A Montréal engineering consultancy turns on Copilot for its twelve managers. A week later, a project lead asks it to summarize "the latest discussions about the reorganization." The answer cites an HR document about upcoming layoffs.
Nobody hacked anything. The document sat in a SharePoint site open to the entire organization for two years. Before Copilot, you had to know it existed to stumble on it. Now, all it takes is the right question.
That's oversharing: overly broad access that sat dormant until an AI assistant made it visible. The good news is that Microsoft provides the tools to find and fix it before you roll out.
TL;DR
- Copilot doesn't create new access: according to Microsoft, it only shows what the user can already view. The risk is the overly broad permissions you already have.
- By default, SharePoint sets sharing to the most permissive option (Microsoft Learn, 2026): tighten that first.
- As soon as one user has a Microsoft Copilot licence, your admins get SharePoint Advanced Management tools to find and contain oversharing.
- Law 25: an employee who can reach personal information they don't need for their job is a compliance problem (s. 20).
Why Copilot exposes oversharing
Microsoft Copilot (formerly Microsoft 365 Copilot) only surfaces organizational data to which each user has at least view permission, according to Microsoft Learn documentation updated in 2026.
That's reassuring, but it shifts the problem. Copilot reaches into your email, chats, meetings and documents through Microsoft Graph. A file that everyone "could" open, without anyone knowing, becomes a file anyone can find with one sentence.
The usual sources of oversharing at a small business:
- SharePoint sites or Teams teams set to public internally;
- files shared with the "Everyone except external users" group;
- sharing links that work for the whole organization, or for anyone with the link;
- permissions changed folder by folder that nobody understands anymore;
- ownerless sites left over from finished projects.
Microsoft also states that prompts, responses and data accessed through Graph aren't used to train foundation models. The risk you need to manage is mostly internal.
Microsoft's tools to find and contain oversharing
Microsoft bundles these tools in SharePoint Advanced Management, which is included with the Microsoft Copilot licence: as soon as one user in your organization has a licence, SharePoint administrators get access (Microsoft Learn, 2026).
| Tool | What it does | Worth knowing |
|---|---|---|
| Data access governance reports | Find the sites with the broadest permissions, recent sharing links and content shared with the whole organization | Microsoft recommends snapshot reports quarterly and activity reports monthly |
| Content Management Assessment | A guided report: potentially overshared content, inactive or ownerless sites | Rerun every 30 days, per Microsoft |
| Site access reviews | Ask site owners to review their own permissions | Useful when IT doesn't know who should have access |
| Restricted Access Control | Limits a site to a specific group, even for people who had a link | For payroll, HR, sensitive client files |
| Restricted Content Discovery | Removes a site from Copilot responses and organization-wide search without changing permissions | A temporary control; doesn't apply to OneDrive |
| Sensitivity labels (Microsoft Purview) | Encrypt sensitive documents; Copilot honours the usage rights granted | Manual labelling included in Business Premium and E3; automatic labelling with E5 or an add-on |
Be careful with Restricted Content Discovery: it's a bandage, not a cure. People who already have access can still open the files, and Microsoft warns that overuse makes Copilot's answers less complete. As for data loss prevention (DLP) that stops Copilot from processing certain files and emails, the Microsoft Purview service description limits it to E5 licences and certain Purview add-ons.
8 steps before you deploy Copilot
Before assigning licences to the whole team, work through these eight steps in order; the first few cost nothing.
- 1. List your sensitive content: payroll, HR, client files, bids, contracts, health information. Note where each lives.
- 2. Tighten sharing: SharePoint admin center, Policies, Sharing. Default links limited to specific people, expiry on links open to anyone, or turn those links off.
- 3. Assign a first Copilot licence to a single person: your SharePoint admins then get the reports. Run the site permissions report and the "Everyone except external users" report.
- 4. Clean up: remove that group and organization-wide links from sensitive sites; launch site access reviews with owners.
- 5. Contain: Restricted Access Control for HR and finance sites; Restricted Content Discovery, temporarily, for sites not yet cleaned up.
