Module 4 of StartCloud's Copilot Essentials learning pathway, in six short units with a knowledge check: why Copilot makes oversharing visible, how its permissions model works, how to audit SharePoint and OneDrive sharing, the temporary brakes versus the real permissions fix, and a step-by-step pre-rollout checklist.
Getting Your Data Ready for Copilot
The day Copilot finds the payroll spreadsheet
Here is a story we hear a version of every few months. A business switches on Copilot, and within the first week someone asks it something harmless like "what do we pay our project managers?" Copilot, being helpful, finds a salary spreadsheet sitting in an old SharePoint site from 2019 and summarises it beautifully.
Nobody hacked anything. Copilot did not break a single rule. That spreadsheet had been sitting in a site shared with the whole organisation for six years, and the only thing protecting it was that nobody knew it was there. Copilot only surfaces content a person already has permission to open. The trouble is that in most organisations, "already has permission" covers a lot more than anyone realises.
Before Copilot, that gap did not matter much. Finding an overshared file meant clicking through years of site rubble, so in practice nobody ever did. Copilot removes the digging. Ask a question, and anything your permissions technically allow becomes one polite answer away.
For years, "nobody will ever find it" quietly did the work of real security. That was the spare key under the doormat: fine while nobody looked. Copilot is the friendly new neighbour who checks every doormat the moment someone asks where the key is. The fix is not to be cross with the neighbour. It is to stop keeping keys under doormats.
This module is about closing that gap before rollout rather than after an awkward all-staff email. The good news: the work is well understood, Microsoft gives you purpose-built tools for it, and most of it makes your environment safer whether or not you ever buy a Copilot licence.