Copilot will surface every file you forgot to lock down

Copilot respects the access a person already has. That sounds reassuring until you remember how many shared folders, old Teams sites, and inherited permissions have accumulated over the years.

Before rollout, inventory broad sharing links and sensitive sites, identify owners, and remove access that no longer has a business reason. Treat this as a data-governance project, not just a licensing project.

Then pilot Copilot with a small group and test realistic prompts against real permissions. The goal is not to make information harder to find; it is to make sure the right information is easy for the right people.