The finance director asks Copilot for a breakdown of project costs and gets the team’s salary table in the answer as well. Nobody hacked anything. The spreadsheet sat on a SharePoint site that had been shared with “everyone in the organisation” a few years earlier, because that was simpler during the move from the file server. For years nobody found it, because nobody was looking. Copilot looks every time.
That is the main risk associated with Microsoft 365 Copilot: not a new vulnerability, but old permissions that an AI assistant suddenly makes visible. This guide explains what Copilot sees, where oversharing comes from, and which Microsoft tools let you get it under control before and after Copilot is switched on. The feature descriptions reflect the state of Microsoft Learn documentation as of 10 November 2026.
Can Microsoft 365 Copilot see every file in the company?
No — Copilot only surfaces organisational data to which the individual user has at least view permissions. That is how Microsoft describes it on the Data, Privacy, and Security for Microsoft Copilot page (updated 9 July 2026). Copilot uses the same underlying access controls as other Microsoft 365 services, so it sees no more than the user asking the question.
This answer is only half reassuring. A user often has view permissions to far more files than they realise: through membership of broad groups, through sharing links and through sites open to the whole organisation. Before Copilot, those files were protected mainly by obscurity. An assistant that searches everything the user can access removes that protection.
Two other points from the same page matter to the security team. Prompts, responses and data accessed through Microsoft Graph are not used to train foundation language models. Interaction data, meaning the prompt and the response with citations, is however stored in the service, and an administrator can review it through Content search or Microsoft Purview.
It is also worth knowing that Microsoft is changing its naming. The privacy page already uses the name “Microsoft Copilot”, while the Purview pages on DLP and auditing use “Microsoft 365 Copilot”. In this article we use Microsoft 365 Copilot for the assistant that works on organisational data. The coding assistant GitHub Copilot is a different product with a different set of risks, which we cover in the article on what GitHub Copilot is and how to use it.
What is the oversharing risk in Microsoft 365?
Oversharing is a state in which data is available to a wider group of people than its purpose requires — and Copilot turns that excess access into actual exposure. Microsoft states plainly in its Purview documentation that generative AI amplifies the problem and risk of oversharing or leaking data.
The sources of oversharing in a typical tenant are recurring. The first is broad groups: sites and teams shared with “Everyone except external users” or with a group covering an entire department. The second is sharing links created for convenience — for everyone in the organisation or for anyone with the link. The third is broken permission inheritance, when a single folder or file gets its own, often broader, permissions than the site it sits on.
The fourth source is the hardest to notice: old sites. Projects from several years ago, migrations from file servers, sites left behind by employees who have gone. Nobody uses them, so nobody watches their permissions, but their content is searched just like the content of current projects. That is where spreadsheets with personal data, old contracts and exports from HR systems most often sit.
The broader background to this problem, AI tools used in the company outside IT’s control, is covered in the guide on how to detect and reduce shadow AI. Copilot is an approved tool, but it inherits exactly the same permission neglect that leads to leaks with shadow AI.
How do you review permissions before switching Copilot on?
The review starts with the Data access governance reports in the SharePoint admin center, which show sites with potentially overshared or sensitive content. Microsoft describes them on the Data access governance reports for SharePoint and OneDrive sites page (updated 9 July 2026).
The reports fall into two groups. Snapshot reports show the state on the day they are generated: site permissions across the organisation, all sites a specified user can access, and sites containing files with specific sensitivity labels. The site permissions report helps you find places with the broadest access, for example with external guests or the “Everyone except external users” permission.
Activity reports track events that may indicate oversharing over the last 28 days, according to the reports documentation: sites where users created the most sharing links, and sites where content was shared with all internal users. These reports help you catch new cases before they become entrenched.
A report is only a task list. Permissions are cleaned up by site owners, because only they know who really should have access to a given project. The role of IT and security is to set the order — sites with personal data, finance and HR documents first — and the rule that will apply once the cleanup is done: access based on the principle of least privilege, meaning only as much as the work requires.
How do you limit the scope of Copilot search in SharePoint?
While permissions are being cleaned up, Microsoft recommends Restricted Content Discovery — a site-level setting that removes the site’s content from organisation-wide search and from Copilot responses. The feature is described on the Restrict discovery of SharePoint sites and content page (updated 11 October 2026).
