Before Copilot: Fix the SharePoint Permissions Problem It Will Find First

Copilot oversharing is what happens when Microsoft Copilot answers someone's question with a file they could technically open but were never meant to see. Copilot breaks no rules to do it. Microsoft says Copilot "only surfaces organizational data to which individual users have at least view permissions" (Microsoft Learn (opens in a new tab)). So the fix is not in Copilot. It is in your SharePoint, Teams and OneDrive permissions: find where access is wider than anyone intended, close it, and then hand out licenses.

This is the technical follow-up to our 12-point Copilot readiness check. That post covers licensing, labels and training. This one goes deep on the check that usually takes the most work: permissions.

Why the permission you forgot becomes Copilot's answer#

For years, loose permissions were protected by obscurity. A spreadsheet in the wrong folder was only a risk if someone went looking for it. Copilot changes the effort, not the access. Anyone can type a plain question, and Copilot draws on what that person can open across SharePoint, OneDrive, Teams and email.

Picture a 25-person distributor. Years ago someone created a public team called "Office" for the holiday schedule. Later, the bookkeeper saved last year's bonus spreadsheet in its Files tab because it was handy. Nobody browses there. Once Copilot is live, a sales rep who asks "what bonuses did we pay last year?" can get an answer built from that file, because a public team's files are open to the whole company.

Microsoft treats this as step one. Its Copilot deployment blueprint puts "Remediate oversharing" first of its three pillars, ahead of guardrails and regulations (Microsoft Learn (opens in a new tab)). Its SharePoint guidance adds a blunt warning: "By default, SharePoint sets sharing settings to the most permissive option" (Microsoft Learn (opens in a new tab)).

Where Copilot oversharing hides#

Some oversharing gives everyone access the moment it happens. Other kinds spread only as links get clicked. Start with the first kind.

Sites and files shared with "Everyone except external users"#

"Everyone except external users" is a built-in SharePoint group that automatically includes every internal user. When a site is set to public, that group becomes part of the site's membership, which makes all of the site's content visible to everyone in your organization. Individual files and folders can also be shared with it from the people picker. Microsoft warns that sharing with this group grants access to "all current and future employees" (Microsoft Learn (opens in a new tab)).

Old public teams#

Every team in Microsoft Teams stores its files in a connected SharePoint site, and a public team is one that anyone in the organization can join (Microsoft Learn (opens in a new tab)). When a team's site is public, "Everyone except external users" gets Edit permission by default (Microsoft Learn (opens in a new tab)). Teams set up in a hurry years ago, still public and with no current owner, are worth checking first.

One trap: archiving a team in Teams puts it into read-only mode (Microsoft Learn (opens in a new tab)). Read-only is not the same as removing access.

Folders that inherit more than you think#

SharePoint permissions flow downhill. Libraries inherit from their site, and folders and files inherit from above them, unless someone breaks the chain (Microsoft Learn (opens in a new tab)). A "Payroll" folder created inside a site the whole company uses inherits the whole company.

The opposite problem is just as real. Sharing a folder breaks its inheritance automatically, and every folder with its own permissions is one more exception to track. Microsoft's advice on the same page is "don't break inheritance," and to keep sensitive material together so you restrict access once. Its Copilot preparation guide (opens in a new tab) lists broken inheritance and complex access models among a site's risk signals.

Sharing links that got passed around#

Links are less dangerous than many checklists suggest, but not harmless. Microsoft says creating an "Anyone" or "People in your organization" link does not by itself make a file appear in search or Copilot. The link has to be redeemed, meaning clicked. But a "People in your organization" link sent from SharePoint or OneDrive, in Outlook, or in a Teams chat is redeemed automatically for each individual recipient, up to 100 of them (not for group addresses or Teams channel posts). "Specific people" links make the file searchable and available to Copilot for everyone added to the link (Microsoft Learn (opens in a new tab)).

So an organization link emailed by name to 12 coworkers has given all 12 access, and their Copilot can use it. "Anyone" links carry a different risk: nobody signs in to use them and their use can't be audited. That is more an outside-leak problem than a Copilot problem, but the cleanup is the same.

OneDrive#

Folders shared out of personal OneDrive accounts follow the same link rules, but some tools skip OneDrive. The organization-wide permissions report below covers it. The activity reports in the admin center cover SharePoint sites only, and Restricted Content Discovery, a stopgap in the fix order, does not work on OneDrive at all.

How to run a SharePoint permissions audit with built-in reports#

You do not need third-party software to start. Microsoft already gives you these.

