Copilot answers from whatever each person can already open in SharePoint, OneDrive and Teams. We find what it would surface in your tenant, contain the risky sites and design a pilot you can measure, before the licences arrive.
Microsoft's privacy documentation says Copilot "only surfaces organizational data to which individual users have at least view permissions." It does not get around SharePoint security. It reads the same access lists your sites, Teams channels and OneDrive folders have built up over years, and it reads them faster and more thoroughly than any person would.
Most tenants grew one project at a time. A team was created for a tender, a site for an acquisition, a folder broken out of inheritance so a contractor could see one drawing set. Somewhere in there is a salary spreadsheet in a Teams channel, a board pack shared with everyone in the organisation so a director could open it on a phone, or an HR site whose owner left two restructures ago. Before Copilot, finding those files took effort and luck. After Copilot, a staff member asks a plain question and the answer arrives with a citation.
The Australian Government found the same thing. The Digital Transformation Agency's evaluation of the whole-of-government Copilot trial, which ran from January to June 2024 across more than 60 agencies and about 7,600 users, found that "Copilot may magnify poor data security and information management practices." The finding applies to any organisation running SharePoint, whether that is a council, a law firm, an engineering contractor or a health service.
A note on names: Microsoft has renamed Microsoft 365 Copilot to Microsoft Copilot, and the older name still appears in licences and admin screens. This page uses "Copilot" for the licensed product that grounds its answers in your tenant's data.
Organisation size matters less than what is sitting in your tenant and what you are about to switch on.
HR investigations, payroll, legal matters, client health records or board papers stored on sites nobody has reviewed in years.
Shared channels, guest accounts and external sharing links built up across projects and joint ventures.
Licences budgeted or a pilot date set, with no clear picture of what Copilot will be able to answer from.
Personal information covered by APP 11, or a government contract with rules on data handling and AI use.
Restructures and staff turnover have left sites where nobody can say who should have access.
Staff pasting work content into public chatbots while the business decides what to approve.
If the shadow AI point sounds familiar, our post on staff leaking business data into public AI tools covers that risk. A governed Copilot rollout often reduces it.
The work follows the order in Microsoft's own deployment guidance: find exposure, contain it, fix it at source, then set defaults so it stays fixed.
We run the SharePoint data access governance reports across SharePoint, OneDrive and Teams, looking for sites with oversized audiences, 'Everyone except external users' grants, broken inheritance, organisation-wide and Anyone links, and inactive or ownerless sites. Each flagged site is ranked by audience size and how sensitive its content is.
We design a label set that matches how your organisation classifies information, with default and auto-labelling for the content that matters. Where a file is encrypted through a label, Copilot honours the usage rights granted to the user. Purview DLP for Copilot can keep labelled files out of Copilot answers altogether.
Restricted Content Discovery hides a site's content from organisation-wide search and Copilot without changing permissions, which buys time while owners review access. It covers SharePoint sites only, so OneDrive needs separate treatment. SharePoint Advanced Management site access reviews then fix access at the source.
The DTA trial found Word and Teams were the most used and most favourably viewed, while only a third of participants used Copilot daily. We help you pick a cohort whose work suits the tool, include people from finance, HR and legal to test containment, and record baseline task times before go-live.
The OAIC's Guidance on privacy and the use of commercially available AI products (October 2024) expects due diligence before adoption, including who will be able to access input and generated data. We document the audit, the decisions and the residual risks so you have that record.
Usage dashboards show who opened Copilot. We set up before and after measures on real recurring tasks, plus Purview DSPM Activity Explorer and Purview Audit reviews of Copilot interactions, so the expansion decision rests on evidence about time and about risk.
See what this would take in your business
A free 30-minute review on Microsoft Teams. Bring the process you want fixed and leave with a clear first step.
Licensing changes what the discovery step looks like. SharePoint Advanced Management is included with Copilot licences. Microsoft 365 E5 tenants without it get the activity reports only, without snapshot reports or remedial actions. If you are auditing before any Copilot licence exists, we check what your current licences expose first, because that decides whether discovery is a report run or a PowerShell exercise.
