Copilot for Your Staff · Lesson 2 of 7

What Copilot can see, and the oversharing check

20 minutes. Copilot doesn't open new doors. It walks through the ones you already left open.

---

Here's the sentence from Microsoft's own documentation that every owner should read twice: Copilot "only surfaces organizational data to which individual users have at least view permissions." Microsoft follows it with a warning: it's important to use the permission settings in Microsoft 365 to make sure the right people have access to the right content.

That's good news and a warning in one breath. The good news: Copilot can't show your dispatcher a file the dispatcher can't open. The warning: if the dispatcher *can* open it, Copilot can find it, summarize it and quote it, in seconds, in answer to an innocent question.

Nobody overshares on purpose. It happens like this.

Three years ago, Gina at Comfort Zone (our fictional company) shared the "Payroll 2023" spreadsheet with the bookkeeper using a link that worked for anyone in the company, because it was quicker. The link still works. Nobody remembers it. Before Copilot, finding that file meant knowing it existed and digging for it. With the paid license, a technician who asks Copilot "what do our installers earn?" might get an answer built from it.

Copilot didn't break anything. The file was already open to the whole company. Copilot just made it easy to find.

The usual suspects in a small business:

• Payroll, salaries and bonuses
• HR files: reviews, write-ups, medical notes, background checks
• Owner and partner documents: bank statements, loans, the sale of the business, a buyout plan
• Customer data you hold for a reason: card authorizations, tax forms, health information
• Passwords in a spreadsheet or Word document (this one deserves its own fix, with your IT partner)

Everyone with the paid license can have Copilot search across files they can open. Copilot Chat users mostly bring files to Copilot themselves, but Copilot Chat in Outlook can reach a limited set of related files, and permissions are the same either way. So the oversharing check is worth doing before anyone gets the paid license, and once a year after.

It's also worth doing because it's good housekeeping. The permissions that worry you about Copilot were already a risk. Copilot just raised the stakes.

Open the Oversharing Check template. In the first table, write down the ten files or folders you'd least like the whole company to read. Don't search yet. Just think. Payroll, HR, the owner's folder, anything with Social Security numbers.

Each person can check what they've shared from their own OneDrive.

• Open OneDrive on the web and sign in with your work account.
• Select Shared in the navigation. Microsoft's help page describes a view that shows files shared by you and files shared with you. Look for the part that shows what you shared (on some screens it's a tab marked Shared by me or By me).
• Scan the list. Anything on your Step 1 list? Anything you forgot you shared?

For each sensitive file you find:

• Select the file.
• Open the details for it. Microsoft's help describes this as Details in the upper right, or an Info icon in the top right corner, depending on where you are.
• Select Manage access. You'll see the people, and the links, that give access.

Read it slowly. A link might work for specific people, or for everyone in your company. Specific people is usually right for sensitive files.

You can also select a file and choose Share. If the file is already shared, a group appears at the bottom left of the Share window. Hover over it to see a summary of who has access.

If you own the file, Microsoft's help page lists your options under Manage access:

• Stop sharing removes sharing for everyone.
• On the Links tab, remove a link you don't want anymore.
• For a person with direct access, select their name and change or remove their access.

One detail that trips people up: Microsoft says you can't change a link from edit to view, or view to edit. You delete it and make a new one.

If you don't own the file, or the folder is a company SharePoint site, don't change it yourself. Write it on the template and send it to the owner, or to your IT partner.

Some of this is beyond one person's OneDrive. Microsoft gives administrators tools to find sites shared with the whole company, restrict which sites Copilot can search, and apply sensitivity labels that limit what Copilot can do with a file. You don't need to know how these work. You need to ask for them.

Copy this onto the template's last section and send it:

> We're rolling out Copilot. Before we give anyone the paid license, can you (1) find SharePoint sites and files shared with everyone in the company, (2) lock down payroll, HR and owner folders to the people who need them, and (3) tell us whether sensitivity labels make sense for our most private files?

• Share with specific people, not the whole company, unless it really is for everyone.
• When someone leaves a project, take them off the file.
• Passwords never live in a document. Use a password manager.
• If Copilot shows you something you shouldn't see, don't share it. Tell the owner or your IT partner the same day. It means the file is open to you, and probably others.

Fill in the Oversharing Check template: your ten sensitive files, what you found in Shared, what you fixed, and what you're sending to your IT partner. Ask every person who'll get the paid license to do Steps 2 to 4 for their own OneDrive.

Check it worked

• You listed at least five sensitive files or folders.
• You opened Manage access on each one you could find and know who can open it.
• Any file shared with the whole company that shouldn't be has been fixed or reported.
• Your IT partner has the three questions above, in writing.

---

Next: now that the doors are right, learn to ask Copilot for what you actually want.

→ Lesson 3: Prompts that work

Previous: Which Copilot do you have? · Next: Prompts that work