How to Clean Up SharePoint Permissions Before Turning On Copilot

Clean up SharePoint before Copilot by finding and fixing overly broad access: run the data access governance reports in the SharePoint admin centre, remove "Everyone except external users" from sensitive sites, restrict or expire "Anyone" links, move HR and finance files into private sites, then test with an ordinary account. Most small businesses need one to two days.

The reason is simple and Microsoft states it plainly: Copilot only surfaces organisational data that each user can already view. It doesn't create new access. It makes existing access easy to find, so a pay spreadsheet that has sat in a folder everyone could open since 2021 becomes the answer to "what do we pay instructors?" Nothing was hidden before; it was just obscure.

Follow me on Instagram@sagnikteaches

One common piece of advice is out of date. Restricted SharePoint Search, the allow-list setting many guides recommend, is retiring: Microsoft blocked new enablement from 31 July 2026 and points organisations to Restricted Content Discovery instead. If you're starting now, skip it and use the tools below.

Connect on LinkedInSagnik Bhattacharya

Why a Copilot licence changes the cleanup toolkit

Assigning even one paid Microsoft Copilot licence (sold to small businesses as Microsoft 365 Copilot Business, $21 a user a month on an annual commitment) gives your SharePoint administrators the SharePoint Advanced Management features Microsoft bundles for Copilot deployments. For business customers those include the data access governance reports, Restricted Content Discovery, restricted access control, site access reviews, the content management assessment and inactive-site and site-ownership policies. Microsoft's prerequisites page words its base-plan requirements in enterprise terms, so once the licence is assigned, check that these options actually appear in your SharePoint admin centre before planning around them. The free Microsoft Copilot Chat that comes with business plans works mostly on the web, on Outlook mail and on files you open, so the oversharing risk arrives with the paid licence, which searches across everything a user can reach.

Subscribe on YouTube@codingliquids

That suggests an order of work: license one administrator or a small pilot group first, use the tools that licence brings to clean up, then extend Copilot to everyone. The product itself is now called Microsoft Copilot in most places, though licence pages still say Microsoft 365 Copilot Business; they're the same thing. The licensing choices are covered in how to roll out Microsoft 365 Copilot to a small team.

The driving school used as the example here

Eleven people work at this illustrative driving school: the owner, an office manager, a bookings assistant and eight instructors, three of them self-employed contractors with company accounts. Its Microsoft 365 grew the usual way, one team and one folder at a time since 2021. Before touching anything, the office manager spent an hour writing down what exists, using this template:

SITE / TEAM     WHAT'S IN IT                     WHO CAN OPEN IT NOW      WHO SHOULD
Office          Admin, Pricing, HR folder,       Everyone except          Office staff; HR only
                Learners library                 external users (all 11)  owner + office manager
Instructors     Lesson schedules, handbook,      All instructors +        Same (fine)
  (Teams)       vehicle maintenance logs         office staff
Finance         Accounts, cash-flow reports,     Owner + bookkeeper       Same (fine)
                business valuation               (guest)
Owner OneDrive  Business plan and valuation      One "People in your      Owner only
                spreadsheet                      organization" link
Guests          Bookkeeper; former instructor's  -                        Bookkeeper only
                personal email (left 2023)

Two rows stand out before any report is run: the HR folder and the learner records inherit the Office site's "everyone" access, and a former instructor still has a guest account. That's typical. The biggest risks in a small business are rarely exotic; they're folders created in a hurry and never revisited.

Run the data access governance reports

In the SharePoint admin centre, expand Reports and select Data access governance. Microsoft suggests starting with the site permissions snapshot report (marked Recommended), which shows the sites with the broadest access, including those open to "Everyone except external users" (a built-in group containing every internal account) and those with guests. Then run the two activity reports, Sharing links and Shared with 'Everyone except external users', which cover the last 28 days. If your organisation doesn't have SharePoint Advanced Management, you have to enable data collection first, and activity reports become available 24 hours later.

The driving school's reports (illustrative) found:

• Office site: open to Everyone except external users, which covers all eleven accounts and every future account.
• Sharing links: 37 new links in 28 days, including six "Anyone" links from the Learners library, sent to parents with lesson schedules. One pointed at the whole library rather than a single file.
• Owner's OneDrive: the business plan shared with an organisation-wide link, pasted into a Teams chat once and forgotten.
• Guests: the bookkeeper, correctly, and the former instructor, who should have gone two years ago.

Don't confuse these with the Copilot readiness report in the Microsoft 365 admin centre (under Reports, Usage, Microsoft Copilot). It checks licences and app update channels, not sharing permissions, so a clean readiness report says nothing about who can open the HR folder.

