Microsoft 365 Copilot works with the permissions of the signed-in user. It can only use content that the user can already access, but it finds and summarises that content far faster than a person could. Permissions that were too broad but went unnoticed become visible overnight. A secure rollout therefore starts with your data and identities, not with licences.
Plan the checks below as a short readiness phase before the first licences are assigned. Most findings, such as broad permissions or missing labels, reduce risk whether or not you use Copilot.
Find and fix oversharing in SharePoint and OneDrive
SharePoint Advanced Management, which Microsoft includes with Copilot licences, provides the main tools for this work.
- Run data access governance reports to find sites shared with “Everyone except external users” or through broad sharing links
- Start site access reviews so that site owners confirm or remove access
- Use Restricted Content Discovery to keep high-risk sites out of Copilot while you clean them up
- Apply restricted access control to limit sensitive sites to specific groups
- Fix the root causes: default sharing settings, orphaned sites and missing owners
Label and protect sensitive content in Microsoft Purview
Sensitivity labels tell Copilot and your users how content must be handled. Define a small, understandable label taxonomy and apply default labels to new content. Labels with encryption restrict Copilot to users with the required usage rights. Use Purview Data Loss Prevention to stop sensitive information from leaving through Copilot interactions, and use Data Security Posture Management to see how AI is used across your organisation. Make sure Copilot prompts and responses are covered by audit, retention and eDiscovery.
Harden identities in Microsoft Entra ID
Copilot is only as secure as the accounts that use it. A compromised account gives an attacker the same fast access to content that the legitimate user has.
- Require multi-factor authentication for all users, and phishing-resistant methods for administrators
- Enforce Conditional Access policies that cover Microsoft 365 and Copilot
- Block legacy authentication
- Manage privileged roles with just-in-time access and regular reviews
- Review guest accounts and their access to Teams and SharePoint
Require compliant devices with Microsoft Intune
Copilot answers can contain sensitive content, so the device matters. Define compliance policies in Intune and require compliant or managed devices through Conditional Access. For personal devices, use app protection policies and limit downloads and copy-and-paste from unmanaged devices.
Govern Copilot Studio agents
Agents built in Copilot Studio can connect to data sources and act on behalf of users. Without rules, they spread quickly and inherit risk from their makers.
- Decide who may create and share agents, and in which environments
- Set data policies for connectors in the Power Platform admin center
- Review knowledge sources, authentication and the permissions agents use
- Keep an inventory of agents with owners and a review cycle
Train users and set clear rules
Users need to know what Copilot can see, how to check its output and what must not go into prompts. Training also supports the AI literacy measures required by Article 4 of the EU AI Act. In Germany, involve the works council early, as tools that can monitor employee behaviour or performance are subject to co-determination. Agree how users report incorrect or inappropriate output and who follows up. Start with a pilot group, measure issues and widen access in stages.
Fidempli assesses Copilot readiness and implements these controls in your tenant, and the Fidempli platform, launching in December 2026, will track Copilot readiness and agents over time.