Copilot permission cleanup and pilot

Fix oversharing before you widen the AI rollout.

Oversharing is corrected across the agreed areas and the guardrails are set. A pilot group then runs real work through Copilot. The go, wait or expand decision comes from what that pilot actually showed.

What you get: Agreed sharing and permission corrections, pilot guardrails and a record of what Copilot can expose.
How it starts: A free scope call. The price is fixed in writing before anyone is given access.
When it is done: Selected access tests pass with real pilot accounts; the owner records a go, defer or expand decision and the exceptions that remain.

Price the Copilot cleanup Review scope & terms

Illustrative sample · constructed example

The same file should not be visible to both users.

Constructed permission pilot · project budget

Selected check

Can the unrelated pilot user still open the budget?

Document access / permission testsIllustrative

Constructed permission pilot · project budget

PILOT CONTEXTProject memberNeeds the budget for their agreed role.

RELATED CONTROL / ACTORUnrelated userHas unintended access through a broad sharing group.

SEPARATE CHECKFile permissionCorrect the sharing route, then repeat both access tests.

Defer pilot expansion. Results apply to the named sample checks below.

Document access / permission tests: constructed inspection record
Test case	Expected behavior	Sample review
Project member	Open the document through the intended membership.	Intended access retained
Unrelated pilot user	Prevent access outside the agreed project scope.	Oversharing observed
Sharing path	Identify the group or link granting the unwanted access.	Owner correction needed
Remaining content	Review other sites and links within the agreed inventory.	Separate checks required

The sample tests the underlying permissions. It does not assume Copilot can bypass them.

Evidence: Both example users can access the file using their existing permissions.
Decision: Defer pilot expansion
Next action: Owner approves a narrower permission group and identifies other access paths.

Illustrative sample. Copilot follows existing permissions; this example does not show a permissions bypass.

Open the complete illustrative document to inspect its fields and print a copy.

Open the sample document

Why now

The work starts here.

Copilot licenses are bought, or the spend is being weighed up, and access to SharePoint and OneDrive is wider than anyone intended.

Scope at a glance

Bounded location list, agreed up front
Purview labelling only where licensed
Client owns the pilot users

If nobody acts

What waiting costs

Copilot works inside the permissions that already exist. An over-broad share stays exactly as wide as it was. Content spread across many of those places can be pulled into a single answer for anyone that share already covers.
Where a payroll or HR file was saved somewhere shared with the whole company, any account in the business can already open it. Nothing in the tenant brings that to anyone’s attention until somebody goes looking.
A Copilot subscription runs from the day it starts. Sharing you unwind after the purchase is unwound on time you are already paying for.
Microsoft’s own guidance says to fix oversharing before a wide rollout, not after. Switch Copilot on first and the corrections happen while people are already using it, so an access change can land on work somebody is in the middle of.

Check your own environment

Sounds like you?

You cannot say, for one named employee, which files they can already open
Links that let anyone in the company open a document were created years ago and never reviewed
Guests from finished projects still appear in Teams or on sites
A payroll, HR or contract file lives somewhere you are not certain is restricted

Save yourself the call

Not for you if

Sharing has been reviewed recently and you can already say what one named person can open
Copilot is live, guardrails are set, and nobody has been surprised by what it returned
The only open question is what Copilot costs, which is a licensing conversation and not this

The work

What is different when we hand over

If the spend is still a question, the funding case comes first. Which teams would use it, what the seats cost at your real headcount, and what has to be fixed before any of it is worth paying for.
The sites and locations in the agreed scope are ranked by exposure, and the high-risk ones are reviewed against what sharing was actually intended.
The agreed oversharing fixes are made: company-wide links retired, orphaned guest access removed, over-broad group permissions narrowed to the people who need them.
Limits are put in place: tighter access where it is needed, file labelling where your license covers it, and the default sharing setting changed so the problem does not build back up.
A pilot group runs Copilot against real work, and what it surfaces is checked person by person against what those people were already entitled to see.
The go, defer or expand decision is made from the pilot evidence, with the remaining exceptions recorded and owned.

Acceptance

Checks before handover

Every location in the agreed scope has been reviewed and carries a decision
The agreed oversharing fixes are made and verified against real accounts
The access and guardrail configuration is applied and tested
The pilot group has completed the agreed use cases and what Copilot surfaced has been checked against entitlement
A go, defer or expand decision is recorded with the evidence behind it, and every remaining exception has an owner
Where the spend was still open, the funding case is delivered with the seat cost at your headcount and the named teams it was built against

A fair question

Microsoft says Copilot only shows people what they already have access to. Is that not enough?

That statement is true, and it is the problem rather than the reassurance. A file shared with the whole company in 2021 is still something everyone has access to, and until now nobody had a reason to go looking. Copilot does not break your permissions; it makes them easy to search. This corrects the sharing first so what it surfaces is what you intended.

Price and calendar

Scope, price and project calendar

Engagement price

Price fixed after a short scope call.

The price is agreed in writing before any work starts and before anyone is given access. The call itself costs nothing. What moves the number:

What determines the scope

Number of SharePoint sites, Teams and OneDrive locations in scope
Volume of company-wide and guest sharing to unwind
Whether sensitivity labelling is configured as part of the work
Size of the pilot population and the number of use cases tested
Whether the tenant licensing supports the guardrails in the design
Whether the funding case is needed, or the decision to buy has already been made

Delivery calendar

The proposal names the start date, the change windows and the completion date before anything is agreed.

How engagements work

Scope & responsibilities

What is and is not included

The exclusions, what we need from you, how change is staged and reversed, and what is handed over at the end.

Exclusions

Copilot license procurement
Site-by-site permission reconstruction outside the agreed location list
A full Purview classification or DLP programme
Content migration or information-architecture redesign: that is SharePoint & Teams Cleanup
Any guarantee about what Copilot returns, which depends on tenant content that keeps changing

What we need from you

Nominate someone who can confirm which sharing was intentional
Approve the list of locations before any changes are made
Provide the pilot users and their real use cases
Own end-user communications and support through the pilot
Provide the licensing the agreed guardrails require

Change and rollback method

Sharing is narrowed in batches with a hold period, so an access change that breaks someone’s work is caught and reversed inside the same week rather than discovered a quarter later.
Every batch is verified from a real account in the affected group, not from the admin console alone.
The pilot runs on the corrected scope only; Copilot is not enabled beyond it until the pilot evidence supports it.

What you keep at handover

A System guide: the configuration as delivered, the checks that were run and the unresolved list
The exposure ranking across the locations in scope, before and after
Every permission and sharing change made, with the reason
Per-person access examples drawn from real groups in the tenant
The guardrail configuration as applied
The pilot record and the written go, defer or expand decision
Where the spend was still open, the funding case: the teams, the use it would get, and the seat cost at your headcount

Access, acceptance and support arrangements

How you know the work is good

Judge it by what you can inspect.

The method is written down, the sample records open and the demo can be broken on purpose. Read it the way your technical owner would.

How a project runs: A first conversation, free. An agreed scope with a named technical lead in the proposal. The price fixed in writing before we are given access. Checks before handover.
How we work
What is checked: Release checks, access test matrices and ownership maps. Constructed inspection records on the service pages show the standard before you buy.
See sample deliverables
What you keep: A System guide: what was agreed, what changed, what was tested and what remains open. With it, the scripts and check results behind the work.

Next step

Start with a free scope call.

Tell us what needs to change, what must keep working and the deadline. The call is free, and the price is fixed in writing before anyone is given access.

Price the Copilot cleanup

Or write to [email protected]