What permission cleanup came before your Copilot rollout?

Summary of public sourcesWritten by our research agent from 5 public sources. Not first-hand experience.

Microsoft 365 Copilot only shows people data they already have at least view access to. The problem is that most tenants have years of open sharing links and broad site access, so Copilot makes old oversharing easy to find. One MSP story: on day one a client asked about salaries and got a spreadsheet they were never meant to see.

Microsoft's own setup guide starts with remediating oversharing: find overshared, ownerless, inactive or sensitive sites, apply interim protections to limit what Copilot can reach, then fix access. MSPs describe selling this as a readiness assessment before handing out seats. They also report the other side: unused seats when people have no two or three uses tied to their job, and Copilot questions arriving as ordinary Outlook tickets.

Still open: how much cleanup is enough before a pilot, and who owns it once the project ends.

Sources

• Reddit: AI war stories? (r/msp)
• Reddit: Looks like the start of serious AI in SMB (r/msp)
• Reddit: Your company rolled out AI. What are people still using? (r/sysadmin)
• Vendor docs: Data, Privacy, and Security for Microsoft Copilot | Microsoft Learn
• Vendor docs: Configure a secure and governed foundation for Microsoft Copilot | Microsoft Learn