before buying.
You do not need every user licensed to start. A handful of pilot licences is enough to switch on the SAM readiness features.
Where Copilot data is processed in Australia
For tenants signed up in Australia, Microsoft's Copilot data residency documentation (opens in a new tab) confirms that the content of Copilot interactions (prompts and responses) is covered by the Product Terms commitments for data at rest. Processing is a separate question. Microsoft's general Copilot documentation says large language model calls go to the closest datacentres in the region but can be routed to other regions when demand is high. In November 2025 Microsoft announced in-country processing of Copilot interactions for Australia by the end of 2025; an April 2026 update revised that, saying local inferencing is expected to become available in Australia by the end of 2026. As at August 2026, treat in-country processing as announced rather than delivered, and check the current Microsoft Learn pages before making commitments to clients or regulators. Our earlier article on Microsoft 365 data sovereignty in Australia covers the wider residency picture.
Privacy and AI governance considerations
Copilot is a commercially available AI product, so the OAIC's guidance on privacy and the use of commercially available AI products (opens in a new tab) applies directly. It asks organisations to do due diligence before adoption, consider a privacy impact assessment, update privacy notices, use personal information only for its original purpose or with consent, and take reasonable steps on accuracy, such as human review of AI output.
The federal Guidance for AI Adoption (opens in a new tab), published by the National AI Centre in October 2025, replaced the Voluntary AI Safety Standard with six essential practices: decide who is accountable, understand impacts, measure and manage risks, share essential information, test and monitor, and maintain human control. For Copilot, that means a named owner, an acceptable use policy, a risk register entry and a post-pilot review. If you are formalising this, our article on AI governance and ISO/IEC 42001 explains how to structure it.
Copilot readiness checklist
- Appoint an owner for the rollout and agree what Copilot will and will not be used for.
- List the sites, teams and libraries that hold sensitive information and confirm each has an active owner.
- Review and remove "Everyone except external users" and organisation-wide links on sensitive content, and set the default sharing link to "Specific people".
- Make sensitive teams private and archive inactive sites.
- Publish a simple sensitivity label scheme and label your most sensitive content, using encryption where it is warranted.
- Confirm licensing and buy a small number of pilot licences.
- Run data access governance reports and site access reviews, and apply restricted content discovery to high-risk sites still under review.
- Record your data residency position and complete a privacy impact assessment.
- Update your acceptable use policy and privacy notice, and brief staff on checking AI output.
A phased rollout plan
Phase 1: Prepare. Work through the first five checklist items. Most of the effort is here, and it improves security regardless.
Phase 2: Pilot. License a small pilot group across different roles, including someone from finance or HR who will notice if sensitive content appears. Ask them to report anything surprising and use their findings to tighten permissions.
Phase 3: Expand in waves. Add licences by team, removing restricted content discovery from sites as their reviews are completed.
Phase 4: Operate. Make site access reviews, link clean-ups and label checks routine rather than a one-off project.
If you would like help assessing your tenant's oversharing, licensing or rollout plan, get in touch.