Restricted Content Discovery does not change permissions. Users who have access to the content can still open it directly, and the content is not removed from the search index. The site does, however, stop appearing in organisation-wide search results and Copilot responses, and AI entry points such as the Copilot button disappear from its pages. The feature works only for SharePoint sites, not for OneDrive.
Microsoft describes it as a temporary governance control and recommends using it selectively, because excessive use reduces the completeness of Copilot’s answers. A typical scenario is to temporarily restrict the finance or HR sites until their owners have reviewed the permissions, and then lift the restriction.
The older solution, Restricted SharePoint Search, is being retired: according to the feature page, new enablement has been blocked since 31 July 2026, and Microsoft points to Restricted Content Discovery as the replacement. The same page stresses that Restricted SharePoint Search, which is based on an allow list of sites, is not a security boundary. The same logic applies to both features: they buy time for the cleanup, but they do not replace it.
Key takeaways:
- Copilot shows data the user has at least view permissions to — including data shared by accident.
- Data access governance reports point to the sites with the broadest access and new sharing links.
- Restricted Content Discovery temporarily hides a site from Copilot but does not change permissions.
- Restricted SharePoint Search is being retired and is not a security boundary.
How do sensitivity labels and DLP in Microsoft Purview protect data from Copilot?
Sensitivity labels with encryption limit what Copilot can do with a file’s content, and DLP policies in Microsoft Purview let you exclude files with specific labels from responses and block prompts containing sensitive data. Both controls work only if the company has an orderly data classification.
According to Microsoft Learn, Copilot honours the usage rights granted to the user when data is encrypted by Microsoft Purview Information Protection. The Microsoft Purview data security and compliance protections for Microsoft 365 Copilot and other generative AI apps page (updated 27 May 2026) specifies the condition: when a label applies encryption, the user must have the EXTRACT usage right, as well as VIEW, for AI apps to return the data. A label that grants only the right to view therefore keeps the document’s content out of Copilot’s answer.
The second layer is DLP in Microsoft Purview with a policy location dedicated to Copilot. The Microsoft Purview DLP for Microsoft 365 Copilot and Cowork page (updated 9 November 2026) describes four uses: blocking web search when a prompt contains sensitive information types, blocking the processing of prompts containing such data, excluding files and emails with specific labels from responses, and excluding emails from external domains as a source for responses. Two of these features, blocking prompts with sensitive information types and excluding external emails, are in preview according to that page.
When configuring, keep two details from the documentation in mind. A single rule cannot combine the sensitive information types condition with the sensitivity labels condition — you need separate rules in the same policy. Files excluded by a label rule still appear in the citations of a response, but Copilot does not use their content, so the user will see that such a document exists.
These mechanisms protect data inside Microsoft 365. Leaks through other AI tools, for example public chatbots used from private accounts, require a broader set of controls, which we describe in the article on how to stop data leaks to ChatGPT and AI assistants.
How do you audit Copilot interactions and manage their retention?
User interactions with Copilot are logged automatically as part of Audit (Standard) if the organisation has auditing enabled — no additional configuration is needed. This is described on the Audit logs for Copilot and AI applications page (updated 26 August 2026).
CopilotInteraction records contain information on who used Copilot, when and in which application, as well as an AccessedResources field listing the resources Copilot accessed to prepare its answer. For each resource the record can include the ID of its sensitivity label. That lets you answer the question that will come up at the first incident: did Copilot use a document labelled as confidential, and whom did it summarise it for?
Auditing also covers administrator activities related to Copilot settings. According to the same page, interactions with non-Microsoft AI applications are billed on a pay-as-you-go model, so the scope of auditing needs a deliberate decision if the company allows other tools.
Retention is the other side of the same issue. Copilot interaction data is stored in the service, and an administrator can apply retention policies to it in Microsoft Purview. The rules should be set together with the data protection officer: retention that is too short will hamper incident analysis, and retention that is too long will increase the amount of personal data held.
How do you control web search, plugins and agents in Copilot?
The administrator decides which agents and extensions are available in the organisation, and web search can be restricted through privacy settings and DLP policies. Each of these features sends part of the context outside the organisation’s data, so each needs its own decision.
For web search, Copilot picks terms from the prompt that could improve the answer and, based on them, sends a query to the Bing Search service. The Copilot privacy page notes that turning off optional connected experiences can affect the availability of web search. A more precise control is the DLP rule described above, which blocks web search only when the prompt contains sensitive data.