Containment needs planning too. Microsoft notes that on sites with more than 500,000 items, a Restricted Content Discovery update can take more than a week to process, so we apply it to the largest high-risk sites early and let that delay run while other work continues. Once a site is remediated, the restriction comes off, because leaving too much content hidden makes Copilot's answers less complete.
| Metric | Typical inherited state | Copilot-ready state | Improvement |
|---|---|---|---|
| Default sharing link | People in your organisation | Specific people | New shares reach named users only |
| 'Everyone except external users' grants | Unreviewed, often on HR and finance sites | Removed or justified site by site | Closes the widest internal exposure |
| Site ownership | Owners have left | Accountable owners assigned | Someone can approve access reviews |
| Sensitivity labels | Not deployed or optional | Default and auto-labelling for priority content | Copilot honours encryption usage rights |
| Anyone links | Enabled tenant-wide | Disabled or time-limited | Removes anonymous access paths |
Scope is agreed in the first call, so the list below is the usual shape and may change to fit your tenant.
How long each phase takes depends on how many sites are flagged and how quickly owners respond. In our published planning shape, discovery to the end of remediation runs about eight weeks when owners are engaged. Treat that as a starting estimate, which we firm up after discovery.
See what this would take in your business
A free 30-minute review on Microsoft Teams. Bring the process you want fixed and leave with a clear first step.
Australian Privacy Principle 11 requires reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. Your own staff opening records they have no business reason to see counts. If payroll files or client health information sit on an overshared site, Copilot makes that access easier, and the question becomes whether your steps were reasonable once you knew the tool was coming. The OAIC's first takeaway in its October 2024 guidance is that privacy obligations apply to personal information put into an AI system and to its output. Our guide to Privacy Act compliance and AI covers the wider picture, and the 2026 changes are in our post on automated decision rules.
Data residency needs a careful answer. For a tenant whose default geography is Australia, Microsoft's data residency commitments cover Copilot along with Exchange, SharePoint, OneDrive and Teams, with Australian data centres in Sydney and Melbourne, and Copilot became a covered workload on 1 March 2024. Processing is a separate question: Microsoft states that calls to the language model can go to other regions where capacity is available. Microsoft also states that prompts, responses and data accessed through Microsoft Graph are not used to train foundation models. If you need in-country processing as well as storage, our data sovereignty guide and private AI infrastructure service cover the options.
Agencies and suppliers working with NSW Government have a further layer. Our post on the NSW AI Assessment Framework explains how it applies to AI tools, and a Copilot readiness record is useful evidence when that assessment is done.
One timing point catches people out. Older readiness checklists recommend Restricted SharePoint Search, an allow list limited to 100 sites. Microsoft has announced it is retiring, and new enablement has been blocked since 31 July 2026. Any proposal built on it is out of date.
Start here if you have not yet decided whether Copilot is the right first AI investment. We work from use cases and data readiness back to which licences earn their place.
Learn moreOnce Copilot is live, the reports, labels and access reviews need an owner. We can run that operating rhythm with your team.
Learn moreWhen Copilot needs to draw on line-of-business systems through connectors, the integration and its permissions need the same care.
Learn moreFor workloads where content cannot leave your environment, self-hosted models sit alongside Copilot for the most sensitive material.
Learn moreGovernance does not stop at Microsoft 365. Our posts on AI agent governance and human override and building an AI governance framework apply the same access principles to other AI tools, and our change management guide covers the adoption side of a pilot.
Solve8 is based in Brisbane. Most of the readiness work happens in your admin centres and over Teams, so we deliver it across Australia. Site owner workshops in South East Queensland can be done in person when that gets reviews finished faster.
See our Brisbane AI consulting page for the wider set of services we deliver locally.
Our principal consultant brings 18 years of enterprise delivery experience from projects for BHP, Rio Tinto and Senex Energy, delivered with previous consulting employers. These companies are not Solve8 clients. You work directly with senior people, not a sales team handing you off to juniors.
Book a 30-minute scoping call. We will talk through your tenant, your rollout plans and the content you are most worried about, then agree what the readiness work should cover.