- 6. Label your most sensitive files with a label that encrypts the content.
- 7. Run a pilot with three to five people and ask Copilot the awkward questions: salaries, performance reviews, layoffs, social insurance numbers, passwords.
- 8. Govern usage: retention and audit logging for interactions in Microsoft Purview, a short training session, a monthly report review.
Our Microsoft 365 security audit article covers the other settings to check at the same time, and our piece on generative AI data leaks covers the usage policy.
What Law 25 means for a Copilot rollout
Quebec's Law 25 doesn't mention Copilot, but its section 20 states exactly the rule oversharing breaks: employees may access personal information only if it's needed for the performance of their duties.
Three other sections come into play:
- Section 10: security measures must be reasonable given the sensitivity, quantity and distribution of the information. A payroll file open to everyone is hard to defend.
- Section 3.6: access not authorized by law to personal information is a confidentiality incident. If Copilot shows personal information to an employee who doesn't need it, the event may need to go in your incident register and be assessed for risk of serious injury.
- Section 3.3: a project to acquire or overhaul an information system involving personal information requires a privacy impact assessment (PIA).
Microsoft also says that customers outside the European Union may have their queries processed in the U.S., the EU or other regions, something to document under section 17. Outside Quebec, federal and provincial privacy laws raise similar questions. These are legal calls: confirm your analysis with legal counsel.
After rollout: staying in control
Oversharing creeps back as soon as people start collaborating again: schedule a monthly review of activity reports and a quarterly review of permission reports, as Microsoft recommends.
A few habits to keep:
- Remove Restricted Content Discovery from a site as soon as it's cleaned up.
- Turn on the site ownership and inactive site policies included with the Copilot licence, so sites don't end up orphaned.
- Control agents: in the Microsoft 365 admin center, administrators choose which agents are allowed in the organization.
- Review access whenever someone changes roles: Copilot follows the person's permissions, not their new job.
A 30-person business doesn't need a governance team to get there. It needs one serious first pass, then a routine. If you'd like an outside review to handle that first pass, our Microsoft 365 and Google Workspace audit covers sharing in SharePoint, OneDrive and Teams, a solid starting point before Copilot.
Frequently asked questions
Can Copilot see every file in my company?+
No. According to Microsoft, Copilot only surfaces data the user has at least view permission for. But if a payroll folder is shared with the whole organization, every employee has that permission, and Copilot can cite it in an answer. The real control is your SharePoint, OneDrive and Teams permissions.
How do I stop Copilot from accessing certain SharePoint files?+
Fix overly broad permissions first. Microsoft then offers Restricted Access Control, which limits a site to a specific group, and Restricted Content Discovery, which temporarily removes a site from Copilot responses and organization-wide search. Sensitivity labels with encryption also limit what Copilot can use, based on the usage rights granted to each person.
Does Microsoft Copilot use our data to train its AI?+
According to Microsoft's documentation, prompts, responses and data accessed through Microsoft Graph aren't used to train foundation large language models, including those used by Copilot. Interactions are stored under the same contractual commitments as your other Microsoft 365 content. The main risk is internal: oversharing.
Do we need a privacy impact assessment before rolling out Copilot?+
Often, yes. Quebec's Law 25 requires a privacy impact assessment for any project to acquire, develop or overhaul an information system involving personal information (s. 3.3). An assistant that draws on your email and client files usually fits that description. Involve your privacy officer from the start and confirm with legal counsel.
Sources
- 1.Microsoft Learn: Data, Privacy, and Security for Microsoft Copilot
- 2.Microsoft Learn: Get ready for Microsoft Copilot with SharePoint Advanced Management
- 3.Microsoft Learn: SharePoint Advanced Management features in Microsoft Copilot licenses
- 4.Microsoft Learn: Restrict discovery of SharePoint sites and content
- 5.Microsoft Learn: Data access governance reports for SharePoint sites
- 6.Microsoft Learn: Microsoft Purview service description (licensing)
- 7.LégisQuébec: Act respecting the protection of personal information in the private sector (P-39.1)