Copilot readiness is mostly a permissions problem. Microsoft states that Copilot "only surfaces organizational data to which individual users have at least view permissions." It does not bypass SharePoint security; it reads the access your file shares, Teams and OneDrive have accumulated for years, faster than any person would. Microsoft Copilot readiness therefore starts with a Copilot permissions audit, before you buy licences.
Key takeaways
- Copilot shows each user what they can already open. The risk is the access they have but never knew about.
- The biggest exposures are "Everyone except external users" grants, organisation-wide sharing links, broken inheritance and ownerless sites.
- Restricted Content Discovery contains high-risk sites temporarily. Owner-led access reviews are the permanent fix.
- Under the Privacy Act, APP 11 still applies inside your own Microsoft 365 environment. A documented audit is your evidence of reasonable steps.
- Measure the pilot on real tasks, timed before and after, including the time spent checking output.
Why does Copilot readiness start with permissions?
A salary spreadsheet saved to a Teams channel in 2021. A board pack shared with "People in your organisation" so a director could open it on a phone. An HR site nobody has owned since a restructure. Before Copilot, finding those files took effort and luck. After Copilot, a staff member types "what are the executive salaries this year" and the answer arrives with a citation.
The Australian Government saw this early. The Digital Transformation Agency's evaluation of the whole-of-government Copilot trial (more than 60 agencies, about 7,600 users, January to June 2024) found that "Copilot may magnify poor data security and information management practices" and recommended that agencies "must configure their information systems, permissions, and processes to safely accommodate generative AI products." That finding applies to any organisation running SharePoint: a council, a law firm, an engineering contractor or a hospital network.
This guide covers the audit to run before you buy licences: which reports to pull, which settings to change, which temporary controls Microsoft provides, how the Privacy Act bears on it, and how to structure a pilot that measures something real.
A note on names. Microsoft has been renaming its Copilot products, and older names persist in licences and admin screens (Microsoft Learn). This article uses "Copilot" for the licensed product that grounds answers in your organisation's Microsoft 365 data.
Why does oversharing become visible overnight?
Most Microsoft 365 environments in Australia grew one project at a time. A team was created for a tender, a SharePoint site for a merger, a folder broken out of inheritance so a contractor could see one drawing set. Each decision was reasonable. Nobody went back.
Microsoft's SharePoint Advanced Management Content Management Assessment looks specifically for "sites with oversized audiences, EEEU usage, broken inheritance, inappropriate sharing, and those that are inactive or ownerless" (Microsoft Learn). EEEU is "Everyone except external users", a built-in SharePoint group that automatically includes every internal account. Grant a site or folder to EEEU and every staff member can read it, which means every Copilot user can be answered from it.
| Typical inherited state | Copilot-ready state | Impact | |
|---|---|---|---|
| Default sharing link type | People in your organisation | Specific people | Each new share reaches named users only |
| 'Everyone except external users' grants | Unreviewed, often on HR and finance sites | Removed or justified site by site | Closes the widest internal exposure |
| Site ownership | Owners have left the organisation | Two accountable owners per site | Someone can approve access reviews |
| Inactive sites | Still searchable | Archived or excluded from Copilot | Stale content stops grounding answers |
| Sensitivity labels | Not deployed, or optional | Default and auto-labelling for key content | Copilot honours encryption usage rights |
| Anyone links | Enabled organisation-wide | Disabled or time-limited | Removes anonymous access paths |
These settings have been sitting in the admin centre for years. Copilot raises the cost of leaving them at their defaults.
Which Australian obligations sit behind the audit?
Privacy Act APP 11 applies inside your own environment
Australian Privacy Principle 11 requires entities to take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. Unauthorised access includes your own staff opening records they have no business reason to see. If payroll files, client health information or HR investigation notes sit on an overshared site, Copilot makes that access easier. The APP 11 question becomes whether your steps were reasonable once you knew the tool was coming.
The OAIC's Guidance on privacy and the use of commercially available AI products (October 2024) sets the expectation. Its first takeaway is that "privacy obligations will apply to any personal information input into an AI system, as well as the output data," and it asks organisations to do due diligence before adoption, including who will be able to access input and generated data (OAIC). A permissions audit is the most direct evidence of that due diligence for a Copilot rollout. For the wider picture, see our guide to Privacy Act compliance and AI.
Data residency: storage is in Australia, processing may not be
For organisations whose Microsoft 365 default geography is Australia, Microsoft's Product Terms data residency commitment covers Exchange Online, SharePoint and OneDrive, Teams, and Microsoft 365 Copilot, with Australian data centres in Sydney and Melbourne (Microsoft Learn, data residency overview). Prompts, responses and activity history are stored in line with your other Microsoft 365 content.
