Four weeks ago, on March 16, Microsoft put a name and a demo reel to what had been rumor for months: Microsoft 365 Copilot. We watched the same video every other Microsoft partner watched, and we had the same reaction our clients are now calling us about — not "when do we get it," but "what exactly can it read." That question is a data governance question, and the honest answer for most estates runs through Purview sensitivity labels, DLP policies, and SharePoint permissions that nobody has audited since the scramble onto Microsoft 365 during the pandemic. Copilot's reasoning sits on top of the Microsoft Graph and what Microsoft is calling its Semantic Index, plus a large language model doing the drafting. None of that machinery cares whether your site permissions have been sane since 2019. It reads whatever the signed-in user is already allowed to read.
We opened a readiness engagement this month for a regional insurer running Microsoft 365 E5 across a few thousand seats, and the kickoff question from their CISO was blunt: if we turned this on today, what would it show somebody it should not. Nobody in the room could answer with confidence — not the SharePoint admin, not the security analyst running Purview DLP alerts, not us until we pulled the actual permission data. That gap is the real subject of this note. Copilot is still months from general availability and most of our clients cannot buy a seat yet. The governance work does not care about that timeline; it was already overdue before anyone said the word Copilot out loud.
So this is not really a Copilot post. It is a data governance post that Copilot's announcement made impossible to keep deferring. The mechanics are Purview: sensitivity labels, data loss prevention, and the SharePoint and OneDrive permission model sitting underneath both. Get those three right and Copilot, Azure OpenAI Service, or whatever Microsoft announces next quarter is a licensing decision. Get them wrong and every new interface just makes the oversharing easier for someone to find — including, eventually, an auditor.
An assistant that reads exactly what your ACLs allow
What Microsoft demonstrated on March 16 is a chat interface, built into Word, Excel, Outlook, and Teams, that answers questions by retrieving content the signed-in user can already access and having a language model summarize or draft from it. It does not have its own view of your tenant. It inherits the view every user already has, and most tenants have never looked hard at what that view actually includes.
We have run permission reviews for years without anyone in the room getting nervous about them, because the failure mode used to be slow. A former contractor's guest account sitting in a site's member group for three years was embarrassing if discovered, but discovery was rare, and the blast radius was whatever that one person went looking for. An assistant that can summarize every quarterly forecast, every HR investigation note, and every acquisition memo a user's account happens to touch changes the arithmetic. The access was already a mistake. The assistant just makes the mistake legible, on demand, in a paragraph anyone can screenshot.
This is also where the GPT-4 headlines from a couple of weeks earlier matter less than people think. Whether the model behind Copilot is GPT-3.5 or GPT-4 changes how good the summary reads; it does not change what documents were in scope to summarize. We keep steering client conversations away from "how smart is the model" and back to "what can it see" — the question a security team can actually act on before summer.
Sensitivity labels have to earn a paycheck, not decorate a slide
Most tenants we walk into already have Purview sensitivity labels published, because someone stood them up during a compliance push two or three years ago. Far fewer have labels that do anything. A label with no encryption, no content marking, and no downstream DLP condition attached to it is a folder color. It looks organized and changes nothing about who can open the file or what happens when it leaves the tenant.
Our standing advice going into any Copilot-adjacent readiness project: cut the label taxonomy down before you extend it. Five working labels beat fourteen aspirational ones. We typically land clients on something close to Public, Internal, Confidential, and Highly Confidential (the last one carrying encryption and a "do not forward" content mark by default), plus one regulator-specific label when the client actually has a regulator to please. Anything past five and the label picker becomes a coin flip for end users.
The other piece people skip is auto-labeling. A taxonomy that depends on every employee correctly tagging every document by hand will be wrong within a quarter. Purview's auto-labeling policies, built on sensitive information types and trainable classifiers, can apply a baseline label to content matching patterns like national ID numbers, account numbers, or a client's own defined pattern for case files, without waiting on user judgment. We turn these on in simulation mode first, always, because a classifier tuned on someone else's data will happily mislabel a spreadsheet full of part numbers as a financial record.
# Spot-check auto-labeling simulation results before enforcing
Connect-IPPSSession -UserPrincipalName admin@contoso.com
Get-Label | Select-Object Name, Priority, ContentType
Get-AutoSensitivityLabelPolicy -Identity "Finance Auto-Label" |
Select-Object Name, Mode, Applications, Workload
Simulation mode is not a formality. Run it for at least two full weeks against a representative population before anyone talks about enforcement, and read the false positives yourself.
