What Copilot can actually reach in Microsoft 365

The rule, stated once

Copilot can surface, summarise and cite anything the person asking could already open themselves. It adds no access. It removes the friction that used to hide access nobody had audited.

That distinction matters, because it means a Copilot rollout does not create a new security problem. It reveals one you already had, instantly, to every employee at once.

Where the exposure actually comes from

In practice, four patterns account for most of what surprises people.

1. Organisation-wide sharing links

A "people in your organisation" link is a transferable key. Creating one does not open the file to everyone — but everyone it reaches can open it, and once they have, Copilot can surface it to them. Links sent by email or in a Teams chat are redeemed automatically for up to a hundred recipients, links get forwarded, and unless an expiration policy is set they do not expire. Ten years of them accumulate, and nobody can say who already holds which.

2. Company-wide groups used as convenience

"Everyone except external users" started as a shortcut for one intranet page. It is now attached to sites nobody remembers granting. It is a common cause of a Copilot answer that contains something a colleague should not have seen.

3. Inherited permissions on old sites

A site created from a template in 2019 inherits an access model designed for a team that no longer exists. Nobody checks, because nothing surfaced it — until something did.

4. Personal OneDrive sprawl

People store things in OneDrive precisely because it feels private, then share a folder once to collaborate on one file. The folder stays shared.

Why native reporting does not answer this

SharePoint Advanced Management's data access governance reports flag broad sharing per site, and they are worth running. Sharing information is also retrievable per workload, in separate reports. What none of them answers easily is the question you actually need answered: for this person, what would Copilot be able to reach, and which of that is sensitive? And each answers it one tenant at a time.

That requires joining sharing data to the permission model to the sensitivity of what sits behind it — across SharePoint, OneDrive, Teams and the groups underpinning all three. It is a crawl, not a report.

What to do before you roll out

1. Inventory sharing across every workload, not one at a time.
2. Find the org-wide links and company-wide groups first. They reach the most people per item and are usually the easiest to fix.
3. Score by sensitivity, not count. Four hundred shared lunch menus do not matter. One shared HR folder does.
4. Fix the top of the list, then re-run. Sharing sprawl regenerates; a one-off clean-up decays within months.
5. Keep the evidence. The scan that proves you fixed it is the same artefact your auditor wants next quarter.

ShareCare runs this crawl across SharePoint, OneDrive, Teams and the groups behind them, scores it by sensitivity and reach, and keeps the history.

The uncomfortable part

Restricting Copilot tenant-wide — turning off search scope, delaying the rollout — treats the symptom and costs you the value you paid for. The exposure was there before Copilot and will outlast it. The links, the stale guests and the company-wide groups are a data-access problem that happens to have become visible.