7 things to do before you switch on Microsoft 365 Copilot

Microsoft 365 Copilot does not grant any new permission; it works on content the user can already access. That is precisely the problem: a salary spreadsheet shared with “Everyone”, or a management folder left open years ago, can now appear in front of anybody in response to a single question.

The Microsoft 365 Copilot preparation list

• Sharing audit: we report the files and sites shared with “People in your organisation” and “Anyone with the link”.
• SharePoint and Teams permissions: we clean up ownerless sites, over-broad memberships and old project spaces.
• Sensitivity labels: we label content such as payroll, contracts and client data and restrict access to it.
• Identity security: we do not switch on Copilot without multi-factor authentication and conditional access; a compromised account now gathers data far faster.
• Retention and archive: content that should have been deleted years ago is also a source for Copilot, so we review the retention policies.
• Pilot group: we open it not to the whole company but to a small group from different departments, and review together what they find.
• Usage rules and training: we cover verifying the output, client data and responsibility in hands-on sessions.

The cost of permissions comes before the cost of licences

Most Copilot projects launched without preparation are halted at the first “how did it see that?”. We put the data in order first and switch on the assistant afterwards; that sequence removes both the risk and the wasted licence cost. See our AI Integrations page for details.