AI data safety
We bought Microsoft 365 Copilot licences. How do we make sure it doesn't show staff files they shouldn't see?
Last updated
Microsoft 365 Copilot only shows content a person can already open, so the fix is permissions, not Copilot. Before rollout, run the SharePoint data access governance reports, pull broad sharing links back, apply sensitivity labels to HR, payroll and board content, hide high-risk sites with Restricted Content Discovery, and start with a pilot group.
How to stop Copilot surfacing the wrong files
Name the sensitive content first
List where HR, payroll, board, legal, acquisition and customer personal information lives, and who should be able to open each. This list decides which sites get fixed first.
Run the sharing reports
In the SharePoint admin center, run the data access governance reports: site permissions across the organisation, sharing links, and content shared with 'Everyone except external users'. They come with SharePoint Advanced Management, which Microsoft includes with Copilot licences.
Hide the riskiest sites while you fix them
Turn on Restricted Content Discovery for HR or finance sites under review. It keeps a site out of Copilot answers and organisation-wide search without changing who can open it. Use Restricted Access Control where only one group should get in at all.
Fix access with site owners
Send site access reviews to owners so they remove 'Everyone' grants, old sharing links and groups that no longer need access. Change the default sharing link to specific people.
Label what must stay protected
Apply Microsoft Purview sensitivity labels with encryption to HR, payroll and board files. Copilot honours the usage rights a label grants. Purview data loss prevention can also stop Copilot using the content of labelled files and emails in its answers.
Pilot, check, then widen
License a pilot group drawn from several functions and sites. Ask them to search for content they should not reach, review Copilot activity in Purview, then widen rollout in waves as each group of sites is cleaned up.
Which control does what
| Control | What it does | What it does not do |
|---|---|---|
| Data access governance reports | Find sites with broad access, many sharing links or 'Everyone' grants | Fix anything on their own |
| Restricted Content Discovery | Keeps a SharePoint site out of Copilot and organisation-wide search | Change permissions, or cover OneDrive |
| Restricted Access Control | Limits a whole site to a named group | Review individual files or links |
| Site access review | Asks site owners to confirm and clean up access | Work if no one owns the site |
| Sensitivity labels with encryption | Limit who can open a file wherever it is stored, and Copilot honours those rights | Label old files unless someone applies labels or sets up automatic labelling |
| Purview audit and activity review | Show Copilot use and policy changes for checking | Prevent exposure before it happens |
Australian specifics
APP 11 in the Privacy Act 1988 requires reasonable steps, including technical and organisational measures, to protect personal information from misuse, interference, loss and unauthorised access. A staff member reaching payroll or health records they have no reason to see is unauthorised access, whether they find it through search or a Copilot answer. Documented sharing reports, an owner for each sensitive site and a record of what was fixed are direct evidence of reasonable steps. Where access is likely to cause serious harm, the Notifiable Data Breaches scheme may apply.
In New Zealand, information privacy principle 5 of the Privacy Act 2020 sets the same expectation of reasonable security safeguards. On both sides of the Tasman, Microsoft states that Copilot prompts, responses and Microsoft Graph data are not used to train foundation models, and that Copilot is covered by the data residency commitments in its Product Terms. Customers outside the EU may have queries processed in other regions, so confirm residency for your Microsoft 365 environment with your Microsoft partner before rollout to regulated teams. APRA-regulated entities should also map the work to CPS 234.
Limits and when not to use AI
Switching Copilot off is not the fix
The same overshared files are still reachable through search, Teams and old links. Copilot only makes them faster to find.
Restricted Content Discovery is temporary
Microsoft describes it as a holding control while access is reviewed. Applying it widely makes Copilot answers less complete and hides the real problem.
Labels need ongoing care
A label scheme nobody applies protects nothing. Keep it to a few labels staff understand, and assign an owner.
