# Microsoft 365 Copilot readiness: the permissions checklist to run first > Before you switch on Microsoft 365 Copilot, fix the oversharing it will surface. A practical permissions and governance checklist for a safe rollout. Source: https://olyteck.com/blog/microsoft-365-copilot-readiness-permissions-checklist Published: 2026-06-26 | Updated: 2026-07-28 Author: Oleg Garasym, Olyteck (France, EU-hosted) Product: Olyteck Cyber Topics: copilot, microsoft 365, permissions, governance, oversharing License: free to quote with attribution to Olyteck and a link to the source URL. --- Microsoft 365 Copilot does not get its own view of your data. It sees exactly what the signed-in user can already see, and then makes that content trivially easy to find and summarise. That is the whole readiness problem in one sentence: Copilot does not create oversharing, it *surfaces* the oversharing you already have. A file a user could technically open three folders deep, but never would have, is now one prompt away. So the work before a rollout is not about Copilot settings. It is about cleaning up the permissions and sharing posture underneath it. ## Why Copilot turns quiet exposure into loud exposure For years, most accidental access was protected by obscurity. Nobody navigated to the HR site they weren't supposed to reach, so the broken permission never mattered. Copilot removes the obscurity. Ask it "what is our parental leave policy" or "summarise the latest acquisition discussion" and it will pull from anything the user can read, including the site that was shared too widely in 2023. The three configurations that cause the most surprises: - **"Everyone except external users"** applied at a site or library level, which effectively means every employee. - **"Anyone with the link"** anonymous shares that never expired. - **Stale guest accounts** that still carry access to sites long after a project ended. ## The readiness checklist Run these before you assign a single Copilot license. 1. **Find broad-access sites.** List every SharePoint site shared with "Everyone", "Everyone except external users", or large security groups. These are the highest-risk surfaces for Copilot. 2. **Inventory anonymous links.** Anonymous "Anyone" links bypass identity entirely. You want a current list, sorted by sensitivity and age, and the worst ones revoked. 3. **Review external guests.** Remove guests who no longer need access, especially on finance, HR, legal and customer-data sites. 4. **Check ownerless and public Teams.** Ownerless Teams have no one accountable for their content, and Public Teams are readable by the whole organisation. Both feed Copilot. 5. **Confirm sensitivity labels where they matter.** Labels that block or restrict content give you a control that travels with the file, not just with the site. 6. **Map who gets Copilot first.** A phased rollout to a clean, well-scoped pilot group beats a tenant-wide switch into unknown permissions. ## Triage by blast radius, not by count A readiness scan can return thousands of findings, and that number is paralysing. Sort by impact instead of trying to fix everything: - A shared *site* or *library* is far worse than a single overshared file. - Finance, HR, legal and customer data come first. - Broad access on a site that Copilot users actually touch matters more than a dormant archive. > Copilot readiness is a permissions project wearing an AI deadline. The deadline is useful, because > it finally makes the cleanup urgent, but the fix is ordinary access hygiene done in the right order. ## How to get the picture without a scripting project You can assemble this manually. SharePoint admin reports give a coarse, site-level view; Microsoft Graph can enumerate permissions per item if you are prepared to write, run and re-run the scripts across every site, OneDrive and Teams library. For most teams that is a project in itself, and it goes stale the day after you run it. The faster route is a read-only scanner that walks the tenant through Graph and reports overexposed sites, anonymous links, stale guests and Copilot-license coverage in one place, without exporting any file contents. Olyteck Cyber does exactly this, with a Copilot-readiness view that ranks what to fix before rollout. The point either way is the same: you cannot govern what you cannot see. ## A practical baseline - A current list of broad-access sites, reviewed and tightened - Anonymous links inventoried, the sensitive ones revoked - Stale guests removed from high-value sites - Ownerless Teams assigned an owner, Public Teams justified or made Private - Sensitivity labels enforced on the data that would hurt most if summarised - A phased Copilot rollout, starting with a clean pilot group - A monthly re-scan, because sharing posture drifts the moment people collaborate Copilot is a genuine productivity gain, and the readiness work is not a reason to delay it. It is the thing that lets you say yes with confidence instead of finding out, in a meeting, that the assistant just quoted a document nobody meant to share. ## FAQ ### Can Copilot see files a user is not supposed to see? Copilot has no separate view of your data. It returns content the signed-in user can already open, which includes anything reachable through a site shared too widely or an anonymous link that never expired. It does not break permissions, but it makes quietly overshared content easy to find and summarise from a single prompt. ### Does turning on Copilot change any permissions in Microsoft 365? No. Copilot does not grant, remove or alter access, and it does not create oversharing. It inherits the permissions and sharing posture that already exist across SharePoint, OneDrive and Teams, so any exposure it reveals was there before the rollout. ### How long does Copilot readiness work take? There is no fixed duration, because it depends on how many sites, libraries and guests your tenant carries and how much broad access has built up. Assembling the picture manually from SharePoint admin reports and Microsoft Graph scripts is a project in itself, and it goes stale the day after you run it. A read-only scan gets you the same view much faster, and the fixes can then run alongside a phased rollout rather than blocking it. ### Where should we start if a readiness scan returns thousands of findings? Sort by blast radius instead of by count. A site or library shared broadly is far worse than a single overshared file, and finance, HR, legal and customer data come first. Broad access on a site your Copilot users actually touch matters more than a dormant archive nobody opens.