All checklists
Before you turn on Copilot
Copilot doesn't grant new access. It just makes the access people already had far easier to use - which is exactly the problem. Everything staff can technically reach becomes searchable in plain English. Run this first.
Microsoft 36510 stepsUpdated 30 July 2026
Who this is for
Organisations being asked to roll out Copilot, and the person who'd be blamed for a leak.
Time needed: A few days of review, spread over a fortnight
01
Find the oversharing
The sensitive files nobody meant to leave open.
- Look for sites and folders shared with 'everyone' or the whole organisationUsually HR, finance and old project folders - and usually a surprise.
- Check anonymous sharing links across the tenantLinks that never expired are the most common finding.
- Review who can see salary, contract and board materialAsk the owner of each, not IT - IT can't judge sensitivity.
02
Tidy before you switch on
Less noise means better answers, too.
- Archive sites and Teams nobody has touched in a yearOld drafts and superseded policies are the worst thing for Copilot to quote back.
- Apply retention so genuinely obsolete content goesDeleting is better than hiding.
- Set sensitivity labels on the material that matters mostStart with a handful of labels people will actually use.
03
Roll out narrowly
A pilot tells you more than a policy does.
- Pick one team with clean, well-owned dataNot the whole organisation, and not the executive team first.
- Agree what people should and shouldn't put into itOne page of plain guidance beats a policy nobody reads.
- Ask the pilot group what surfaced that surprised themThis is your best oversharing report, and it's free.
- Review licence value after 60 days before buying moreUsage tells you who genuinely benefits.
Worth watching out for
- Copilot enforces existing permissions exactly - if the permissions are wrong, the answers will be too.
- The oversharing review is the work. The switch itself takes minutes.
- Buying licences for everyone before a pilot is the most common and most expensive mistake here.
Stuck on one of these steps?
Get an IT health check that reviews your support, security and Microsoft setup, then gives you a short, prioritised list of what's worth doing.