Microsoft 365 Copilot and oversharing: fix permissions first

Short answer: A firm of 50 to 500 people should review Microsoft 365 permissions before expanding Copilot to more staff. Microsoft says Copilot surfaces organizational data the individual user has at least permission to view, so an overly broad permission can become an AI discovery problem. Our recommendation is to identify sensitive locations, assign business owners, remove unnecessary access and test with ordinary staff accounts before the next rollout group. A successful test needs evidence that access is correct, not just a Copilot answer that happens to omit a sensitive file.

Obsidian Ridge offers the assessment below. The permission-review process is our recommendation; Microsoft product behavior and feature status are tied to the documentation checked for this article.

Key facts

• What can Copilot surface? Microsoft says, “Microsoft Copilot only surfaces organizational data to which individual users have at least view permissions.” Correct access is therefore the starting point. Microsoft privacy documentation, checked November 3, 2026.
• What comes first? Microsoft's deployment blueprint includes “Remediate oversharing” as a pillar. Apply that to the actual sites, groups and files your staff use. Microsoft deployment guidance, checked November 3, 2026.
• Does hiding discovery fix access? Microsoft states, “Restricted Content Discovery doesn't change existing permissions.” Existing users can still access content directly. Microsoft Restricted Content Discovery, checked November 3, 2026.
• Are old search-restriction instructions current? Microsoft says, “Restricted SharePoint Search is retiring. Starting July 31, 2026, new enablement is blocked.” Review current guidance before following an old rollout checklist. Microsoft retirement notice, checked November 3, 2026.
• What should the firm approve? Our recommendation is a named rollout group, reviewed information sources, evidence of correct access and an owner for unresolved exceptions. Use the weekly checklist.

Why can correct permission enforcement still reveal a problem?

Microsoft's documented boundary is the user's access. It does not decide whether your firm's historical permission assignments still reflect a current business need. Our practical conclusion is that an access review must ask both whether the system enforces a permission and whether the business owner intended to grant it. Microsoft privacy documentation, checked November 3, 2026.

Consider an invented 120-person firm where a compensation folder was placed in a broadly accessible team site years ago. If ordinary employees can open it, the permission problem exists before an AI rollout. Asking an assistant to find compensation information makes the discovery question more visible, but the corrective decision is still who should have access to the folder and why.

Do not use this example to assume every broadly shared document is a mistake. A staff handbook may be intended for everyone. The owner needs to classify the material and its audience. The useful outcome is an explicit access decision, with a date and an accountable person, rather than a blanket removal that breaks routine work.

The existing Microsoft 365 security review covers a wider account-security review. This article focuses on the content permissions and evidence needed for a Copilot rollout.

Where should a firm of 50 to 500 people start?

Our recommendation is to begin with a bounded inventory that the business can review. Name the sites and information areas likely to contain sensitive client, personnel, financial or transaction material. Include shared working areas and locations with no obvious current owner. Ask staff where they actually store working copies rather than assuming the official folder structure tells the whole story.

Assign each location to someone who can decide its intended audience. IT can inspect and change access, but the finance lead should decide who needs the finance material. A practice leader should decide who may see a client matter. Where the owner is unclear, record that as an unresolved decision and hold the affected rollout scope.

Use the following review order as a practical starting point, not a claim that every firm has the same risks:

Record the decision and the evidence together. A spreadsheet listing sites without owners is an inventory, not a completed review. A list of owners without an access test is equally incomplete.

How should the permission cleanup work?

Ask each owner to approve the intended roles and named exceptions. Have the administrator compare that decision with effective access, including the relevant group memberships and sharing routes. Record unnecessary access before removing it so the firm can explain the change and identify any work that needs a different approved route.

Pilot the cleanup on one manageable area. Tell affected staff what is changing, who can approve an exception and how to report a legitimate access problem. Keep the review from becoming an informal round of restoring broad access whenever someone encounters an error. An exception should have a reason, an owner and a review date.

Our recommendation is to preserve material according to the firm's records process while correcting access. Do not delete old client or employee files simply to make an AI test look cleaner. Ask counsel or the records owner to resolve retention, preservation and professional obligations where they apply.

