Copilot and your files: the check to run before you turn it on

On July 1, Microsoft changed what a small-business Microsoft 365 subscription is. The standard plans now come with Copilot built in — Microsoft calls the new bundles "the new standard for small business," and its pricing page currently lists Business Standard with Copilot from $22 per user per month at a promotional rate.

The pitch is an assistant that can find, summarize, and answer questions from your company's files, email, and chats. The catch hides in one reassuring sentence from Microsoft's announcement: "Copilot only sees what it is allowed to see."

That's true. The question is what your people are allowed to see — and in most small businesses, the honest answer is: far more than anyone intended.

"Allowed to see" is doing a lot of work

Copilot doesn't hack anything. Microsoft's setup guidance says it retrieves data based on "existing permissions, sharing settings, and policies."

Here's the uncomfortable part, from that same Microsoft page: "By default, SharePoint sets sharing settings to the most permissive option." SharePoint is the file system underneath Microsoft 365 — where your Teams files and shared folders actually live.

So the permissions Copilot will faithfully respect are usually five years of accumulated shortcuts:

• The folder shared with "everyone in the company" in 2021 because permissions were annoying that week.
• The offer letter saved to the general HR folder instead of a restricted one.
• The "anyone with the link can view" link that still works, created for a vendor who's long gone.
• The guest account for a contractor who finished the job two years ago.

None of this mattered much before, because finding those files required knowing where to look. Nobody browses 40,000 files out of curiosity. Copilot's entire job is to browse the 40,000 files. Ask it "what do people get paid here?" and if a payroll export sits in an over-shared folder, back comes an accurate, cheerful summary. That's not a breach — every one of those files was already visible. A search box just made the visibility real.

The check to run before you switch it on

You don't need to become a permissions expert. Three moves, in order of payoff:

1. Play attacker with your own crown jewels (ten minutes). Pick the three files that would hurt most if the whole company read them — payroll, financials, an HR matter. Open each in OneDrive or SharePoint, click Manage access, and read the list. Fix what you find.
2. Ask your IT provider for the sharing reports — by name (one email). Say: "Please run the data access governance reports in the SharePoint admin center — the sharing-links report and the 'everyone except external users' report — and send me the top ten." Those reports exist for exactly this; Microsoft recommends them as Copilot preparation. Then delete the "anyone" links nobody can justify.
3. Evict stale guests (fifteen minutes). In the Microsoft 365 admin center, review your guest users — outside people invited into your files. If they don't work with you anymore, remove them.

And if one folder genuinely can't be untangled this month, ask your IT provider about Restricted Content Discovery — a setting that keeps a site out of Copilot and company-wide search without changing who can open it. It's a tarp, not a repair, but it buys time.

The honest good news

Bundled Copilot is probably a good deal for a small team, and the security model is sound: it shows each person their own view of the company, nothing more. Just be clear about what that means. Turning on Copilot doesn't open any new doors — it hands everyone a flashlight for the doors already open. Check the doors first.

If you'd rather not do the checking by hand, this is exactly what a read-only scan is for: Tenant Strike grades your Microsoft 365 setup A–F in about five minutes — over-shared links, stale guests, and the settings above included — and shows the exact fix for each.