Microsoft 365 Copilot is one of the most requested tools we are asked about. It can summarise long email threads, draft documents from your own files, pull together meeting notes and answer questions about your work in plain English. Used well, it saves real time.

But there is one fact about Copilot that every business owner should understand before buying a single licence: Copilot works with what each user can already access. It does not bypass permissions. It also does not fix them.

That sounds reassuring, and in one sense it is. In practice it means that every file someone could open but would never have found is now a single question away.

Why oversharing suddenly matters

Picture a 30-person engineering firm in Pretoria East. Over eight years, people have created Teams, shared folders with “everyone in the organisation” to get a project moving, and sent sharing links that were never removed. Somewhere in SharePoint there is a spreadsheet of salaries that HR shared with a manager in 2021 using a link anyone in the company could open.

Nobody stumbled on it, because nobody went looking. With Copilot, a junior staff member asking “what do people in my role earn here?” might get a helpful, accurate answer drawn from that file.

Copilot did nothing wrong. It respected the permissions exactly. The permissions were the problem.

Before Copilot, poor permissions were a hidden risk. After Copilot, they become a visible one. Fix them first.

The readiness checklist

Work through these in order. Some will take an afternoon; others may take a few weeks depending on how much has accumulated.

1. Find and fix oversharing

Review SharePoint sites and Teams for content shared with everyone in the organisation, or through “anyone with the link” sharing.
Identify sensitive locations first: HR, finance, payroll, board and management, legal, and client files with personal information.
Check membership of each Team and SharePoint site. Remove people who no longer need access, and former staff accounts that should have been disabled.
Review OneDrive sharing. Personal OneDrives often hold files shared widely “just for now” years ago.
Tighten default sharing settings so new links are scoped to specific people unless there is a reason otherwise.

2. Tidy permissions into a structure people understand

Ad-hoc permissions on individual files are hard to manage and hard to audit. Where possible, move to permissions granted through groups (for example “Finance team”, “Project managers”) assigned at the site or library level. When someone changes role, you change their group membership and the access follows.

3. Apply sensitivity labels to what really matters

Microsoft Purview sensitivity labels let you classify documents as, for example, General, Confidential or Highly Confidential, and apply protection such as encryption or restrictions on who can open them. Copilot respects these protections.

Start small: two or three labels, applied to your most sensitive libraries first. A labelling scheme that people understand and actually use beats an elaborate one that everyone ignores.

4. Deal with stale and duplicate data

Copilot will draw on old drafts, superseded policies and outdated price lists as readily as current ones. If your file shares contain five versions of the leave policy, expect Copilot to occasionally quote the wrong one.

Archive or delete obsolete sites and Teams.
Agree where the “official” version of key documents lives.
Set retention policies so that content is kept as long as it needs to be, and not indefinitely by default.

5. Get identity and access security right

Copilot makes it easier to find and summarise information. That is equally true for an attacker who has taken over a user’s account. Before rollout, confirm:

MFA is enforced for every user, including administrators and service accounts where applicable.
Conditional Access policies are in place, for example requiring compliant or known devices and blocking risky sign-ins.
Legacy authentication is disabled.
Former employees’ accounts are disabled promptly as part of a defined offboarding process.
Admin roles are limited to the people who genuinely need them.

6. Check licensing and choose a pilot group

Copilot is an add-on licence that requires an eligible Microsoft 365 base licence. Rather than licensing the whole business on day one, choose a pilot group of perhaps five to eight people:

Include people with heavy email, document and meeting workloads, such as managers, project leads and senior administrators.
Include at least one sceptic. Their feedback will be more useful than an enthusiast’s.
Make sure the pilot group’s own access is clean, because they will be the first to surface any oversharing you missed.

While you are reviewing licences, it is worth checking for waste elsewhere, such as licences assigned to departed staff or users on a higher tier than they need. We review Microsoft 365 licences for exactly this as part of our managed service.

7. Plan adoption and training

The most common reason Copilot disappoints is not technical. People simply don’t know what to ask it. Plan for:

A short, practical session using examples from your own business, not generic demos.
A shared list of prompts that work well for common tasks: summarising a client email thread, drafting a project update, preparing for a meeting.
Clear guidance that Copilot’s output must be checked. It can misread context, combine information incorrectly or present an old document as current.
A channel where pilot users share what worked and what didn’t.

Your existing AI acceptable-use guidance applies here too. If you don’t have one yet, our article on POPIA and AI tools sets out what it should cover.

8. Decide in advance how you will measure value

Before the pilot starts, agree what “worth it” looks like. Useful measures for a small business are practical rather than scientific:

Which tasks do pilot users now do faster, and roughly by how much?
How often do they use it in a typical week after the novelty wears off?
Did anything go wrong, such as an incorrect summary or an unexpected file surfacing?
Would each pilot user keep their licence if they had to justify it to their manager?

Review after a fixed period, then decide whether to expand, adjust or stop. It is perfectly reasonable to conclude that Copilot suits some roles and not others.

What Copilot won’t do for you

It won’t clean up your data, enforce your policies or decide who should see what. It won’t replace purpose-built automation for structured workflows like processing supplier invoices or onboarding staff; for those, see where AI automation actually pays off. And it won’t make a poorly secured tenant safer. If anything, it raises the stakes.

The work is worth doing anyway

The good news is that almost everything on this checklist is worth doing whether or not you buy Copilot. Clean permissions, clear labels, enforced MFA and tidy data reduce your exposure to breaches and accidental disclosure, and make life easier for your staff.

It follows the same order we use with every new client: Discovery, Stabilise, Document, Improve, Operate. Secure the essentials first, then improve in a structured way.

Not sure where you stand?

If you would like an outside view before committing to Copilot, our free Automation & Risk Check is a 30-minute review of where AI and automation would genuinely help, plus the basics: backups, security and documentation. You receive a one-page report, and there is no obligation.

Before you buy Microsoft 365 Copilot: a readiness checklist