Last updated:
Which content does Microsoft 365 Copilot see?
According to Microsoft, Microsoft 365 Copilot only uses organizational data that the user has at least view permission to. Copilot grants no new permissions, but it makes widely shared content much easier to find.
Sharing links count too. A file shared with specific people becomes reachable for them in search and in Copilot.
Checklist before you turn on Copilot
- Find overshared sites. The data access governance reports in SharePoint Advanced Management list sharing links and sites with broad permissions.
- Narrow "Everyone except external users" access. Sharing with this group opens content to every current and future employee. Public sites also show their content to everyone in the organization.
- Have site owners review access. Site access review sends the sites in the reports to their owners, so the people who know the permissions best fix them. It covers SharePoint sites, not OneDrive.
- Limit discovery while reviews run. Restricted Content Discovery keeps the sites you choose out of organization-wide search and Copilot. It doesn't change permissions and is designed as a temporary control.
- Lock down sensitive sites. With Restricted Access Control, only the group you specify can enter a site. People outside that group lose access, even with earlier permissions or a shared link.
- Label sensitive content. For Microsoft Purview sensitivity labels that apply encryption, Copilot only returns the content to users with the VIEW and EXTRACT usage rights.
- Limit "Anyone" links. If you allow Anyone links, set them to expire or allow view only.
- Turn Copilot on for a pilot group first. Once the riskiest areas are fixed, watch usage in a small group, then widen it.
Which tool does what?
SharePoint Advanced Management is included with Microsoft 365 Copilot licenses. It's enough that at least one user in your organization has a Copilot license.
| Tool | What it does | When |
|---|---|---|
| Data access governance reports | Finds sites with potentially overshared or sensitive content | First |
| Site access review | Has site owners review the sites in the reports | After the reports |
| Restricted Content Discovery | Hides selected sites from search and Copilot; doesn't change permissions | While reviews run |
| Restricted Access Control | Lets only a group you specify into a site | For sensitive sites |
| Microsoft Purview sensitivity labels | Opens encrypted content only to authorized users | For sensitive files |