DLP was written for outbound mail, and that is not where the risk sits anymore
Ask most security teams to describe their data loss prevention posture and they will describe Exchange transport rules and maybe a SharePoint sharing policy. That coverage made sense in an era when the leak vector was an email attachment. It is a poor match for a tenant where sensitive content can now move through a Teams chat message, a OneDrive share link, or — soon — a Copilot response that quotes a paragraph from a document nobody remembers granting the requester access to.
Purview DLP already covers more surface than most tenants have turned on: Exchange Online, SharePoint and OneDrive, Teams chat and channel messages, and, through the Windows endpoint client, what happens on a device itself — clipboard actions, uploads to unsanctioned browser destinations, and removable media. We push clients to get DLP policies across that fuller surface into report-only mode now, so tuning happens against real traffic instead of a go-live weekend.
The specific new wrinkle worth naming: Azure OpenAI Service keeps prompts and completions inside the customer's own tenant boundary and does not use that content to train shared models, which is exactly why we have been steering regulated clients toward it over the public ChatGPT interface since January. Copilot, once it ships, inherits that same tenant-boundary posture. That is a real advantage over a browser tab pointed at a consumer chatbot. It is not a substitute for DLP coverage, though: "stayed inside Microsoft's cloud" and "stayed with only the people who should see it" are different guarantees, and regulators only care about the second one.
The site nobody has owned since the project that created it ended
Every tenant we have reviewed this quarter has the same site somewhere: created for a project that ended years ago, permission inheritance broken along the way, and a sharing link set to "anyone with the link" from back before tenant-level link restrictions were the default. Add a distribution group granted access for convenience during a reorg, a handful of guest accounts from a vendor relationship that ended without an offboarding step, and a site owner field pointing at someone who left the company — and you have a library an assistant can summarize on request that nobody currently employed would approve if asked directly.
"Everyone except external users" is the permission we find doing the most damage, because it reads as a safe default and behaves like a broad grant. It was often applied years ago to solve a one-time problem — get a new-hire cohort into an onboarding site quickly — and never revisited once the problem was solved.
# Enumerate sites still granting the everyone-except-external claim
Connect-SPOService -Url https://contoso-admin.sharepoint.com
Get-SPOSite -Limit All -Detailed |
Where-Object { $_.SharingCapability -ne "Disabled" } |
Select-Object Url, SharingCapability, StorageUsageCurrent |
Sort-Object StorageUsageCurrent -Descending
That query only gets you the sharing-capability layer; you still have to walk the sites it surfaces and check the actual permission groups, ideally with a business owner who can say whether the access still makes sense. There is no shortcut that skips a human decision here. There is only a shorter list of sites to make that human look at.
A sequence that starts before anyone requests a pilot seat
Clients keep asking us to skip straight to "turn on Copilot for twenty friendly users and see what happens." We resist it every time: a friendly pilot cohort will not surface the one oversharing incident that would embarrass the company; that discovery happens later, in production, in front of someone unfriendly. The sequence we actually run puts the unglamorous inventory work first.
| Phase | Focus | Exit signal |
|---|---|---|
| Map | Inventory sites, libraries, and Teams with sharing set broader than needed | Every top-storage site has a named business owner |
| Label | Cut the taxonomy to five or fewer labels; enable auto-labeling in simulation | Two weeks of simulation reviewed by a human, not just exported |
| Contain | DLP policies for Exchange, SharePoint, OneDrive, and Teams chat in report-only | Report-only alert volume triaged, not just collected |
| Remediate | Fix the "everyone except external users" and stale-link sites the map surfaced | Oversharing count trending down week over week |
| Pilot | Small cohort, explicit success and rollback criteria, dated review | Metrics reviewed against a threshold agreed before the pilot started |
Treat that table as a gate sequence, not a checklist to run in parallel. A client who wants to skip Map and go straight to Pilot is asking us to find their oversharing problem live, in front of whichever executive happens to ask the assistant the wrong question first. We would rather find it in April, in a spreadsheet, where fixing it does not require an apology.
If you're facing this
If a Copilot pitch, an Azure OpenAI project, or just a nervous CISO question has put data governance back on your agenda this quarter, do the inventory before you do the pilot. Sensitivity labels and DLP policies that only exist on a compliance slide will not survive contact with an assistant that reads everything a user's account can already reach. Tell us what your estate looks like today and where the pressure is coming from, and we will help you build the sequence that gets you to a defensible pilot instead of a defensible apology.