MICROSOFT
Copilot and Microsoft AI: what has to be true in your tenant first
5 min read
Microsoft 365 Copilot does not grant new access; it makes existing over-permissive sharing findable, which is why permission and labelling work belongs before a rollout rather than after the first complaint.
The sentence that matters in every Copilot discussion is this: Copilot can see what the user can already see. It is not a new permission model. It is a very efficient search across the one you already have.
In a tenant where permissions have been managed carefully, that is reassuring. In a tenant where a site was set to organisation-wide sharing in 2021 so one contractor could read one file, it is the moment that decision becomes visible to everyone.
Nothing has been breached. Something has been found. The work is the same either way, and it is better done before the rollout than during it.
Find what is shared with everyone
The first task is an inventory of broad access: sites and libraries shared with Everyone, Everyone except external users, or an all-company group, plus anonymous sharing links that have no expiry.
Most tenants have more of these than anyone expects, and most were created for a reason that ended years ago. Each one needs a decision, not a bulk change — some of them are deliberate and correct.
- Sites and libraries with organisation-wide access
- Anonymous or company-wide sharing links without expiry
- Teams created for a project that ended, with their files still broadly readable
- Personal OneDrive content shared widely, which is easy to miss and common
Decide what sensitive means, then label it
Sensitivity labels are how you tell the platform which content needs different handling. They are worth having regardless of Copilot, and a rollout is a good forcing function for the decision.
The usual mistake is a taxonomy with nine labels, which nobody applies correctly. Three or four, with clear names and automatic application where the content is identifiable, is more useful than a complete scheme that is ignored.
Clean up the dead content
A large part of what Copilot surfaces unhelpfully is not sensitive, just wrong. Old versions of policies, superseded price lists, draft documents that were never deleted. The model has no way to know which document is current.
Retention and lifecycle policies address this, and so does the less sophisticated approach of archiving the sites belonging to projects that ended. Both improve the answers people get.
Then pilot narrowly
Start with a group whose content you have reviewed, and ask them specifically to report answers that drew on something they did not expect to be able to see. That is the signal you are testing for, and it will not appear in a usage dashboard.
Expand once the reports stop. The pace is set by how quickly the permission work completes, not by licence availability.
The honest summary
Copilot readiness is mostly information governance with a deadline attached. The tasks are ones that were always worth doing and never urgent enough to schedule.
That is not a reason to delay the rollout. It is a reason to be clear that the work is permissions and content lifecycle, not AI configuration, and to budget for it accordingly.
Questions we get asked
Can Copilot show a user something they could not otherwise open?
No. It operates within the user's existing permissions. What changes is discoverability: content that was technically accessible but buried becomes easy to surface, which is why pre-existing oversharing turns into a visible problem at rollout.
How long does Copilot preparation take?
It depends almost entirely on the state of SharePoint and OneDrive permissions. A tenant with disciplined site provisioning may need a few weeks. One with years of ad-hoc sharing and no lifecycle policy should expect months, and should phase the rollout behind that work.
Are sensitivity labels required before using Copilot?
Not required, but they are the mechanism for treating some content differently once Copilot is in use. Without them the only lever is access itself, which is blunter and harder to maintain.