Illustrative scenario: the organization below is a fictional composite. It reflects problems and fixes we commonly see in Microsoft 365, Intune, Purview and Azure environments. Names and figures are examples, not a specific client.
This Copilot readiness case study follows a consulting firm that wanted Microsoft 365 Copilot quickly but discovered, during a permissions review, that half its SharePoint content was visible to the whole company. Copilot only shows people what they can already open, so fixing oversharing came first.
75 staff, 2 offices, about 210 SharePoint sites and Teams
Microsoft licensing
Microsoft 365 Business Premium, plus Microsoft 365 Copilot for a 15-person pilot
Challenge
Client files, HR records and salary data reachable by everyone through broad permissions
What we did
Permissions cleanup, sensitivity labels, Restricted Content Discovery on high-risk sites during the pilot, staged Copilot rollout
Outcome
Org-wide permissions removed from 61 of 64 flagged sites, zero oversharing incidents in the pilot, Copilot extended to 40 users
The challenge
The managing partners had seen Copilot drafting proposals and summarizing meetings and wanted it for the whole firm. Their IT lead raised a concern: during a Copilot demo on a trial license, a consultant asked for “examples of our day rates” and got back a spreadsheet from the finance team with partner compensation in it.
Copilot had not done anything wrong. That spreadsheet sat in a site that everyone in the company could read. Copilot simply made it easy to find. The partners asked us to make the firm safe for Copilot without pausing the project for six months.
What we found
The Copilot licenses for the pilot brought SharePoint Advanced Management features with them, including data access governance reports. We used those reports and a manual review of the top sites:
64 sites granted access to “Everyone except external users”, often added years ago to “make sharing easier.”
Broken permission inheritance on hundreds of folders in the client delivery sites, so site owners had no idea who could see what.
Over 2,300 “People in your organization” sharing links, many on folders rather than single files.
No sensitivity labels. Nothing distinguished a public brochure from an HR investigation file.
31 sites had no active owner because the owner had left the firm.
What we changed
1. Hold back the riskiest sites while we worked
Microsoft’s Restricted SharePoint Search was the old stopgap here, but new enablement ended on July 31, 2026, so we used Restricted Content Discovery instead. In the SharePoint admin center under Sites > Active sites > [site] > Settings, we turned on Restrict content from Microsoft Copilot for HR, finance, partner and the 12 most sensitive client sites. Permissions did not change, but content from those sites stopped surfacing in organization-wide search and Copilot while we cleaned up.
2. Clean up permissions
Removed “Everyone except external users” from 61 of the 64 sites. The other three, the intranet, the policy library and the templates site, kept it on purpose.
Ran site access reviews so each site owner confirmed membership, and assigned new owners to the 31 orphaned sites.
Reset inheritance on client delivery sites to a standard model: one Microsoft 365 group per client engagement, no folder-level exceptions.
Changed the default sharing link type to “Specific people” and expired old organization-wide links.
3. Sensitivity labels
We published four labels in Microsoft Purview: Public, General, Confidential and Highly Confidential. Highly Confidential applies encryption so only the named group can open the file, wherever it ends up. We also turned on labels for containers, so a site labeled Confidential is private and blocks guest access. Documents without a label get General by default, and staff choose a higher label when needed.
4. Pilot Copilot, then expand
Fifteen pilot users from delivery, sales and operations got Copilot licenses for six weeks. We gave them a short guide on good prompts and on what to do if Copilot ever surfaces something they should not see. Each week we checked the sharing and permissions reports again and removed Restricted Content Discovery from sites as they passed review.
Results
In this scenario, after ten weeks:
Org-wide access removed from 61 of 64 flagged sites, and organization-wide sharing links down from about 2,300 to under 200.
Every site has at least two active owners.
About 900 files labeled Confidential or Highly Confidential, mostly by staff during the cleanup.
No reported oversharing incidents during the six-week pilot.
Pilot users reported saving roughly two to three hours a week on proposal drafts and meeting recaps, and the firm extended Copilot to 40 users.
Restricted Content Discovery remains on only the HR and partner sites.