Two limits to know. Activity reports only look back 28 days, so older links need checking another way, and the sharing settings change below helps with that. And the reports tell you where access is broad, not whether it's wrong: a handbook everyone can read is fine; a pay spreadsheet is not. That judgement is yours.

Tighten the organisation-wide sharing defaults

In the SharePoint admin centre, go to Policies and select Sharing. Three settings do most of the work, and here is the driving school's before and after:

The expiry change quietly fixes old links too. Microsoft's documentation says that if you shorten the maximum, existing "Anyone" links with a longer expiry are updated to the new, shorter setting. The default link type matters more than it looks: staff click Share and send whatever appears first, so making "Specific people" the default prevents most future oversharing without anyone needing training.

Staff will notice the change the first time they share something, so tell them before it happens. The note the office manager sent to the team:

"From Monday, when you click Share in SharePoint or OneDrive, the link will go only to the people you name. If a parent needs a lesson schedule, share that one file with their email address, not the folder. Links for people outside the school now stop working after 14 days, so resend if someone says a link has expired. HR and learner records are moving to their own sites this week; if you can't find something you need for lessons, message me rather than asking for the old folder back. This is to get ready for Copilot, which can find anything you can open."

That last sentence did more than any policy document. Once instructors understood that Copilot answers from whatever they can open, two of them flagged folders nobody had thought to check.

Guest clean-up belongs here as well. Remove the former instructor's guest account in the Microsoft 365 admin centre, and put guest removal into your leavers' process; the staff offboarding checklist for AI tools and shared accounts has the full list of what to close.

Fix the high-risk sites, in the right order

With the reports in hand, work through the sites where a wrong answer would hurt. For the driving school that meant HR, learner records and the owner's valuation. The order matters, as a realistic mistake shows.

On the first attempt, the office manager removed "Everyone except external users" from the whole Office site. Within an hour, three instructors messaged that they couldn't open the pricing sheet or the booking cancellation policy, which they use with learners every day. The fix was to reverse the change and do it properly:

1. Create private sites first. A new "HR" site with only the owner and office manager as members, and a "Learner records" site with office staff only. Move the HR folder and the Learners library into them.
2. Then change the Office site's membership from everyone to an "All staff" group, so the pricing sheet and policies stay open to instructors while the sensitive files have already left.
3. Replace the six "Anyone" links to the Learners library with single-file links to each learner's schedule, or better, send the schedule as an attachment.
4. Stop sharing the owner's plan by removing the organisation-wide link from the file's sharing settings.
5. Consider restricted access control for the HR site. It limits a SharePoint site to members of a named security group, so even if someone is accidentally added to the site later, only the group can get in.

Where a site has an owner other than you, use a site access review from the data access governance report to ask that owner to review and confirm the access, rather than guessing at what their team needs.

Hide sites still under review with Restricted Content Discovery

Some sites can't be fixed in a day. For those, Restricted Content Discovery keeps a site's content out of organisation-wide search and Copilot's answers while you work, without changing anyone's permissions. In the SharePoint admin centre, expand Sites, select Active sites, choose the site, open the Settings tab, turn on Restrict content from Microsoft Copilot and select Save. The PowerShell equivalent sets -RestrictContentOrgWideSearch $true on the site.

Three details matter. People can still find content they own or have recently worked on, so it isn't a lock. It applies to SharePoint sites only, not OneDrive. And Microsoft warns against using it widely: the driving school first applied it to the Instructors site as well, and instructors' Copilot answers about test-day procedures got noticeably worse, because the handbook had disappeared from Copilot's reach. Use it on the few sites under review, then remove it once they're fixed.

It helps to be clear which tool solves which problem, because they're easy to confuse:

Label the files that must never surface loosely

Permissions decide who can open a file; sensitivity labels add a second layer that travels with the file. Microsoft 365 Business Premium includes sensitivity labels that staff apply by hand, and when a label encrypts a file, Copilot honours the usage rights it grants. The driving school created one label, "Confidential - owner and office only", applied it to the pay rates, contracts and valuation files, and set it to encrypt so that even a file copied somewhere careless stays closed. If you're on Business Standard, this is one of the practical differences that may justify the upgrade; Business Premium vs Standard for AI security weighs it up.

Test as an ordinary user before anyone else gets Copilot

Reports show access; only a test shows what Copilot will actually say. Use a normal staff account, ideally a real instructor's with their permission, and ask the questions you'd least like answered:

What do we pay instructors per hour?
Summarise any disciplinary notes about instructors.
Which learners have declared a health condition?
What is the business valued at?
Find contracts that mention termination or notice periods.
Show me the bookkeeper's latest report.