A few details matter:

• A site admin runs the site sharing report (opens in a new tab), and each person can run the OneDrive version from their own OneDrive settings. Both leave out Anyone links and links that were emailed but never clicked, so pair them with the Anyone link counts from the admin reports where you have them.
• The last three rows are SharePoint Advanced Management (SAM) reports. Microsoft says SharePoint admins get these features once at least one person in the organization is assigned a Microsoft Copilot license, and that page names business as well as enterprise customers (Microsoft Learn (opens in a new tab)). Its prerequisites page (opens in a new tab) lists only enterprise base plans, though, so on a Business plan, confirm the reports appear in your admin center before planning around them.
• The first organization-wide permissions report (opens in a new tab) can take up to 5 days to complete, and it covers SharePoint and OneDrive. The per-user report can't run until it has, so start it early.
• Microsoft's advice for the per-user report (opens in a new tab) is worth copying: use it "when you want to review permissions for users before assigning them a Copilot license."

The fix order#

Work in this order. Each step shrinks the next one.

1. Stop new oversharing. In the SharePoint admin center, open Policies, then Sharing (Microsoft Learn (opens in a new tab)). Consider making "Specific people" the default link type, which Microsoft calls the most restrictive option; it adds friction to internal sharing, so tell staff first. Make "Anyone" links expire and view-only, or turn them off, and set an expiration policy for "People in your organization" links. Microsoft's Copilot guidance also says to disable or restrict company-wide sharing groups and Anyone links for the whole tenant (Microsoft Learn (opens in a new tab)).
2. Put a temporary lid on the riskiest sites. With Copilot licenses in place, Restricted Content Discovery keeps a site out of Copilot and organization-wide search while you review it. Turn it on in the SharePoint admin center under Sites, Active sites, then the site's Settings tab ("Restrict content from Microsoft Copilot"). Microsoft calls it "a temporary governance control." It does not change permissions, people can still find content they own or recently worked with, and it does not apply to OneDrive (Microsoft Learn (opens in a new tab)).
3. Close the everyone-level exposures. Make public teams private if they hold anything sensitive. A team owner can do it under Manage team, Settings, Team details, Privacy, if your admin settings allow it (Microsoft Support (opens in a new tab)), and an admin can do it from the Teams admin center. Going private stops new people from finding or joining the team, but anyone who already joined is still a member, so trim the member list too. Then check the site's permissions to confirm "Everyone except external users" is gone, and remove that group from any files or folders shared with it.
4. Move sensitive folders instead of patching them. If payroll, HR, legal or owner files live inside a site everyone uses, move them to their own site with a short member list. That is Microsoft's keep-it-together advice from above, and it beats breaking inheritance folder by folder.
5. Clean up links and owners. Use the sharing reports to delete stale links and switch the ones people still need to specific people. Give every team and site at least one current owner. Delete sites nobody uses, or move them to Microsoft 365 Archive (opens in a new tab), where content "is no longer directly accessible to anyone."
6. Label what remains sensitive. Microsoft 365 Business Premium includes sensitivity labels and Purview data loss prevention (Microsoft Learn (opens in a new tab)). When a label encrypts a file, Copilot honors the usage rights that label grants each person (Microsoft Learn (opens in a new tab)). Our readiness check suggests a simple four-label set.
7. Review pilot users, then license. Run the per-user report for each pilot user, fix what surprises you, and then assign licenses. Once permissions are fixed, remove the temporary Restricted Content Discovery settings, as Microsoft's guidance says.

Microsoft 365 data governance is a habit, not a project#

Oversharing grows back. Microsoft recommends running the snapshot permission reports quarterly and the activity reports monthly (Microsoft Learn (opens in a new tab)). Our managed IT services include quarterly vCIO reviews, a natural place to keep that on the calendar.

If you handle patient records, customer financial data or other regulated information, an overshared folder is a compliance problem long before Copilot finds it. Our compliance management team helps line up access controls with HIPAA, the FTC Safeguards Rule and similar requirements. This is general information, not legal advice.

Frequently asked questions#

Book a Copilot readiness review#

If you would rather not work through permission reports alone, book a Copilot readiness review with us. Start with a free 15-minute discovery call, tell us how your Microsoft 365 tenant is set up, and we will point to the fixes that matter first. For the wider plan, see our AI readiness and adoption services. Our Eau Claire office serves the Chippewa Valley with IT consulting in Eau Claire, and we have offices in La Crosse and Fort Myers as well.