Copilot can reach every file the person asking already has permission to open. In most tenants that is far more than anyone intended, and a pilot is usually how a firm finds out.
Most of the work is in your permissions, not in Copilot
Licenses are the easy part. A pilot goes well or badly depending on what your permissions already allow, and putting that right is measured in weeks.
66%
of AI users say it lets them spend more time on high-value work.
58%
say they are producing work they could not have produced a year ago.
130+ staff
Mal Warwick Donordigital: permissions work first, then Copilot across the whole firm.
40%
of all breached organizations had applied access controls to their AI models and data, which leaves the majority of them with none. The six steps below are those controls.
First two figures from Microsoft’s 2026 Work Trend Index, 20,000 knowledge workers surveyed February to April 2026. The access control figure is from IBM’s 2026 Cost of a Data Breach Report, 602 organizations studied March 2025 to February 2026.
Before you switch it on
Six conditions that have to be true in your tenant
Copilot does not create exposure. It surfaces exposure that was already sitting in your permissions. Open any row for what the work involves.
Find out who can actually reach what
Microsoft's Data Access Governance reports give you a site permissions baseline, a per-user view, and the sharing links people have created over time. The report itself runs in minutes. Reading it is the part that takes an afternoon.
Fix the everyone-except-external-users problem
There is a permission in SharePoint called Everyone Except External Users, and over the years it ends up on sites nobody meant to open to the whole company. There is a report dedicated to finding it, and clearing it is usually the single largest reduction in what Copilot can see.
Retire the sites nobody owns
Site ownership policies enforce a minimum number of owners, inactive site policies find the abandoned ones, and Microsoft 365 Archive moves dead content out of reach. When a site has no owner, there is nobody left to ask whether its permissions are still right.
Label what matters
Sensitivity labels through Purview, applied to the material that would hurt if it surfaced in the wrong summary, with DLP behind them. Labeling everything takes longer than it is worth, so we start with the categories that carry real consequence.
Restrict what Copilot is allowed to discover
Restricted Content Discovery keeps a high-risk site out of Copilot and organization-wide search without changing who can open it directly. Restricted Access Control limits a site to a named group. Together they let you roll out to willing teams while the rest waits.
Turn on logging before anyone prompts
Usage and audit logging, so that when someone asks how a figure reached a client deck, you can answer from the log. This is also what a client security exhibit or an insurance renewal will ask you to produce.
ChatGPT and Claude
A different problem, in the same firm
Copilot is a permissions problem inside your tenant. Everything else is a vendor terms problem outside it. Two different jobs, and one does not cover the other.
Data leaves your tenant, so the terms matter
Copilot works inside Microsoft 365, where your data stays under your tenant's controls. ChatGPT and Claude are outside it, so the question becomes what the vendor does with a prompt: whether it trains on input, where it is stored, how long it is kept, and who can see it. The answer often changes between the consumer tier and the business tier of the same product.
Most of it is the free tier of a tool you already approve
Someone signs in to the consumer version with a personal account, because that was quicker than asking. Approving the business tier and blocking the consumer one removes most of the problem.
Each earns its keep somewhere different
Copilot is strongest where the answer lives in your own files and email. ChatGPT and Claude are stronger on drafting, analysis and reasoning over material you paste in. We help you decide which belongs in which workflow, because your staff are already using both.
How the work runs
Four steps, three to six weeks
The order matters. Assess before you clean, clean before you pilot, pilot before you roll out.
Assess the tenant
We run the readiness and access governance reports and give you the numbers: how many sites are open wider than intended, where the sharing links point, and which sites have no owner.
Clean up in priority order
Widest exposure first, then abandoned sites, then labeling. Most of this is configuration you already own and already pay for.
Pilot with one team
A team with real work and a willing lead, with discovery restricted everywhere else. We watch the logs and the questions people ask, which usually differ from the plan.
Roll out with rules attached
Licenses assigned deliberately, training that covers the two or three situations people hit in week one, and the acceptable use policy in place before the wider group starts.
What it looks like in practice
Two clients, two very different starting points
Not every firm needs Copilot. Some need the automation that sits underneath it, built from tooling the licenses already include.
Mal Warwick Donordigital
Copilot and AI document search across a firm of more than 130 people, with the permissions work done first and the guardrails set before anyone else was switched on. The full version of what is on this page.
Preefer
A practice owner losing the front of every day to his inbox. We built automated triage and summarizing in Power Automate, using tooling already inside the Microsoft licenses he pays for. Mail arrives sorted and summarized. No new subscription and no new vendor.
Take it further
Copilot is one part of the picture
Cleaning up the tenant makes Copilot safe to switch on. Written rules keep it that way, and the logs and reports it produces answer questions your carrier and your clients are already asking.
Do we have to fix SharePoint before we turn Copilot on?
In almost every tenant, yes, and the reason is worth getting straight before you brief anyone. Copilot has no permissions of its own. It reaches exactly what the person asking could already have opened by searching, so nothing new is exposed; what changes is that finding it stops taking effort. The salary file that was technically reachable and practically buried becomes a one sentence question. That is why the pilots that go badly are the ones that skipped the permissions work, and why we would rather spend three weeks on your SharePoint than explain to your leadership team why the pay review turned up in a summary.
What does Copilot actually have access to?
Whatever the individual user could already find. That includes files shared with Everyone Except External Users, sites they were added to years ago and forgot, and documents reachable through an old sharing link. It does not give anyone access they did not already have.
Do we need to buy extra licenses for the cleanup work?
Usually not. Assigning a single Microsoft Copilot license to one user switches on SharePoint Advanced Management across the whole tenant, which is where the access governance reports and the discovery controls live. A few specific features still need the standalone add-on, and we will tell you if you are in that case.
Will Copilot train on our data?
No. Microsoft 365 Copilot does not use your tenant content to train the underlying models. What a consumer AI tool does with a prompt is a separate question, and it is the reason your acceptable use policy needs a named tool list.
How long does readiness take?
Three to six weeks for most firms of twenty to two hundred people. The reports run quickly. The slow part is deciding what to do about a site with four thousand files and no owner.
Do you support ChatGPT and Claude, or only Copilot?
All three, and in practice most firms end up with more than one whether they planned to or not. The three need different work from us. Copilot is a tenant problem: what it can see is decided by permissions you already own, so the effort goes into SharePoint before anything is switched on. ChatGPT and Claude are contract problems: which plan you are on decides whether your prompts train a model, and the consumer tiers are not the same deal as the business ones. The failure we see most often is a firm that bought one of the three and told nobody the rules, so staff quietly use a personal account for work documents because it is easier than asking.
Thinking about Copilot?
Fifteen minutes is usually enough to tell you what your tenant would show.
