In this guide · 8 sections
- 01How Copilot decides what a user can see
- 02Where oversharing usually hides in a small business
- 03Microsoft tools to find overshared files
- 04Sensitivity labels and DLP by Microsoft 365 licence
- 05A 1-day oversharing clean-up before Copilot rollout
- 06What to tell staff before Copilot goes live
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
Copilot is safe to the extent your permissions are. Microsoft says it only surfaces data a user already has at least view access to. So the risk is oversharing: fix 'Everyone' and organisation-wide links, broad groups and stale sites before you turn Copilot on for staff.
How Copilot decides what a user can see
Microsoft's Copilot privacy documentation states that Copilot only surfaces organisational data to which individual users have at least view permissions. It uses the same access controls as SharePoint, OneDrive, Exchange and Teams, and its Semantic Index respects each user's access boundary.
Microsoft also says prompts, responses and data accessed through Microsoft Graph are not used to train the foundation language models. That answers the 'will Microsoft learn from our files' question. It does not answer the more practical one: which of your own staff can now find files they were never meant to see?
Where oversharing usually hides in a small business
These are the patterns to look for first. None of them are Copilot problems; Copilot simply makes them visible.
| Pattern | Why it happens | Risk with Copilot |
|---|---|---|
| Sites shared with 'Everyone except external users' | Quick fix when someone could not open a file | Every staff member can query the whole site |
| 'People in your organisation' sharing links | Default link type in many tenants | Anyone internal with the link, or who finds it, can open it |
| Public Microsoft 365 groups and Teams | Created as public by default | Any staff member can join and read files |
| Old project or ex-staff OneDrive content | Nobody tidies up after projects end | Stale files with personal data stay searchable |
| Guests never removed | Agencies and freelancers from past work | External users keep access to sites they were added to |
HR, payroll, finance, customer lists with NRIC numbers and board papers are the files to check first.
Sensitivity labels and DLP by Microsoft 365 licence
Labels let you mark files as Confidential and, if you choose, encrypt them so only named people can open them. Copilot respects those protections. Whether you can use them depends on your plan.
| Plan | Sensitivity labels | Data loss prevention |
|---|---|---|
| Microsoft 365 Business Basic / Standard | Not included | Not included |
| Microsoft 365 Business Premium | Manual labelling included | Included |
| Microsoft 365 E5 or E5 Compliance add-on | Manual and automatic labelling | Included, more advanced |
For a business on Business Standard, labels are not the first step anyway. Permissions are. If you later need labels, our guide on whether Microsoft 365 Business Premium is worth it sets out the other security features you get for the extra cost.
A 1-day oversharing clean-up before Copilot rollout
For a 10 to 50 person company this fits into a day of focused admin work, spread across a week if you need managers to confirm access.
List your sensitive locations
HR, payroll, finance, management and customer data sites, plus any OneDrive folders that hold them. Ask each manager where their sensitive files actually live.
Run the site permissions report
In the SharePoint admin centre, run the data access governance site permissions report and sort by broadest access. If you have no Copilot or SAM licence yet, check site permissions manually for your sensitive list.
Remove 'Everyone' and organisation-wide access on sensitive sites
Replace it with a specific group of the people who need the site. Convert public Teams that hold sensitive files to private.
Change the default sharing link
In the SharePoint admin centre sharing settings, set the default link to 'Specific people' rather than 'People in your organisation' or 'Anyone'.
Remove stale guests and ex-staff access
Review guest users in the Microsoft 365 admin centre and remove those you no longer work with. Check ex-staff OneDrive content has been moved or deleted.
Hide what you cannot fix yet
Use Restricted Content Discovery for sites that need more work, so Copilot does not draw on them in the meantime.
Pilot Copilot with a small group
Give licences to a few staff first and ask them to try prompts like 'show me salary information' or 'find customer NRIC numbers'. Anything that comes back is a permission to fix.
Our Microsoft 365 security checklist covers the wider tenant settings, such as MFA and admin roles, that should be in place before any AI rollout.
What to tell staff before Copilot goes live
A short note avoids most problems. Tell staff that Copilot can see what they can see, so if it ever shows them something they should not have access to, they must report it rather than use it. Remind them that Copilot answers can be wrong and need checking, and that personal data rules under the PDPA still apply to anything Copilot drafts.
If you are still choosing between assistants, our comparison of Copilot vs Gemini for small businesses covers pricing. As of October 2026, Microsoft lists Microsoft 365 Copilot Business at US$21 per user per month on an annual plan for organisations with up to 300 users, with free Copilot Chat included in Business plans; see Microsoft's business plan comparison.
Do it yourself or get help?
If you have one or two SharePoint sites and know who uses them, you can do this clean-up yourself. It gets harder with years of Teams, ex-staff OneDrives and guests from past projects, or when nobody is sure who should have access to what.
Copilot readiness checklist
Our Microsoft 365 / Google Security Lockdown (S$590) sets external sharing rules, cleans up admin roles and enforces MFA. For ongoing control, the Access Review & Leaver Tool (from S$1,200) lists who has access to what and asks managers to confirm it every quarter.
Frequently asked questions
No. Microsoft states that Copilot only surfaces organisational data the individual user already has at least view permission for, using the same access controls as SharePoint, OneDrive and Teams. The risk is that many users have more access than anyone realises, so Copilot can find files that were overshared but never noticed.
Microsoft says prompts, responses and data accessed through Microsoft Graph are not used to train the foundation language models used by Copilot. Optional feedback may be used to improve the service but not to train those models, and admins can manage feedback settings for the organisation.
Not necessarily. The most important step, fixing SharePoint and OneDrive permissions, works on any plan. Business Premium adds manual sensitivity labels and data loss prevention, which help protect the most sensitive files. Automatic labelling needs an E5-level licence. Many small businesses start by cleaning up permissions and add labels later.
It is a SharePoint Advanced Management setting that stops a site's content appearing in Copilot and organisation-wide search, without changing who can open it. It is useful as a temporary measure while you fix permissions. Microsoft recommends it in place of Restricted SharePoint Search, which blocked new enablement from 31 July 2026.
As of October 2026, Microsoft lists Microsoft 365 Copilot Business at US$21 per user per month on an annual commitment, excluding GST, for organisations with up to 300 users. Copilot Chat is included free with Microsoft 365 Business plans. Many businesses license only the staff who will use Copilot daily.