The processing side is different. Microsoft states that Copilot calls to the language model are routed to the closest data centres but "can call into other regions where capacity is available," and that "customers outside the EU may have their queries processed in the US, EU, or other regions" (Microsoft Learn). If your board or a government contract requires in-country processing as well as storage, raise it before the purchase. Microsoft also states that prompts, responses and data accessed through Microsoft Graph are not used to train foundation models. Our data sovereignty guide covers the storage and processing distinction in more depth.
How do you run a Copilot permissions audit?
The audit follows the same order as Microsoft's deployment guidance: find exposure, contain it temporarily, fix it at source, then set defaults so it does not return.
- DiscoverSite permissions, EEEU and sharing link reports
- PrioritiseRank sites by audience size and sensitivity
- ContainRestricted Content Discovery on high-risk sites
- RemediateOwner-led site access reviews and inheritance fixes
- LabelSensitivity labels and DLP for Copilot
- MonitorActivity reports and Copilot interaction audit
Step 1: Pull the data access governance reports
In the SharePoint admin centre, under Reports, the Data access governance reports give you the baseline (Microsoft Learn):
- Site permissions across your organization: a snapshot of permissions across all SharePoint and OneDrive sites, surfacing sites with thousands of users, external guests or EEEU permissions.
- Sites and files shared via special SharePoint groups: the exact sites, folders and files exposed through EEEU or "Everyone", so clean-up can be scripted instead of left to site owners.
- Sharing links, and Shared with 'Everyone except external users': activity reports covering the last 28 days, which catch new oversharing as it happens.
- Sensitivity label applied to files: where labelled content lives, so you can check the site protecting it matches the label.
Microsoft recommends running snapshot reports quarterly and activity reports monthly. One licensing detail matters: SharePoint Advanced Management is included with Copilot licences, while Microsoft 365 E5 without SAM gives the activity reports only. If you are auditing before any Copilot licence exists, check which reports your current licence exposes, because that decides whether the audit is a report run or a PowerShell exercise.
Step 2: Rank sites by blast radius
Not every overshared site matters equally. A marketing asset library open to the whole organisation is fine. A finance site open to the whole organisation is not. Score each flagged site on audience size and content sensitivity, and work the high-audience, high-sensitivity quadrant first. Microsoft Purview Data Security Posture Management risk assessments help with the sensitivity axis by identifying overshared sites that contain sensitive information types.
Across our consultants' careers on data platform and reporting programmes at BHP, Rio Tinto and Senex Energy, every access model followed the same path: security designed once at go-live, then eroded one exception at a time by project teams, contractors and reorganisations. SharePoint permissions drift for the same reason. What holds them in place is an owner who reviews access on a schedule. A one-off clean-up without that owner decays within a year or two.
Step 3: Contain high-risk sites while you fix them
Remediation on a large site can take weeks. Microsoft provides temporary controls so the rollout is not held hostage to the slowest site owner.
Restricted Content Discovery (RCD) is a site-level setting that stops a site's content appearing in organisation-wide search and Copilot responses without changing anyone's permissions (Microsoft Learn). Users who already have access can still open the content directly. It applies only to SharePoint sites, not OneDrive, and on very large sites the change can take more than a week to process. Apply it to your largest high-risk sites early so the delay runs while other work continues.
Restricted SharePoint Search is the older allow-list approach, limited to 100 sites. Microsoft has announced it is being retired and recommends RCD and SharePoint Advanced Management instead (Microsoft Learn). If a proposal or an older readiness checklist recommends it, that advice is out of date.
Microsoft Purview DLP for Copilot can exclude files and emails carrying specific sensitivity labels from Copilot grounding, and can stop Copilot responding to prompts that contain specified sensitive information types.
What did the audit find on this site?
- Sensitive content, broad audience, owner availableSite access review now, RCD until it is complete
- Sensitive content, broad audience, no ownerAssign ownership, apply Restricted Access Control, then review
- Inactive site with records valueMicrosoft 365 Archive or retention labels to exclude it from Copilot
- Specific labelled files must never ground answersPurview DLP for Copilot policy on that label
- Broad audience, non-sensitive contentLeave discoverable; it improves Copilot answers
Step 4: Fix access at source
Temporary controls only buy time. SharePoint Advanced Management site access reviews send flagged sites to their owners, who can remove excess users and groups, delete company-wide sharing links including EEEU grants, and correct broken inheritance down to file level. Sites without an owner need one assigned before any review can happen, and a site ownership policy keeps that from slipping. Once a site is remediated, remove RCD, because Microsoft warns that excessive use can reduce the content available and make Copilot answers less complete.
