Is it safe to turn on Copilot? What to check first

Short answer: yes, once you know what each person can access. Microsoft 365 Copilot only shows people content they already have permission to open. It doesn’t break your security. The risk is that, after years of quick shares, “everyone” links and old Teams, most staff can open far more than anyone realises. Copilot makes that content easy to find. So check access first, fix the worst of it, then switch it on.

Why Copilot changes the risk

Before Copilot, an overshared file was mostly hidden by obscurity. Someone would have to know it existed and go looking for it.

Copilot removes the looking. Ask it “what are we paying our senior staff?” or “summarise the restructure plans” and it will search everything that person can open, then answer in seconds. If a salary spreadsheet sits in a site shared with the whole organisation, Copilot can surface it.

AI doesn’t create the problem. It surfaces it.

What to check before you switch it on

For a growing organisation of 50 to 150 staff, these five checks cover most of the risk.

1. “Everyone” and organisation-wide sharing. Look for sites, libraries and files shared with “Everyone except external users” or with organisation-wide links. These are the most common source of oversharing.

2. Sensitive content in the wrong place. HR, payroll, board papers, client contracts and health information. Find where they actually live, not where they’re meant to live, and who can open them.

3. Old sites and Teams nobody owns. Projects finish and people leave, but their sites stay, often with broad access. Every site should have a named owner, or be archived.

4. Guest and external access. Check which guests still have access and whether they still need it.

5. Licences. You don’t need Copilot for everyone on day one. Decide which roles get the most value and start there, after the clean-up. Here’s what Copilot includes and costs for Australian businesses.

What to fix first

You don’t need a perfect tenant before you start. Fix in order of risk:

1. Remove organisation-wide access from anything sensitive.
2. Give every active site an owner; archive the rest.
3. Tighten how new access is granted, so the problem doesn’t grow back.
4. Then roll out Copilot to a pilot group with a short, practical usage policy.

Microsoft 365 has built-in tools that help, such as sensitivity labels and SharePoint access reviews. Most organisations already pay for more of these than they use.

Does Copilot respect SharePoint permissions?

Yes. Copilot uses the same permissions as SharePoint, OneDrive and Teams. If a person can’t open a file, Copilot won’t use it in their answers. That’s why the permissions check matters: Copilot is only as safe as your access settings.

How long does it take to get ready?

For most organisations of 50 to 150 staff, a readiness check takes a few weeks and the priority clean-up a few more. When we checked Lincoln Institute’s 36 SharePoint sites before their Copilot rollout, nothing was overshared and access was rated green, but 18 legacy sites were flagged to archive so Copilot wouldn’t draw on outdated content.

Where to start

Applecart’s Copilot readiness check is a fixed-price look at your sharing, permissions, storage, site sprawl and licences. You get a plain-English report: what’s fine, what’s a risk, and what to fix first. We’re based in Brisbane and work alongside your IT team.

Find out about the readiness check