Microsoft 365 Copilot: What to Check Before You Switch It On

7 Views

Microsoft 365 Copilot does not grant new access. It surfaces what each user could already open, which is the problem: nobody has ever opened all of it. Permissions that were harmless when finding a file meant knowing its name become obvious when a search box will summarise it on request. Run a permissions review before rollout, not after the first complaint.

Identity and access diagram representing Microsoft 365 Copilot security checks before rollout

The oversharing that has been building for years

Most tenants carry a decade of accumulated sharing decisions that nobody has revisited. The usual suspects are SharePoint sites shared with Everyone except external users, an HR site with broken inheritance on one library, OneDrive folders shared by link with anyone in the organisation, and Teams channels created for a project that ended in 2021. Each of those was a reasonable decision on the day. Together they mean an ordinary employee can reach payroll spreadsheets, board papers or a folder of signed contracts, and until now the only barrier was that nobody thought to look. A prompt asking about salary bands removes that barrier in one line.

Checks worth running before the first licence goes live

You should audit access before enabling the feature, starting with the sites that hold your most sensitive material. Run the SharePoint Advanced Management reports on sharing links and site access, or export permissions if you do not hold that licence. Apply sensitivity labels to the material that matters, since Copilot honours them and will exclude labelled content a user cannot open.

Consider Restricted SharePoint Search while you clean up, which limits the tenant-wide index to a list of sites you approve. Check that unified audit logging is on, because Copilot interactions are recorded there and you will want that history if a question about exposure ever arises.

“Every Copilot readiness review I have run has found at least one site that made the whole senior team uncomfortable. It is never the finance system, which is properly controlled, it is a project site from four years ago with a copy of the payroll file in it. Fix the permissions before the rollout, because after go-live you are explaining to staff why they can see something rather than quietly closing it.”

William Fieldhouse, Director, Aardwolf Security Ltd

Diagram of connected data records showing how an AI assistant indexes files across a tenant

Prompt injection through documents you did not write

Treat any document from outside your organisation as untrusted input to the assistant. Indirect prompt injection works by hiding instructions in content that the model later reads, such as white text in a supplier’s proposal or a comment in a spreadsheet. When the assistant summarises that file, it follows the instructions along with the request. The joint guidelines for secure AI system development that the NCSC published with CISA in November 2023 put this in the design phase for good reason: it is a data handling problem rather than a model problem. Limit which connectors are enabled, and be careful about anything that lets the assistant act rather than answer.

Where this fits in a wider tenant review

Copilot readiness overlaps almost entirely with the identity work in Azure penetration testing services, which is why the two are often booked together. The same review covers Conditional Access, guest accounts, application consent and the role assignments that decide who can change all of it. If you are planning a rollout this quarter, request a penetration testing quote that covers the tenant rather than the assistant alone, because the assistant is only as contained as the permissions around it.

Frequently asked questions about Copilot security

These are the questions IT managers raise once a rollout date is set.

Does Copilot train on your company data?

No. Microsoft states that tenant data is not used to train the foundation models, and prompts stay within your service boundary. The risk is exposure inside your own organisation, not model training.