Step 5: Set defaults so the problem does not return
Change the default link type to Specific people, disable or restrict Anyone links and company-wide sharing groups, and require a site sensitivity label at creation so privacy and sharing settings follow the label. Configure default and auto-labelling with Purview Information Protection for the content types you care about. When a file is encrypted through a sensitivity label, Copilot honours the usage rights granted to the user, so labels become an enforcement layer on top of site permissions.
For how the same access principles apply when AI tools act on business data beyond Microsoft 365, see AI agent governance, data access and human override.
What does a realistic Copilot readiness roadmap look like?
Timelines depend more on how many site owners respond than on the size of your environment. The roadmap below assumes a dedicated internal lead and engaged business owners. Use it as a planning shape.
- Week 1-2DiscoverRun data access governance reports, list ownerless and inactive sites, confirm current licences and data location
- Week 3-4ContainRank sites by audience and sensitivity, apply Restricted Content Discovery to the highest-risk sites, change sharing defaults
- Week 5-8RemediateOwner-led site access reviews, fix broken inheritance, deploy sensitivity labels and DLP for Copilot
- Week 9-14PilotLicence a defined cohort, baseline tasks before go-live, review Copilot interactions in Purview
- OngoingOperateMonthly activity reports, quarterly snapshots, inactive site policy, decide expansion on measured results
Choosing the pilot cohort
Pick people whose work Copilot is good at. The DTA trial found use concentrated on summarising information and rewriting content, with Word and Teams the most used and most favourably viewed. Participants estimated time savings of up to an hour a day on summarising, first drafts and searching for information, yet only about a third used Copilot daily. Broad, untargeted licensing produces the second number without the first.
A strong cohort spans roles with heavy meeting load, document drafting and information retrieval: project managers, contract administrators, policy writers, executive assistants, bid teams. Include at least one person from each high-sensitivity area (finance, HR, legal) so the pilot tests whether your containment worked. Ask them, in week one, to try to find things they should not be able to see. That test is cheaper before go-live than after.
Our AI change management guide covers the adoption side, including why trained champions matter more than licence counts.
How do you measure Copilot value honestly?
Usage dashboards show who opened Copilot and how often, which says little about whether the work got better or faster. Before the pilot starts, choose three to five recurring tasks per role and time them: minutes from a two-hour meeting, a first-draft tender response, a monthly status report. Measure the same tasks at the end of the pilot, and have a reviewer score quality without knowing which version used Copilot.
Track the risk side as well. Purview DSPM Activity Explorer shows Copilot prompts, responses and sensitive data activity, and Purview Audit records interactions. A pilot that saved time but surfaced a payroll file has not succeeded. The DTA evaluation also notes that time saved was partly spent reviewing AI output for errors, so record the time after review and correction.
On licence cost. Copilot is sold as a per-user add-on to an eligible Microsoft 365 or Office 365 plan, with separate business and enterprise offerings (Microsoft Learn, licence options). Web-grounded Copilot Chat comes with eligible subscriptions, while chat grounded in your organisation's data needs the Copilot licence. Pricing and bundles change, so confirm current Australian pricing with Microsoft or your licensing partner before building a business case.
What usually goes wrong?
Treating the audit as an IT task. IT can run reports. Only business owners can say whether the finance team should see a site. Access reviews fail when owners do not know they own the site.
Using the temporary control as the permanent fix. RCD and Restricted SharePoint Search both leave permissions unchanged. Anyone with access can still open the file, so the exposure moves from Copilot back to browsing.
Ignoring Teams and OneDrive. Teams channels store files in SharePoint, private and shared channels have their own sites, and Microsoft notes Copilot honours permissions granted to people outside your organisation through shared channels. RCD does not apply to OneDrive, so broadly shared personal drives need sharing-link clean-up instead.
Waiting while shadow AI spreads. While the organisation waits, staff paste content into public chatbots, which the OAIC recommends against. Our post on staff leaking business data into public AI tools covers that risk. A well-governed Copilot often reduces it.
How do you get started this week?
The first useful step needs only an admin's afternoon:
- Run the Site permissions across your organization report and the EEEU report in the SharePoint admin centre.
- Sort by audience size and mark every site holding personal, financial or legal information.
- Check the Data location card in the Microsoft 365 admin centre and confirm your default geography.
If the results are longer than you expected, that is normal, and it is the right moment to plan the audit, containment and pilot before the licences arrive.
How Solve8 can help
Our team runs Copilot readiness engagements for mid-sized and enterprise Australian and New Zealand organisations: the permissions audit, containment, labelling and a pilot measured on real tasks, in fixed-fee phases agreed before we start. See our Copilot readiness service, our managed AI services for keeping it governed after go-live, or contact us to plan the audit.