Before the cleanup, an illustrative answer to the first prompt read: "Instructor pay ranges from $22 to $28 an hour depending on grade, according to Instructor pay rates 2026.xlsx in Office > HR. Two instructors were moved to the higher grade in June." After the cleanup, the same account got: "I couldn't find information about instructor pay in content you have access to." That second answer is the goal.

The health-condition prompt matters even more, because learner declarations are personal data about customers, not staff. Before: "Three learners have declared conditions: [first name] (epilepsy, seizure-free for two years), [first name] (monocular vision) and [first name] (diabetes), per Learner declarations.xlsx." After the Learners library moved to its private site, an instructor's account got nothing, while the office manager's account, which should see it, still got a correct answer. Test both sides: the people who shouldn't see a file, and the people who must still reach it.

If anything still comes back, click through Copilot's citation to see which file it used, then check how that account can reach it: a direct share, a group, a link or a Teams chat. The driving school's first test surfaced one more file, a copy of the pay spreadsheet an office member had attached to an Instructors team chat months earlier. Chats are content too.

Keeping permissions tidy after launch

Cleanup decays. New sites, new links and new staff reopen the gaps within months unless someone checks. A cadence that suits a small business:

For the driving school, the whole first pass took about seven and a half hours over three days: an hour of mapping, an hour on reports plus the 24-hour wait, twenty minutes on sharing settings, three hours on the HR and learner sites, ten minutes on Restricted Content Discovery, an hour on labels and forty-five minutes of testing. Against three pilot Copilot licences at $21 each a month, that's a modest one-off cost for knowing the answers Copilot gives are safe to give. If you want a broader pre-launch list covering training and settings beyond SharePoint, the Microsoft 365 Copilot readiness checklist picks up where this leaves off, and whether Copilot keeps your business data private covers what Microsoft does with the prompts themselves.

Further reads

• Is Microsoft 365 Copilot Worth It for a Small Business? — Decide whether Copilot earns its licence before you clean up.
• Microsoft 365 Copilot Pricing: Business vs Enterprise Licences — Which Copilot licence a small business actually needs.
• AI Security Checklist Before Connecting Tools to Email and Files — A wider security check before connecting any AI to files.
• How to Hire a Microsoft 365 Partner for a Copilot Rollout — What to ask a partner if you'd rather hand this over.
• How to Check Which Apps Can Access Your Business Accounts — Find other apps that can already read your files.
• Copilot in Teams Meetings: Recaps, Actions and Privacy Settings — The privacy settings for Copilot in Teams meetings.
• AI Security Risks for Small Businesses and How to Close Them — Eleven AI security risks in a small business, each with a real-world example, how to close it, how to check it's closed, and when to do it.
• How to Classify Business Data Before Using AI Tools — A four-tier scheme a small team can apply in an afternoon, with the AI rule for each tier and a fitness studio classified line by line.
• How to Organise Shared Files So AI Tools Can Use Them — Three afternoons to get a shared drive ready for Copilot, Gemini or ChatGPT, with a wedding planner's folder tree and a ten-question test.
• Can AI Work With the Tools Your Business Already Uses? — The four ways AI connects to the software you run on, a 30-minute stack audit, an insurance broker's tools mapped, and workarounds for old systems.
• Reusing Past Client Work With AI Without Leaking Client Data — How consultants and small firms turn old client reports into a reusable AI library: contract checks, three reuse tiers, sanitising, and access controls.
• Is Your Business Data Ready for AI? A Clean-Up Checklist — A 50-record sample test and a five-part clean-up checklist, each item with why it matters and how to check it, plus a record cleaned before and after.
• ChatGPT or Copilot for a Microsoft 365 Business? — Decide whether a Microsoft 365 team needs paid Copilot, ChatGPT or included chat, using a two-user cost and workflow trial.
• AI Knowledge Base Options for Small Businesses Compared — Five kinds of AI knowledge base compared on permissions, citations, setup time and monthly cost, with a tutoring agency's costed choice.
• ChatGPT Connectors: What They Can See in Your Drive and Inbox — What ChatGPT's Drive, Gmail, Outlook and SharePoint apps can read, where training and memory come in, and the admin switches that narrow access.
• Copilot in Word: Draft Proposals From Your Own Files — A care-home cleaning proposal drafted from five sources, the old client name it leaked, and what Copilot in Word can read with and without the licence.
• AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.

Sources: Microsoft Learn articles on Restricted SharePoint Search (retirement notice), SharePoint Advanced Management overview, prerequisites and features included with Copilot licences, Restricted Content Discovery, data access governance reports, sharing settings for SharePoint and OneDrive, and data, privacy and security for Microsoft Copilot. All checked September 2026.