Check that the intended staff can still complete their work. A successful cleanup should demonstrate both sides: authorized users retain the needed access, and other users cannot obtain the material through the tested routes. Document the account roles and test files so another administrator can understand what the evidence covers.

Can discovery controls buy time while we review permissions?

Microsoft describes Restricted Content Discovery as a temporary way to limit discovery from selected SharePoint sites during a review. Its documentation says the control does not change permissions, is not supported for OneDrive sites and can take time to propagate. It also lists licensing and administrative prerequisites. Microsoft Restricted Content Discovery, checked November 3, 2026.

If the administrator proposes it, ask which sites it covers, what remains accessible and how they will verify the setting has taken effect. Keep a separate owner and deadline for correcting permissions. A temporary reduction in discoverability should not become the evidence that an inappropriate grant of access has been removed.

Do not copy an older recommendation to newly enable Restricted SharePoint Search. Microsoft's current notice says new enablement was blocked from July 31, 2026 and points readers toward current content-discovery controls. Have the administrator inspect any existing configuration and current transition guidance. Microsoft Restricted SharePoint Search, checked November 3, 2026.

This article intentionally does not provide a blanket administrative command. The decision depends on the firm's sites, licensing, existing settings and change process. The practical requirement is evidence that the chosen control applies to the intended scope and has an owner.

What should the pilot test prove?

Our recommended pilot uses a small group representing different job roles and deliberately created test documents. Include information each role should be able to access and information it should not. Use invented content with clear labels so testers do not have to expose real sensitive material to prove a point.

Test direct access first. Have the administrator and owner verify effective permissions and attempt the approved access checks using ordinary user accounts. Then test relevant search and Copilot questions. Record the user role, tested location, expected result, actual result and any settings that affect the outcome.

An answer that does not mention the restricted test document is not sufficient proof of correct permissions. The question may simply have failed to retrieve it. Conversely, if a user can open a document that the business owner says they should not see, fix that access even if Copilot has never returned it in your sample prompts.

Check legitimate retrieval too. A rollout that hides necessary working information can produce incomplete results and staff workarounds. Ask the pilot users to report missing sources and unexpected information, then have the owner and administrator distinguish an access issue from a content-quality or retrieval issue.

Keep the pilot's scope explicit. The Microsoft 365 Copilot tool entry provides broader vendor evidence; an access review of selected sites does not approve every connected agent or every other product carrying the Copilot name. Assess new connections and uses when they are proposed.

What can a 50-to-500-person firm do this week?

1. Name the next rollout group. Identify its roles, intended tasks and information sources. Keep the scope small enough for owners to review.
2. Assign content owners. Prioritize sensitive locations, broad access and unclear ownership. Record which areas remain undecided.
3. Approve intended access. Ask the owners who needs the information and why. Have IT compare that decision with actual permissions and sharing routes.
4. Correct and document. Remove unnecessary access through the change process, preserve required records and record approved exceptions.
5. Test ordinary accounts. Verify intended access and denied access with invented documents, then test relevant search and Copilot behavior. Record limitations in the evidence.
6. Make a rollout decision. Proceed for the reviewed scope or hold it with named gaps. Set a continuing review trigger for role changes, new sites, integrations and changed business use.

Do not make the number of licenses the success measure for this week. The useful result is a documented boundary that staff and administrators can explain. For a 50-person practice, one owner session may cover the first pilot. A 500-person firm may need several department reviews. Neither size makes a sample of a few documents proof that the whole environment has been checked.

Use the AI policy builder to record approved tasks and the AI tool risk checker to organize outstanding questions. Law firms, accounting firms and financial advisers should add their own professional and records decisions with counsel or the compliance officer. Discovery and technical review support those decisions; they do not replace them.

Sources

Opened November 3, 2026:

• Microsoft: Data, Privacy, and Security for Microsoft Copilot: the user's permission boundary.
• Microsoft: foundational deployment guidance: oversharing remediation, updated October 30, 2026.
• Microsoft: Restricted Content Discovery: temporary discovery restrictions, limitations and prerequisites.
• Microsoft: Restricted SharePoint Search: retirement notice and July 31, 2026 block on new enablement.