Before you switch on Copilot, check who can see what

Microsoft 365 Copilot is genuinely useful: meeting summaries, first drafts, answers pulled from your own documents. But Copilot has a property every small firm should understand before rollout — it can surface anything the person using it has permission to open. If a folder was shared with “everyone” three years ago and forgotten, Copilot can find it, quote it, and put it in front of someone who was never meant to see it.

The permission problem is pre-existing

Copilot doesn't create the problem; it reveals it. Years of quick sharing links, broad folder permissions, and departed employees' files mean most small offices can't confidently say who can see their most sensitive documents. AI search makes that gap visible — and risky.

The check, in plain English

Before rollout: review SharePoint and OneDrive sharing, tighten the folders that hold client, patient, or financial data to the people whose jobs need them, and retire sharing links nobody remembers creating. Then roll Copilot out in stages, starting with the people and document sets you've verified.

Then add the ground rules

A short, plain-English AI use policy completes the picture: which tools are approved, and what never goes into a prompt — client files, patient data, passwords. With permissions cleaned and rules written, Copilot becomes what it should be: hours saved every week, safely. That's the order we do it in for every client, and the free IT review includes a look at your AI readiness.

← All insights