Rolling out Copilot? Clean up your permissions first

Copilot is switched on in ten minutes. That is exactly the problem: it immediately finds everything an employee formally has access to, including the folders everyone had forgotten were open.

What Copilot does and does not see

Copilot works within the permissions of the signed-in user. It bypasses nothing and leaks nothing outside. But it does search more effectively than a person: where someone once had to know a document existed, asking a question is now enough.

That makes visible what stayed invisible for years. A salary overview in a project folder, an old reorganisation document on a team site the whole organisation belongs to, minutes that ended up in a shared folder by accident.

What we check before a rollout

Before we hand out licences, we go through these points:

• Team sites and SharePoint sites with over-broad groups, such as "everyone except external users".
• Folders and documents with individual permissions nobody can explain any more.
• Shared links without an end date, including links that work outside the organisation.
• Guest accounts that still have access to completed projects.
• Confidential information without a classification label or retention period.

Labels and retention periods

Permissions alone are not enough. Classification labels determine which material is confidential, and retention periods stop documents from 2014 weighing into an answer. That also makes Copilot more useful: less noise, better answers.

Only then roll out, and per department

Licences for everyone at once is the fastest way to let usage bleed out. What works: one department, two or three concrete use cases, a short training per role and a key user who fields questions. Then the next department.

Meeting summaries, first drafts of documents and summarising long email threads are the use cases people come back for themselves.

What this delivers beyond Copilot

Cleaning up permissions is work you should have done anyway. It immediately helps access management under ISO 27001 and the NIS2 duty of care, and it makes later AI agents possible, because like Copilot they see exactly what the user may see.