Is our SharePoint ready for Copilot?

The question behind the question

Copilot doesn’t decide what people can see. Microsoft is explicit that Copilot and agents respect existing permissions, sharing settings, and policies. What changes is how easy it is to find things. A salary spreadsheet shared with “everyone” three years ago was safe because nobody knew it was there. Ask Copilot about pay rates and it isn’t.

So “is our SharePoint ready for Copilot?” really means: would you be comfortable if every person could find everything they can technically open? For most mid-market tenants, the honest answer is no, because nobody has counted. Four checks tell you.

1. Oversharing

Start with the links, because that’s where most exposure lives.

• Sharing links. In the SharePoint admin centre, the sharing links activity reports show which sites have the most “Anyone”, “People in your organisation” and “Specific people” links.
• Everyone except external users. The EEEU report shows where content was shared with the whole organisation. Everything on that list is in reach of every Copilot user you license.
• Your sharing defaults. Microsoft notes that SharePoint sets sharing to the most permissive option by default. If nobody changed it, every new link starts wide open.
• Outside the tenant. The free External Sharing Risk Scanner lists every file shared outside your organisation, who shared it and whether the link still works.

Look hardest at OneDrive. People share from it without thinking of it as a company system, and its links are as visible to Copilot as any site’s.

2. Permissions and inheritance

Links are the visible half. The other half is who has been granted access, and how.

• The baseline. The site permissions baseline report gives a snapshot of your permission structure across SharePoint and OneDrive, and flags the sites that need attention first.
• Broken inheritance. A folder that stopped inheriting from its site years ago is a permission model nobody maintains.
• Access granted to individuals. Every direct grant to a person rather than a group is a grant that outlives their role.
• Sites nobody owns. An ownerless site has nobody to approve or remove access. Set a site ownership policy so every site keeps at least two owners.

The free Permission Visualiser shows who can actually reach a site, and through which group, link or inherited permission. For the background, read who can actually reach a SharePoint site.

3. Sensitivity labels and Purview

Permissions decide who can open a file. Labels decide what happens to it once they do.

• Do labels exist? Having Purview licensed doesn’t mean anyone has published a label.
• Are they on the right files? A label policy that nobody applies protects nothing. The sensitivity labels report shows coverage, though it needs E5 or G5.
• Retention. Records you’re obliged to keep, and drafts you should have deleted, both feed Copilot’s answers. Retention policies decide which is which.

4. SharePoint Advanced Management

This is the part most organisations don’t know they already have. If you assign at least one Microsoft Copilot licence, SharePoint admins get the Advanced Management features that support it.

• Content Management Assessment. A guided run of the key reports, with recommendations. Microsoft suggests re-running it every 30 days.
• Site access reviews. Hand the review of an overshared site to the person who owns it, rather than the IT team guessing.
• Restricted Content Discovery. Keeps a high-risk site out of Copilot and organisation-wide search without changing who can open it.
• Restricted Access Control. Limits a site to one security group, even for people who had access through an old link.

What ready looks like

You’re ready for Copilot when you can say yes to five things:

• No “Anyone” links on sites holding sensitive records
• Every organisation-wide share reviewed and justified
• Every site has at least two owners
• Labels sit on the records that need them
• The handful of genuinely high-risk sites are restricted or hidden from search

Doing it yourself, or with us

You can run every check above yourself in the SharePoint admin centre. We’re Microsoft consultants in Sydney, and this is the work we do most often for mid-market organisations getting ready for Copilot. What takes the time is reading the results, working out which of a few hundred findings matter, and deciding what to fix first.

The SharePoint Audit does that in two to three weeks, read-only, and ends with a prioritised, fixed-price plan. It also traces a three-month-old record end to end, which tells you whether your records would survive an auditor as well as Copilot. See what one audit found in an 85-seat tenant. If you’d rather start smaller, read where to start with AI in Microsoft 365.