Data protection & insider risk
Keep client lists and sensitive files from leaving with the person who resigns.
Departing employees walk out with client lists. Forgotten "anyone with the link" shares sit live in SharePoint. Sensitive files sync to personal devices. You have no map of where sensitive data lives or who can reach it.
What the evidence looks like
Illustrative sample · constructed example
The same file should not be visible to both users.
Constructed permission pilot · project budget
Selected check
Can the unrelated pilot user still open the budget?
Constructed permission pilot · project budget
Defer pilot expansion. Results apply to the named sample checks below.
| Test case | Expected behavior | Sample review |
|---|---|---|
| Project member | Open the document through the intended membership. | Intended access retained |
| Unrelated pilot user | Prevent access outside the agreed project scope. | Oversharing observed |
| Sharing path | Identify the group or link granting the unwanted access. | Owner correction needed |
| Remaining content | Review other sites and links within the agreed inventory. | Separate checks required |
The sample tests the underlying permissions. It does not assume Copilot can bypass them.
- Evidence
- Both example users can access the file using their existing permissions.
- Decision
- Defer pilot expansion
- Next action
- Owner approves a narrower permission group and identifies other access paths.
Illustrative sample. Copilot follows existing permissions; this example does not show a permissions bypass.
The relevant scope
Start with a defined piece of work
The scope, the price, and how you will know it is finished are agreed in writing before anyone is given access. Review the engagement below for its deliverables, responsibilities and acceptance criteria.
The engagement
Microsoft 365 Security Hardening
The agreed security controls are implemented and enforced as one agreed scope: sign-in and access policy, administrator roles, risky application consent and account cleanup, each change tested, documented and run in an approved window. The work is scheduled hardening, not emergency incident response or same-day offboarding, and site-by-site file cleanup is scoped separately where the review finds it.
Not sure this is the one?
Describe what happened, in a paragraph. We’ll review your request and follow up about scope and next steps.
Discuss the scope and quoteWhat happens next
- 1Describe what happenedA few short fields: company size, environment, and what is going wrong.
- 2We’ll review your request and follow up about scope and next steps.The most direct next step, or a clear answer that AZ Innovations is not the right fit.
- 3A fixed-fee proposalNamed scope, price, and how you will know it is finished. No obligation.