AI · 2 min read ·
Microsoft 365 Copilot: a checklist before rollout
Copilot sees everything the user has access to. That is why over-broad sharing and old permissions are worth cleaning up before rollout. Here is how to prepare.
Microsoft 365 Copilot answers questions and writes drafts based on the company’s own files, e-mails and Teams conversations. It is useful precisely because it finds information fast. The same feature makes it a risk if permissions are not in order.
Copilot doesn’t bypass permissions, but it surfaces them
Copilot shows a user only what they already have access to. Yet in many companies there are more permissions than anyone knows: folders shared with the whole company, “anyone with the link” shares and old groups. Before, you had to know where to look. With Copilot it is enough to ask: “What do you know about salaries?”
Checklist
- Sharing and links: find files and folders shared with the whole company or with anyone via a link, especially salaries, HR, contracts and customer data.
- Permissions: review the members of SharePoint sites and Teams groups and remove access the job does not need.
- Classification: turn on sensitivity labels so that sensitive information is recognised and protected.
- Old information: delete or archive information whose retention period has ended. The less needless data, the smaller the leak risk.
- A pilot with a small group: start with a few users and deliberately ask Copilot about sensitive things. You see at once what it finds.
- Ground rules: update the AI use policy: what Copilot is used for, how results are checked and how mistakes are reported.
- AI literacy: train the users. The EU AI Act requires it of companies that use AI.
What about privacy?
Copilot processes personal data, so the processing should be recorded and assessed. Make sure Copilot is used with work accounts, so it falls under the data protection terms of the company’s Microsoft agreement. Consider a data protection impact assessment if Copilot is used in HR, for example, and add Copilot to the AI register.
Foregon helps
We review your Microsoft 365 Copilot readiness: sharing, permissions, classification and settings, and you get a clear list of fixes. The Security Folder’s AI register keeps Copilot and other AI services under control from then on.