Delay wide rollout when ownership is missing
If HR, finance and board sites have no named owner, or 'Everyone' grants cannot be traced, keep Copilot to a small pilot whose content is known until owners are in place.
Copilot drafts can be wrong
Microsoft notes that generated responses are not guaranteed to be factual. A person checks any summary of policy, pay or contract terms before it is relied on.
Who should own it
IT or Microsoft 365 manager
Runs the reports, applies Restricted Content Discovery and access controls, and manages rollout waves.
Privacy or risk lead
Defines which content is sensitive, approves the label scheme and signs off each wave.
Site owners in each business unit
Complete access reviews for their own sites and keep membership current.
HR and finance leads
Confirm who should see payroll, employee records, budgets and board papers.
Related work
- Copilot readiness assessmentFind what Copilot would surface, contain the risk and design a measured pilot.
- Copilot readiness: audit permissions firstThe permissions audit to run before buying more licences.
- Shadow AI is already in your businessFind the AI tools staff already use and write a policy that works.
- Security and data residencyHow Solve8 keeps client data in its own environment.
Sources
Microsoft Learn, Data, Privacy, and Security for Microsoft Copilot: https://learn.microsoft.com/en-us/copilot/plan/microsoft-365-copilot-privacy
Microsoft Learn, Restrict discovery of SharePoint sites and content: https://learn.microsoft.com/en-us/sharepoint/restricted-content-discovery
Microsoft Learn, Data access governance reports for SharePoint sites: https://learn.microsoft.com/en-us/sharepoint/data-access-governance-reports
Microsoft Learn, Secure and governed data foundation for Microsoft Copilot, foundational deployment guidance: https://learn.microsoft.com/en-us/copilot/plan/secure-govern-copilot-foundational-deployment-guidance
Microsoft Learn, Microsoft Purview DLP for Microsoft 365 Copilot: https://learn.microsoft.com/en-us/purview/dlp-microsoft365-copilot-location-learn-about
Office of the Australian Information Commissioner, Chapter 11: APP 11 Security of personal information: https://www.oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-guidelines/chapter-11-app-11-security-of-personal-information
Questions
Will Microsoft 365 Copilot show staff payroll files that were shared too widely years ago?
Yes, if those files are still shared with that person. Copilot answers from content each user already has at least view access to, including files reached through old 'Everyone' grants or organisation-wide links. Run the SharePoint site permissions and sharing links reports, then remove the broad access or apply an encrypting sensitivity label before those staff are licensed.
What is Restricted Content Discovery in SharePoint?
Restricted Content Discovery is a SharePoint Advanced Management setting that keeps a chosen site out of Microsoft 365 Copilot answers and organisation-wide search. It does not change permissions, so people with access can still open files directly. Microsoft positions it as a temporary control while site owners review access, and it does not apply to OneDrive.
Does a Copilot rollout need Microsoft 365 E5 to fix oversharing?
Not for the core reports. Microsoft includes SharePoint Advanced Management with Copilot licences, which provides data access governance reports, Restricted Content Discovery, Restricted Access Control and site access reviews. Some Microsoft Purview features, such as automatic labelling, depend on higher licences, so confirm entitlements with the organisation's Microsoft partner before designing the label approach.
Should Copilot stay switched off until every permission is fixed?
Usually not. Fixing every site can take a long time, while the riskiest content is often concentrated in a few HR, finance and executive sites. Hide or restrict those first, start a pilot with staff whose content is well understood, and widen rollout as each group of sites is cleaned up and checked.
Does Microsoft use company files to train Copilot's AI models?
Microsoft states that prompts, responses and data accessed through Microsoft Graph are not used to train the foundation models behind Microsoft 365 Copilot. Interaction history is stored under the same contractual commitments as other Microsoft 365 content, and administrators can manage it with Microsoft Purview retention and search tools.
Have this problem across your branches?
A 30-minute review with a senior consultant. You leave with a written one-page summary you can share internally.
Fixed-fee phases, agreed before we start. Stop after any phase.