Microsoft 365 & Copilot in the Enterprise · Chapter 8 of 12
Oversharing — the thing that actually stops deployments
Copilot respects permissions perfectly. That is the problem, and two-thirds of organisations have delayed a rollout over it.
This is the chapter to read if you only read one. The most common reason a Copilot programme stalls is not cost, model quality or user resistance. It is a permissions problem that has been sitting quietly in the estate for a decade.
The mechanism, stated exactly
Copilot enforces your existing permissions correctly. Microsoft's own wording: Copilot and agents retrieve data from Microsoft Graph and respect existing permissions, sharing settings, and policies. There is no bug here and no bypass.
Microsoft's own worked example, which is an admission
From Microsoft's readiness documentation: a budgeting site that was shared too broadly years ago and forgotten. When Alex asks Copilot for some budgeting information, Copilot gets information from the budgeting site.
Alex could always have opened that site. Alex never did, because finding it required knowing it existed and searching for exactly the right thing.
Copilot removes that friction entirely.
The permissions did not change. What changed is that obscurity stopped being a working control — and in most organisations obscurity was doing far more of the work than anyone had admitted.
Chapter 3 explained where a lot of this originates: when file shares migrate to SharePoint, explicit deny rules are dropped, because SharePoint has no equivalent. That is one documented source of over-broad access. A decade of ‘share with everyone in the company so nobody has to ask me again’ is the other.
How big is it, and who says so
- CoreView, July 2026: two-thirds of organisations have delayed or cancelled a Copilot deployment; 73% cited confidentiality; 75% of C-suite respondents said they personally issued the instruction to delay.
- Concentric AI, 2025: about 16% of business-critical data overshared in the average tenant. Flag the incentive — they sell tooling to fix exactly this.
- HMRC's evaluation of its own 3,500-licence deployment: 46% of people who did not use their licence gave security or privacy as the reason. That is a different failure — not the organisation blocking the tool, but users declining a licence already paid for.
A widely repeated statistic that does not survive checking.
A ‘Gartner survey of 132 IT leaders, 40% delayed three months or more’ circulates attached to this topic. Fetching the article it is attributed to shows it explicitly does not cite Gartner and cites a different firm entirely.
It is a citation-chain error — a number that acquired an authoritative-sounding source as it was copied between summaries. The finding it distorts is real; the attribution is not. This is worth carrying as a habit, not just a fact: when a statistic is doing heavy argumentative work, open the source it names.
What you actually do about it
SharePoint Advanced Management is the toolkit, and it is bundled free with any Copilot licence in the tenant.
| Tool | What it does |
|---|---|
| Content Management Assessment | Microsoft's own stated step one. Scans the tenant for oversharing risk. Rerun every 30 days. |
| Data Access Governance reports | Which sites are shared with ‘Everyone’, which carry sensitivity labels, 28-day sharing-link activity. E5 administrators get a reduced set of these even without the full add-on. |
| Site access reviews | Pushes the decision to site owners, who know what the content is — administrators are deliberately barred from file-level detail. Up to 1,000 reviews a month. |
| Restricted Content Discovery | Removes a site from search and Copilot entirely while you fix its permissions. Allow a week or more to take effect on very large sites. |
| Microsoft 365 Archive | Moves inactive sites out of scope — and Microsoft states Copilot is not trained on archived content. |
One tool is on its way out and appears in most current guides: Restricted SharePoint Search, a temporary allow-list capped at 100 sites. New enablement was blocked on 31 July 2026 and it retires fully on 31 January 2027. Microsoft is explicit that it was never a security boundary — it was a stopgap while you remediated. Restricted Content Discovery replaces it.
On the Purview side, the front door is Data Security Posture Management for AI, which ships a one-click policy that blocks Copilot from processing content carrying chosen sensitivity labels, and a default weekly oversharing assessment. Note the enforcement detail: for labelled and encrypted content the user must hold both view and extract rights, and content Copilot drafts inherits the highest-priority label of its sources automatically.
The sequence, in order
Microsoft publishes an explicit ordering, which is unusual and worth following:
- 1. Run the Content Management Assessment. Find out how bad it is before you argue about it.
- 2. Archive or delete genuinely inactive content. The cheapest remediation is having less.
- 3. Fix the sharing settings — noting Microsoft's own warning that by default, SharePoint sets sharing settings to the most permissive option.
- 4. Apply Purview labels and the DSPM policy for anything genuinely sensitive.
- 5. Take a backup before go-live.
- 6. Only then remove the temporary restrictions, and tell agent owners that results now reflect real permissions.
Notice what this actually is. Steps 1 to 3 are an information-governance programme that most organisations have needed for years and deferred because nothing forced the issue. Copilot did not create this work. It set a deadline for it — and made it visible to executives in a way that a decade of governance proposals never managed.
One named incident, for completeness
EchoLeak (CVE-2025-32711), disclosed around 12 June 2025, rated 9.3 out of 10. A zero-click prompt injection: a hidden instruction inside an ordinary email that Copilot's own retrieval later pulled into an unrelated query, exfiltrating data through rendered links.
Microsoft shipped a server-side fix and no exploitation in the wild was confirmed.
Worth knowing because it is a genuinely new class of problem: the attack arrived as content, and the retrieval step that makes Copilot useful is what executed it. The primary advisory did not render when this was researched, so the detail rests on converging secondary sources.
Check yourself