Before Copilot Speaks: Tidy the Rooms It Can Already See

Copilot demos have a party trick. Someone types a vague question into Teams, waits a second, and gets a tidy answer pulled from a document nobody remembers writing. For a small business, that is either brilliant or mildly alarming, depending on what else is sitting in the same shared folder.

Here is the bit that matters: Microsoft 365 Copilot does not grant new access. It answers using the files, emails and chats each person can already open. If your SharePoint, OneDrive and Teams permissions have been quietly accumulating since the last office move, Copilot is about to become a very fast reader of everything your staff can already see. That is not an AI problem. It is an old sharing problem with a new search box.

Copilot is not the leak. Your old links are.

Think of Copilot as an extremely helpful colleague who has read every file you have permission to read and never forgets a shared link. If a folder was shared with 'Anyone with the link' three years ago and never tidied up, that folder is still in scope for anyone who can reach it. If a whole company is in a site's Visitors group, Copilot can draw on that site for everyone in the company.

The audit is therefore less about Copilot settings and more about answering one question: who can already read what? You want to fix the worst offenders before you switch the assistant on, not after it quotes a confidential client note in a project channel.

Start with the links that say Anyone

In SharePoint or OneDrive, look for sharing links set to 'Anyone' or 'People in your organisation'. These are the usual suspects. They were handy for a quick client handover, a tender pack or a one-off folder drop, and then everyone moved on.

In the SharePoint admin centre, review active sites and their sharing settings. At site level, open Manage access and look for links that are broader than they need to be. For a small business, you do not need a forensic sweep of every file on day one. Pick the sites that hold client data, HR records, finance spreadsheets and contracts. Those are the rooms Copilot will be most useful in, and the ones where a loose link causes the most embarrassment.

Replace 'Anyone' links with 'Specific people' where you can. Remove links nobody has used in months. Do not try to fix everything in one heroic afternoon; fix the top twenty worst examples and write down the rest.

Follow the inheritance chain

SharePoint permissions inherit from the site down to libraries and folders. A folder can look private on the surface while quietly inheriting access from a parent site where the whole company is a member. This is where many small businesses get caught.

Open Site permissions and check the Owners, Members and Visitors groups. Ask the obvious questions: should every member of staff be a Visitor on this site? Should the finance team's site include the sales team because someone added them in 2022? Are there groups with names like 'Temp Access' that outlived the temp?

Teams-connected sites add another layer. Every member of a Team is a member of its SharePoint site. If a project team still has old contractors, former staff or external guests attached, Copilot will treat them as part of the audience too. Removing a person from a Team does not always tidy every permission they picked up along the way, so check the site as well as the Team.

Teams sites are the attic

Every small business has a Teams attic: project sites from finished jobs, committees that met twice, and a channel called 'General' with 400 files in it. They are not doing any harm until Copilot starts treating them as a knowledge source.

List your Teams by last activity. Anything inactive for twelve months or more needs a decision. Archive it, delete it, or lock it down. If it still has value, remove guests and restrict membership. If nobody can remember why it exists, that is usually a sign it should not be answering questions on behalf of the business.

The guest list deserves a look

External guests are normal in UK small businesses. Accountants, clients, freelancers and suppliers often need access to a folder for a few weeks. The problem is the guest account that stays for years after the project ends.

Review guest accounts in Microsoft Entra ID and check which SharePoint sites and Teams they can reach. Remove stale guests, and make sure current guests are only in the sites they actually need. A client folder shared with an external accountant is fine. The same folder sitting open to every guest account in the tenant is not.

Set a boring default and tell people why

Once you have cleaned up, change the default sharing setting for new files. For most small businesses, 'Specific people' is a sensible starting point. Block 'Anyone' links on sites that hold sensitive material. If you use sensitivity labels, apply them to the obvious categories, but do not rely on labels to fix bad permissions. A label tells Copilot how to handle a file; it does not undo a link that should never have been created.

Then explain it to staff in plain English. This is not a witch hunt. It is a tidy-up before a very useful assistant starts answering questions. Ask people to flag anything they are unsure about rather than quietly deleting folders.

A realistic pre-rollout sequence

Pick a pilot group, not the whole company. Run a sharing report for the sites they use. Fix the broadest links first. Review inactive Teams and stale guests. Set sharing defaults. Then test with real questions: ask Copilot for a client summary, a policy detail or a project update, and check where the answer comes from. If it surfaces something surprising, you have found a permission to fix before wider rollout.

Copilot is genuinely useful when its answers come from files you meant to share. If it can quote a forgotten HR memo or an old client negotiation in a team meeting, that is not AI magic. That is an old link doing exactly what you told it to do. Tidy the rooms first, then let it speak.