Lessons for your business
Copilot is a mirror. It reflects your permissions back at you. If people can open it, Copilot can find it.
“Everyone” permissions are the first thing to check. They are easy to add and easy to forget.
Use temporary controls as a bridge, not a fix. Restricted Content Discovery buys time for the cleanup, it does not replace it.
Start the pilot small and keep checking reports. Weekly reviews catch new oversharing before it spreads.
No. Copilot only returns content the signed-in user already has permission to access. The risk is that broad permissions you have forgotten about become much easier to find.
Is Restricted SharePoint Search still available?
Microsoft is retiring it, and new enablement was blocked from July 31, 2026. Microsoft points customers to Restricted Content Discovery and SharePoint Advanced Management instead.
Do we need Microsoft 365 E5 for sensitivity labels?
No. Business Premium and E3 support manual sensitivity labels, default labels, and labels for sites and Teams. Automatic labeling based on content needs E5 or a Purview add-on.
Illustrative scenario: the organization below is a fictional composite. It reflects problems and fixes we commonly see in Microsoft 365, Intune, Purview and Azure environments. Names and figures are examples, not a specific client.
This Copilot readiness case study follows a consulting firm that wanted Microsoft 365 Copilot quickly but discovered, during a permissions review, that half its SharePoint content was visible to the whole company. Copilot only shows people what they can already open, so fixing oversharing came first.
At a glance
The challenge
The managing partners had seen Copilot drafting proposals and summarizing meetings and wanted it for the whole firm. Their IT lead raised a concern: during a Copilot demo on a trial license, a consultant asked for “examples of our day rates” and got back a spreadsheet from the finance team with partner compensation in it.
Copilot had not done anything wrong. That spreadsheet sat in a site that everyone in the company could read. Copilot simply made it easy to find. The partners asked us to make the firm safe for Copilot without pausing the project for six months.
What we found
The Copilot licenses for the pilot brought SharePoint Advanced Management features with them, including data access governance reports. We used those reports and a manual review of the top sites:
What we changed
1. Hold back the riskiest sites while we worked
Microsoft’s Restricted SharePoint Search was the old stopgap here, but new enablement ended on July 31, 2026, so we used Restricted Content Discovery instead. In the SharePoint admin center under
Sites > Active sites > [site] > Settings, we turned on Restrict content from Microsoft Copilot for HR, finance, partner and the 12 most sensitive client sites. Permissions did not change, but content from those sites stopped surfacing in organization-wide search and Copilot while we cleaned up.2. Clean up permissions
3. Sensitivity labels
We published four labels in Microsoft Purview: Public, General, Confidential and Highly Confidential. Highly Confidential applies encryption so only the named group can open the file, wherever it ends up. We also turned on labels for containers, so a site labeled Confidential is private and blocks guest access. Documents without a label get General by default, and staff choose a higher label when needed.
4. Pilot Copilot, then expand
Fifteen pilot users from delivery, sales and operations got Copilot licenses for six weeks. We gave them a short guide on good prompts and on what to do if Copilot ever surfaces something they should not see. Each week we checked the sharing and permissions reports again and removed Restricted Content Discovery from sites as they passed review.
Results
In this scenario, after ten weeks:
Lessons for your business
We run this process through our Microsoft Copilot readiness service, with sensitivity labels and the wider Microsoft 365 services behind it.
Frequently asked questions
Does Copilot ignore SharePoint permissions?
No. Copilot only returns content the signed-in user already has permission to access. The risk is that broad permissions you have forgotten about become much easier to find.
Is Restricted SharePoint Search still available?
Microsoft is retiring it, and new enablement was blocked from July 31, 2026. Microsoft points customers to Restricted Content Discovery and SharePoint Advanced Management instead.
Do we need Microsoft 365 E5 for sensitivity labels?
No. Business Premium and E3 support manual sensitivity labels, default labels, and labels for sites and Teams. Automatic labeling based on content needs E5 or a Purview add-on.
Planning a Copilot rollout? Start with a free Microsoft 365 security assessment to see where your data is overshared.