“Is Copilot safe?” is the question MSPs hear most when a client wants to switch on Microsoft 365 Copilot. The honest answer is that Copilot itself is rarely the problem. The problem is what it can find.
Microsoft says Copilot only shows people organisational data they already have permission to view. That sounds reassuring, and it is true. But in most businesses, people have permission to view far more than anyone intended: old sharing links, sites open to “everyone”, folders inherited from a reorganisation five years ago. Before Copilot, finding those files took effort. With Copilot, it takes one plain question.
This post explains what Copilot can see, where the real risks are, and what to check before and after you switch it on.
What Microsoft 365 Copilot can see
Copilot works on behalf of the person using it. When someone asks a question, Copilot searches the content that person can reach and uses it to answer. That includes:
- Email and calendars the person can open, including shared mailboxes.
- OneDrive and SharePoint files, including anything shared with them directly, with a group they’re in, or with the whole organisation.
- Teams chats and meeting content they took part in or can access.
- Content from connected apps, where Copilot connectors or plugins have been set up.
The key phrase is “can reach”. Copilot doesn’t care whether a person should see a file, or whether they have ever opened it. If their account can open it, Copilot can surface it.
Copilot doesn’t break your permissions. It reads them out loud.
Here’s a common example. A finance manager once shared a folder called “Salary bands 2025” with “People in your organisation” to get quick feedback from two directors. The link was never removed.
For two years, nobody noticed, because nobody went looking. Then the business switches on Copilot, and a junior employee asks, “What’s the pay range for my role?” Copilot finds the spreadsheet, because the employee’s account can open it, and answers the question accurately.
Nothing was hacked. No permission was broken. Copilot did exactly what it was designed to do. That’s why Copilot security is mostly a sharing and access problem, not an AI problem.
The four real Copilot security risks
1. Oversharing
Files and sites shared far more widely than needed are the biggest risk. Look for:
- Sites and folders shared with “Everyone” or “Everyone except external users”.
- Links set to “People in your organisation” that were meant for two or three people.
- Old project sites that still contain contracts, HR notes or client data.
- Teams whose membership grew over the years and was never trimmed.
2. A stolen account with Copilot attached
When an attacker takes over an account, they get that person’s Copilot too. Instead of browsing folders one by one, they can ask Copilot to “summarise every contract renewal this quarter” or “find emails about bank details”. Account takeovers through stolen sessions and MFA tricks are common, and Copilot makes a stolen account more useful to the attacker. Watch for a burst of Copilot file access straight after an unusual sign-in.
3. AI apps and agents with their own access
Copilot is rarely the only AI connected to Microsoft 365. Meeting note-takers, AI assistants and agents built in Copilot Studio often hold their own access to mail, files or calendars through app consents. Each one is another set of keys. Read how to secure AI agents in Microsoft 365 and Google Workspace for that side of the picture.
4. AI use outside Copilot
Paying for Copilot doesn’t stop people using other AI tools. Staff still paste spreadsheets into personal chatbot accounts because it’s what they’re used to. A Copilot rollout should come with a clear rule on which AI tools are approved; our AI usage policy template is a starting point.
What Microsoft gives you
Microsoft provides useful controls, and you should use them. Check the current licensing for each before you plan around it.
- SharePoint data access governance reports list sites shared with large groups.
- Restricted Content Discovery keeps chosen SharePoint sites out of Copilot and organisation-wide search while you review permissions. It doesn’t change who can open those sites.
- Microsoft Purview sensitivity labels mark and protect sensitive files once they’ve been labelled.
- Conditional Access controls who can sign in, from where and on which devices.
These work one tenant at a time. An MSP looking after 30 clients needs to repeat each review 30 times, and labelling every sensitive file is long work that most small businesses haven’t started.
A worked example: getting a 40-person firm ready for Copilot
Here’s an illustrative example of how an MSP might prepare a client.
Week 1: find the oversharing. The MSP lists every site, folder and file shared with the whole organisation or by an open link. At this firm, that turns up 37 overshared folders, nine of them with sensitive content: salary bands, a board pack and two HR investigation folders.
Week 2: fix access, then check. Each folder gets a named owner, who confirms who really needs it. The sharing is narrowed to those people. The MSP then confirms Copilot can no longer surface the files to everyone else. Where the review will take longer, the most sensitive sites are kept out of Copilot search in the meantime.
Week 3: switch on Copilot for a pilot group. Ten people get Copilot first. The MSP watches which sensitive files Copilot opens, and for whom, and checks for unusual access after odd sign-ins.
Week 4 onwards: roll out and keep watching. Copilot goes to everyone. New oversharing and new AI apps are flagged as they appear, not in next year’s review.
Copilot security checklist
Before you switch Copilot on:
- List every site, folder and file shared with “Everyone” or the whole organisation.
- Find open sharing links on sensitive folders: payroll, HR, contracts, board papers.
- Give every sensitive site a named owner who confirms who needs access.
- Narrow access first; use Restricted Content Discovery only as a stopgap.
- Review AI apps and agents that already hold access to mail and files.
- Make sure MFA and sign-in rules cover every Copilot user.
- Agree which AI tools staff may use, and tell them.
After you switch it on:
- Start with a pilot group, not the whole company.
- Watch which sensitive files Copilot opens, and for whom.
- Alert on bursts of Copilot file access after unusual sign-ins.
- Re-check for new oversharing every month.
- Review every connected AI app and agent at least every 90 days.
How Centeye helps
The Centeye Copilot security page shows how this works across every client. In short:
- Centeye Synthwatch (early access) finds files and folders Copilot can surface to anyone, shows which sensitive files Copilot opens and for whom, and gives each overshared folder an owner and the exact sharing fix.
- Centeye Gatewatch spots unusual Copilot access, such as a burst of file access right after an odd sign-in, and can revoke the session at the setting you choose.
- Centeye Lumen lists every AI app and agent connected to Microsoft 365, shows AI use outside Copilot (with the browser extension, and never the content), and proposes only the fixes each client’s Microsoft licence supports.
Reading agents directly from Copilot Studio and Microsoft Entra Agent ID is coming.
Frequently asked questions
Is Microsoft 365 Copilot safe?
Copilot respects existing permissions, so it won’t show anyone a file their account can’t already open. It is as safe as your sharing. If files are overshared, Copilot makes them easy to find. Fix the sharing first and Copilot becomes much safer to roll out.
Does Copilot use our data to train Microsoft’s models?
Microsoft says prompts, responses and data accessed through Microsoft 365 Copilot aren’t used to train its foundation models. Check Microsoft’s current documentation for the details that apply to your plan.
Can we keep some files away from Copilot?
Yes. The real fix is to narrow who can open them. While that review happens, Restricted Content Discovery can keep chosen SharePoint sites out of Copilot search. Sensitivity labels add protection once files are labelled.
What’s the biggest Copilot risk for a small business?
Oversharing. Small businesses tend to share broadly because it’s quick, and they rarely clean up old links. One “People in your organisation” link on a payroll folder is enough.
Should an MSP roll Copilot out to everyone at once?
No. Fix the worst oversharing, start with a pilot group, watch what Copilot opens for a few weeks, then widen the rollout.
New to the terms? See shadow AI, OAuth grant and AI agent in our glossary. Want to see what Copilot can reach in a client’s tenant? Start a free trial.
Copilot permissions, data access governance reports, Restricted Content Discovery, sensitivity labels, Conditional Access and training-data commitments as described by Microsoft on Microsoft Learn, October 2026. The worked example and the salary-bands example are illustrative. Synthwatch is in early access; this post describes what ships today and what is coming.