Agents extend Copilot with access to external tools and services. According to Microsoft Learn, in the Integrated apps section of the Microsoft 365 admin center the administrator can see the permissions and data access an agent requires, as well as its terms of use and privacy statement. The administrator also chooses which agents are allowed in the organisation.
Two further details are worth remembering. Microsoft offers third-party models in Copilot, and according to the privacy page, models provided by Anthropic as a subprocessor are currently excluded from the EU Data Boundary. When reviewing agents and models, you therefore need to check not only permissions but also where the data is processed. Rights to configure these settings should be assigned in line with Microsoft’s own recommendation: roles with the fewest permissions and as few Global Administrator accounts as possible.
What should you check before switching Copilot on?
Before switching Copilot on, check permissions, search scope, labels, DLP rules, auditing and retention, and the rules for agents — in that order, because each step builds on the previous one. The list below links these steps to Microsoft tools and the people who should own them.
| Area | What to check | Microsoft tool | Owner |
|---|---|---|---|
| Site permissions | sites available to the whole organisation, with external guests or with anyone links | Data access governance reports in the SharePoint admin center | SharePoint administrator with site owners |
| Sensitive sites under review | whether finance, HR and board sites can be temporarily excluded from Copilot search | Restricted Content Discovery | SharePoint administrator |
| Sensitivity labels | whether confidential data has labels with encryption and whether only the right people have EXTRACT rights | Microsoft Purview Information Protection | data owner with the security team |
| DLP rules | whether labelled files are excluded from responses and prompts with sensitive data are blocked | Microsoft Purview DLP, Copilot location | security team |
| Auditing | whether auditing is enabled and whether the SOC knows how to read CopilotInteraction records | Microsoft Purview Audit | security team and SOC |
| Retention | how long interaction data is stored and who can access it | retention policies in Microsoft Purview | data protection officer |
| Agents and web search | which agents are allowed, what permissions they have and whether web search is restricted | Integrated apps in the Microsoft 365 admin center, DLP rule for web search | Microsoft 365 administrator |
This list is not a one-off. New sites, new sharing links and new agents appear every week, so permission reports and agent reviews need a permanent place in the IT department’s calendar. A broader view that also covers the company’s other AI systems is provided by the risk and control map for AI environments.
How can nFlo help assess data readiness for Copilot?
nFlo assesses whether the company’s data is ready for an AI assistant: where sensitive data sits, who has access to it and which data protection controls actually work. We do not configure Copilot on the client’s behalf — we provide a picture of the risk on which the IT team and data owners can base the decision to switch it on.
This assessment is part of the shadow AI assessment and AI use policy service, which also covers AI tools used outside Microsoft 365 and an AI use policy for employees. Other services in the AI security area are described on the AI security page, and further guides are in the AI security knowledge base. If you want to check what Copilot will see in your tenant, contact us.
What else is worth knowing about Microsoft 365 Copilot security?
Does Microsoft 365 Copilot learn from company data?
According to Microsoft Learn documentation, prompts, responses and data accessed through Microsoft Graph are not used to train foundation language models, including those used by Copilot. Interactions are, however, stored in the service, and an administrator can search them and apply a retention policy to them in Microsoft Purview.
Does Restricted SharePoint Search still make sense?
Not for new rollouts. Microsoft is retiring Restricted SharePoint Search and has blocked new enablement since 31 July 2026, pointing to Restricted Content Discovery as its successor. Both features are temporary controls rather than a security boundary — the lasting solution is to put permissions in order.
Can Copilot see files encrypted with a sensitivity label?
Copilot honours the usage rights granted to the user. When a label applies encryption, the user must have the EXTRACT and VIEW usage rights for AI apps to return data from the file. If the user only has the right to view, Copilot will not use the document’s content in its answer.
How does Microsoft 365 Copilot differ from GitHub Copilot?
Microsoft 365 Copilot works on the organisation’s data in Microsoft 365 — email, chats and documents — within the user’s permissions. GitHub Copilot is a coding assistant that runs in a code editor. The risks and controls are different, so the two products are assessed separately.
Where should a company start preparing for Copilot?
With the SharePoint permission and sharing reports: finding sites available to the whole organisation, anyone links and sites with external guests. On that basis site owners clean up access, and sites that need a longer review can be temporarily excluded from Copilot search.
