Can Copilot see files the employee has no access to?

No. Microsoft 365 Copilot uses the permissions of the employee asking the question. It only shows information that employee could already reach without Copilot. That is why cleaning up overly broad permissions matters so much.

Do we need to check every file before switching on Copilot?

No, start with the places where sensitive information is stored, such as HR, salaries, contracts and finance. That is usually only a few sites or Teams. You can handle the rest step by step.

Does Microsoft use our company data to train Copilot?

According to Microsoft, data and prompts within Microsoft 365 Copilot are not used to train the underlying AI models, and they stay within the boundary of your Microsoft 365 environment. Record in your own AI policy which tools employees may and may not use.

Do we need a more expensive Microsoft 365 plan for Copilot?

Microsoft 365 Copilot is a separate licence on top of a business Microsoft 365 plan. You do not have to give everyone a licence at once. Start with a small group and expand when it demonstrably saves time.

Rolling out Microsoft 365 Copilot: why an SME should clean up file permissions first

More and more SMEs are considering Microsoft 365 Copilot. The idea is appealing: an assistant that summarises emails, writes meeting notes and finds the right documents in seconds. But that last part deserves a moment of thought. Copilot searches everything an employee has access to. If a folder with contracts, salaries or personnel files is shared too widely somewhere, that used to be a hidden problem. With Copilot, it is one question away.

Copilot sees what your employees can already see

Copilot is not a separate database of company information. At the moment of the question, it searches the email, Teams conversations and files the employee has permission to access. That is good news, because Copilot gives nobody new permissions. But it also means every mistake in your permissions suddenly becomes visible. Before, someone had to know exactly which folder held the salary overview. Now the question “what do my colleagues earn?” is enough.

In most businesses, permissions were not designed this way on purpose; they simply grew. A folder once quickly shared with everyone, a Team set to public, an old file server migration in which all permissions were copied over one to one.

Where permissions are usually too broad

Sharing links for “people in your organisation”. Handy for sharing something quickly, but anyone who has the link, or finds the file through search, can open it. Those links often stay around for years.
Public Teams and Microsoft 365 groups. Anyone in the company can find and read such a Team, even if it only contains management or HR matters.
Sites that “everyone except external users” can access. That group literally includes every employee.
Personal OneDrive folders in which employees shared files with large groups and have long since forgotten about it.
Accounts of former employees and old groups that were never cleaned up. See also our joiner and leaver checklist.

How to clean up permissions

This does not have to be a project that takes months. For most SMEs, this order works:

Map the sensitive places. Where are salaries, personnel files, contracts, customer data and financial figures stored? Often that is only a handful of sites, Teams or folders.
Check who can access them. Set public Teams with sensitive content to private, remove “everyone” groups and replace broad sharing links with access for specific people.
Tighten the default sharing link. Make new links apply to specific people by default instead of the whole organisation. Also review external sharing in SharePoint and OneDrive.
Label confidential documents. With sensitivity labels you can mark and encrypt documents, so they stay protected even if they end up somewhere they do not belong.
Exclude sites from Copilot where needed. Microsoft offers admin options to keep specific SharePoint sites out of Copilot’s search results. That is a good temporary measure for a site you have not yet been able to clean up.

Start small, and keep checking

Give Copilot to a small group of employees who will use it a lot first, for example a few people from sales and management. Ask them to deliberately ask about things they should not be able to see, such as salaries or performance reviews. If something comes up, you know which permissions are still wrong. Also agree clear rules on AI use, so employees do not turn to separate free tools. Read more about that in our article on Copilot and GenAI at work.

Permissions do not stay in order by themselves. New Teams, new employees and new sharing links are added every week. So plan a regular review, for example every quarter, and use the audit log when you want to find out who opened what.

How Floor ICT handles this

Before Floor ICT switches on Copilot for a client, we review permissions across SharePoint, Teams and OneDrive. We map where sensitive information is stored and who can reach it, correct overly broad groups and sharing links, and set up sensitivity labels where needed. Then we start with a small pilot group and agree how Copilot will be used. That way Copilot saves time, without anyone suddenly seeing things that were not meant for them.

View MSP packages Request an intake Microsoft 365