Microsoft Copilot Security: A Governance Guide

You are about to give every employee a search engine that has already been granted their permissions. That is Microsoft 365 Copilot, and it is why Copilot governance matters more than the licence decision.

Copilot drafts your documents, summarises your meetings, reads your spreadsheets, and answers questions from anywhere in your tenant. To do that, it reads everything the person asking is allowed to read. Not what you intended them to read. What your permissions currently say.

In most tenants those two things stopped matching years ago. A SharePoint site shared with “Everyone except external users”. A Teams channel anyone can join. A OneDrive folder opened up for a project that finished in 2022. None of it caused a visible problem, because nobody went looking. Copilot goes looking every time somebody types a question.

This guide is the governance framework we work through before we let a client switch Copilot on.

Fixing permissions before Copilot finds them for you

Copilot does not break your security model. It obeys it, exactly and instantly. If a junior analyst has read access to the board’s SharePoint site because someone shared it broadly three years ago, Copilot will quote board papers back to them the moment a question makes those documents relevant.

Before Copilot, that risk was theoretical. Your analyst had to know the site existed, find it, and read through it. Now “summarise our company strategy” does the work for them in four seconds.

Microsoft calls this oversharing, and its own documentation tells you to review permissions before deployment. Plenty of organisations skip it, because the review is dull and slow. That is the step you cannot skip.

What goes wrong without Copilot data governance

Copilot pulling salary and revenue data into a budget draft

Someone in marketing asks Copilot for help with a budget proposal. Copilot obligingly reaches into a finance site that was opened to all staff for a reason nobody remembers. The draft comes back containing salaries, margins, or an acquisition model.

Client A’s files turning up in Client B’s answers

In legal and financial services, the wall between client matters is the whole business. If your analyst works on Client A, asks Copilot a general question, and gets an answer drawn from Client B’s folder that they technically had access to, you have a confidentiality breach to report.

Performance reviews surfacing in everyday prompts

HR keeps performance reviews, disciplinary notes, and pay data in SharePoint. Where the access group is broader than HR believes, Copilot will surface that material whenever the context fits.

Board papers surfacing in “what is our growth strategy?”

Board packs, deal documents, and strategic reviews sitting behind loose permissions become available in plain English. Nobody has to hack anything. They just have to ask.

A Copilot governance checklist to work through before you deploy

1. Audit SharePoint Permissions

This is the single most important pre-deployment task. For every SharePoint site and document library:

• Review who has access (members, visitors, owners)
• Check for “Everyone” or “Everyone except external users” sharing
• Review sharing links (anyone links, organisation-wide links)
• Remove access that is no longer needed
• Implement the principle of least privilege

Microsoft gives you tools to work with: SharePoint admin centre reports, Microsoft Purview Data Access Governance, and the SharePoint Advanced Management add-on. They will tell you where the problems are. They will not tell you who should have access to what — that judgement is yours, and it is the slow part.

2. Clean Up OneDrive Sharing

Your people share OneDrive files freely, because sharing is the point. Review:

• Files shared with “anyone with the link”
• Folders shared with broad groups
• External sharing that has outlived its project

Then change the default, so the next three years do not repeat the last three. Tighten your OneDrive sharing policies to stop broad sharing happening by accident.

3. Review Teams and Groups Membership

Every Team and Microsoft 365 group carries a SharePoint site behind it, and its membership sets your Copilot data access controls. Review:

• Public Teams that should be private
• Teams with open membership that should require approval
• Guest accounts that have outlived their purpose
• Groups with broad membership that reach sensitive content

4. Implement Sensitivity Labels

Microsoft Purview sensitivity labels classify and protect documents by content, and Copilot respects them. Before you deploy:

• Define a label taxonomy (Public, Internal, Confidential, Highly Confidential)
• Apply labels to existing sensitive content, using auto-labelling to cover volume
• Encrypt Confidential and Highly Confidential documents through label policies
• Restrict what Copilot can reference from your most sensitive material

5. Configure Information Barriers (Where Required)

For financial services firms and legal practices, information barriers keep Copilot from crossing ethical walls between client matters or deal teams — a key requirement for FCA-aware deployment. This requires:

• Defining barrier segments based on department, team, or function
• Configuring barrier policies in Microsoft Purview
• Testing that barriers hold before Copilot goes anywhere near production

6. Deploy to a Pilot Group First

Never switch Copilot on for everyone at once. Start with 10 to 15 people:

• Pick users from different departments and seniority levels
• Watch what Copilot surfaces in their answers
• Ask them about productivity and about anything they saw that surprised them
• Fix permissions and policies before you widen the group
• Expand in phases, not in one move

7. Establish Copilot Usage Policies

Write down what good use looks like:

• Which questions are appropriate to ask Copilot
• What to do when Copilot surfaces something the user should not have seen
• How Copilot-generated content gets checked before it leaves the firm
• Where Copilot must not be used at all, such as regulated advice

Make the second point easy to follow. If reporting an accidental disclosure feels like confessing, nobody will do it.

8. Enable Audit Logging

Microsoft 365 audit logs capture Copilot interactions, which is how you prove your controls work. Make sure:

• Unified audit logging is on in your tenant
• Copilot-specific audit events are captured
• Logs are retained long enough — 90 days minimum, longer if you are regulated
• Somebody reads them, especially in the first weeks of rollout

Clear the permissions debt Copilot exposes

Your permissions problem was not one bad decision. It was thousands of small, reasonable ones: a folder shared here, a person added there, a temporary link that nobody ever revoked.

Copilot did not create that debt. It made it searchable.

Cleaning up before deployment is the urgent job. Keeping it clean is the real one. That means scheduled access reviews, sharing links that expire on their own, and a default of deny where broad access has to be asked for and justified.

Weigh the cost of Copilot against the cost of getting it wrong

Copilot costs roughly £24 per user per month, and is increasingly folded into plan pricing — check what the July 2026 Microsoft 365 price change bundled in before you buy separate seats.

Now weigh that against one client confidentiality failure, one data breach notification, or one regulatory finding. The subscription is not where your money is at risk.

Deploy it properly and the gains are real. Your people spend less of the day hunting for information, drafting from scratch, and catching up on meetings they missed. Those hours only count as a win if the deployment did not quietly create a new problem behind them.

A tenant audit before Copilot goes live

We take London businesses through the whole Copilot deployment as part of our Microsoft 365 admin with Copilot governance service: permissions audit, data governance, pilot, training, and the ongoing reviews that keep it safe. We do the tedious part — reading through your SharePoint permissions, setting up sensitivity labels, and building the governance framework — so your rollout rests on controls you can point to.

If you are weighing up Copilot, or you have already switched it on without a governance framework, book a free IT assessment with Nerdster. We will tell you what your tenant would expose today, and what to fix first.