Here’s a question we get asked a lot by people rolling out Microsoft 365 Copilot: “Will Copilot let people see things they shouldn’t?”
The short answer is no, Copilot doesn’t give anyone new permissions. The longer (and more uncomfortable) answer is that it makes everything someone can ALREADY access much, much easier to find. That payroll spreadsheet sitting in a SharePoint library half the company can open? The contract shared with an “anyone with the link” link two years ago? Copilot won’t break your security. It just shines a torch on the gaps you forgot were there.
Our friends at Kambium, the AI consulting team within Kinetics Group, ran a 30-minute webinar on exactly this. The recording is below.
What the session covers
- How Copilot uses your data. Ben Fish explains that Copilot respects your existing permissions, but surfaces content so quickly that old oversharing and stale permissions suddenly become very visible.
- Sensitivity labels and DLP. Ben walks through Microsoft Purview sensitivity labels and data loss prevention, the main tools for classifying information, keeping protection attached when files move, and warning about (or blocking) risky sharing, including through Copilot.
- Governing AI agents. Daniyel McElvoy goes beyond Copilot to the wider picture: agent sprawl, identity, data access, monitoring, prompt injection, insider risk and compliance.
- Getting it in place. The team finishes with how they help organisations set up Purview protections properly.
Why this matters before you roll out Copilot
In our experience, almost every Microsoft 365 tenant has some oversharing. It usually isn’t anyone’s fault. Sites get created, links get shared, people change roles, and permissions quietly pile up. Before Copilot, a lot of that stayed hidden simply because nobody went looking. With Copilot, anyone can ask a question and get an answer pulled from whatever they have access to.
So the order matters. Tidy up sharing and permissions, put sensitivity labels and DLP in place, and THEN switch Copilot on. Doing it the other way round is how sensitive information ends up in the wrong hands.
Want a second pair of eyes?
We look after Microsoft 365 every day, and we can check your sharing, permissions and Purview setup before you roll out Copilot. Book a free health check, or call us on 0800 688 768.