You Bought Copilot. You Never Finished Securing Your Data.
Somebody in IT flips a switch, hands out licenses, and calls it an AI rollout. The project plan has a security section. The security section is a list of admin settings: enable this, disable that, turn on the toggle that says "Microsoft 365 Copilot." Nobody on that plan opened a single SharePoint site to check who has access to it.
That's most of the AI readiness conversations we've sat in this year.
The tool gets configured in an afternoon. The data underneath it, the thing Copilot reads, summarizes, and hands back to whoever asks, doesn't get touched. It's been sitting there for a decade, overshared, unlabeled, half of it stale, and nobody thought to ask what happens when you point a retrieval engine at it until Copilot went and asked for them, out loud, in front of the whole company.
The switch is not the work
Licensing Copilot doesn't tell you what Copilot can see. Your permissions do, and for most tenants, nobody's looked at those closely enough to answer that question honestly.
Microsoft gives you a way to find out, and almost nobody runs it before go-live. Data Security Posture Management ships a default oversharing assessment that scans your top 100 SharePoint sites by usage every week and flags sharing links open to anyone, external guests, and content sitting without a sensitivity label. Run a custom assessment against a broader scope and you get item-level detail: which specific files sit exposed, who owns them, and why. That's not a "nice-to-have" dashboard. That's the inventory you were supposed to have before you licensed anything.
The tool doesn't create your oversharing problem, it just gives the one already sitting in your tenant a much wider audience and a much better set of eyes.
Run the default assessment, then a custom one against the sites that matter most. Wait a few days for the first results, and what comes back isn't a surprise to anyone who's done this work before: sites with "anyone with the link" sharing still active from a 2019 vendor project, a folder shared with everyone in the company that should've died at the last reorg, terminated employees still listed as site members. The custom run added the item-level detail underneath it: folders full of unlabeled contracts sitting one Copilot prompt away from a curious new hire. None of that was new. Copilot just made it findable in one search instead of forty.
If you're going to remediate before rollout, remediate in this order: restrict discovery on the sites you can't fix in time, using SharePoint Advanced Management's Restricted Content Discovery to keep them out of Copilot's discovery and search entirely without touching who already has access; fix the permission and sharing link problems on everything else; apply the sensitivity labels that should have been there already. Skipping straight to "restrict everything" gets you a Copilot nobody can use and a security section you can still put in the project plan, which is the whole appeal.
Mandatory Brain Break
Yellow-bellied marmot, Marmota flaviventris
This one had settled into the gravel a few feet off my truck's tailgate and wasn't in any hurry to move. Yellow-bellied marmots spend most of their lives asleep, up to eight months some years, the whole colony down in a burrow waiting out the cold at altitude. Even parked in the open like this, it never fully stopped watching.
Back to systems that don't get eight months off.
What the label actually controls
What a label controls depends on which tool you're worried about, and that distinction usually gets flattened into "did we turn on labeling," yes or no. A label without configured protections is a classification tag, a fact recorded about the document. Turn on encryption for that label, and it becomes something else: an access control enforced by the Rights Management service, decrypting the file only for the people the label authorizes, in an application built to ask Rights Management for the key.
Drag a file locked with a "Restricted\Employee" label into Claude or ChatGPT and neither one opens it, because neither one has any way to request that key. No DLP policy required. The encryption does the work by itself, whether or not anyone remembered to write a rule.
Inside Microsoft 365 Copilot, the same file behaves differently, because Copilot is already running inside your tenant as the signed-in user. If that user holds the rights the label grants, Copilot decrypts the file the same way Word would and grounds a response on it like anything else, unless a DLP policy specifically tells it not to. The label's encryption keeps out everyone Copilot doesn't already trust. It doesn't keep out Copilot.
Label without a matching DLP rule: Copilot reads the file, summarizes it, and hands it to whoever asked, label and all. Label with a DLP rule configured to restrict Copilot processing: the item gets excluded from the response and still shows up in the citations, so the user sees a reference to a document they can't get content from. Those are two completely different security postures wearing the same visible label, and if you only checked that labels exist, you checked the wrong thing.
In Word, Excel, and PowerPoint, Copilot checks that block-processing policy at file open, not continuously, so labeling a document while someone already has it open doesn't take effect until they close it and open it again. Push a new DLP policy and budget up to four hours before it reaches the Copilot experience. Test your control on a Tuesday afternoon and declare it broken because nothing happened in the first ten minutes, and you've drawn the wrong conclusion from a documented delay, not a failure.
We've also watched a correctly labeled, correctly encrypted file get rejected by Copilot the moment someone dragged it straight into a chat window, the same user who could open that same file in Word without a prompt. Direct chat upload isn't a supported decryption path. SharePoint and OneDrive with labels enabled are, and so is opening the file in the desktop app first. Same rights, same label, different door, different answer.
The bigger gap: DLP cannot read the contents of a file a user drags directly into a Copilot prompt. It evaluates the text someone types. A file attached to that prompt goes in unscanned. You can have a mature labeling scheme, airtight retrieval-time DLP, and a security team that's proud of the coverage, and someone still uploads a spreadsheet full of unreleased financials straight into a chat window and nothing stops them, because that path was never covered in the first place.
That's the difference between the policy working and the experience being what you intended. The policy did exactly what it was built to do. Nobody built it to lock that side door.
Where this gets hard
None of the tooling above is a finished project once you turn it on. The default oversharing assessment covers your top 100 sites by usage, which means the site nobody's opened in two years but that still has forty external guests on it might not surface until you go looking for it specifically. Custom assessments scale further, up to two hundred thousand items per location, but accuracy degrades once a single location passes around a hundred thousand files, and OneDrive doesn't support item-level scanning at all right now. A custom assessment result expires in thirty days. Nobody schedules the renewal, and six months later the "current" report is a snapshot of a tenant that's changed twice over since.
Stop treating the work as a one-time project with a completion date. Governance domains and data products in Unified Catalog need an actual owner checking them, the same way a sensitivity labeling scheme needs someone updating it as the business changes. Standing up the assessment gets you visibility. It doesn't get you a person whose job is to act on what the assessment finds, and without that person, the report just gets more accurate about a problem nobody's fixing.
Every vendor pitching a one-click AI security button is selling something that doesn't exist yet. What exists is a set of tools that tell you the truth about your data if you point them correctly, run them on a schedule, and staff the follow-through. Most organizations bought the license and stopped at "point them correctly."
Do the inventory before you flip the switch, not after someone asks Copilot the wrong question and gets an answer they weren't supposed to have.
Inventory first.
Comments