↗stuck with
copilot.
← Workflow library

For admins

Before you turn on Copilot: check who can see what

Short answer: Microsoft 365 Copilot only uses files a person already has permission to open. If a site is shared with everyone, Copilot can bring its files into answers for everyone. Find and fix overshared sites before you give people Copilot access to work data.

Last checked against Microsoft docs: Oct 20, 2026

Why this matters

Old permissions were easy to ignore when finding a file meant knowing where it was. Copilot finds it for you. A salary sheet in a site shared with "Everyone except external users" was hard to stumble on. With Copilot it can show up in an answer.

The checks

  1. Find widely shared sites. Use the data access governance reports in SharePoint Advanced Management to list sites shared with large groups or with "Everyone". Microsoft says SharePoint Advanced Management is included with Microsoft 365 Copilot licenses.
  2. Fix the worst first. Remove broad groups from sites that hold HR, finance, legal or customer data. Ask site owners to confirm who still needs access.
  3. Limit search while you clean up. Restricted SharePoint Search can limit organization-wide search and Copilot to a list of sites you choose, as a temporary step.
  4. Label sensitive files. Sensitivity labels in Microsoft Purview mark and protect files. Copilot respects the access a label gives.
  5. Add DLP rules for Copilot. Microsoft Purview data loss prevention can stop Copilot from using files with certain labels in its answers.
  6. Check again later. Run the reports again each month. New sites get overshared too.

Microsoft's own step-by-step plan is the secure and governed data foundation blueprint. Then share the answers using the questions for your Copilot admin.

Questions people ask

Can Copilot see files I do not have access to?

No. Microsoft 365 Copilot uses only data the signed-in person already has permission to access. The risk is files people can open but should not.

What is the fastest way to find overshared sites?

Run the data access governance reports in SharePoint Advanced Management, then fix sites shared with large groups first.

Cite or share this guide

Before you turn on Copilot: check who can see what. Stuck with Copilot. https://stuckwithcopilot.com/guides/copilot-oversharing-check/ Last checked Oct 20, 2026.

Official references

Last checked against Microsoft docs: Oct 20, 2026.