Copilot didn't leak your data. It made it findable.

Microsoft 365 Copilot honours every permission you have set. That is exactly the problem. For twenty years obscurity was doing the work you thought access control was doing.

The architecture is not the vulnerability

Every time a Copilot incident gets written up, someone reaches for the word "leak". It is the wrong word, and the wrong word leads to the wrong remediation.

Copilot does not have its own data store. It queries the Microsoft Graph, and it queries the semantic index that Microsoft builds on top of your tenant. Both enforce the access control lists that were already there. If a user could not open a file yesterday, Copilot will not surface it today. Microsoft's documentation is accurate on this point and I have not seen a credible case that contradicts it.

So no permission boundary was crossed. Nothing escaped. Every document Copilot returns is a document that user was already entitled to open.

They just never would have found it.

Obscurity was a control, and nobody wrote it down

Think about what actually stopped an employee from reading the 2018 redundancy list that somebody parked in a Teams-provisioned SharePoint site.

It was not a permission. The permission was almost certainly "everyone except external users", because that is what the default sharing link has produced across most tenants for years. What stopped them was that they did not know the site existed, did not know the file was called Liste_final_v3_REVIDERET.xlsx, and had no reason to run a search that would return it.

Enterprise search was bad. That badness was load-bearing.

Copilot removes it. The semantic index does not need a filename. A user types a question in natural language, and the retrieval layer finds semantically related content across everything they can technically reach, then synthesises it into a confident paragraph with citations. The employee who would never have gone looking now gets an answer they did not ask a precise enough question to deserve.

That is not a leak. That is a retrieval system doing its job against a data estate nobody ever cleaned.

What sensitive data discovery actually finds

Before you argue about Copilot's blast radius, run sensitive data discovery across the tenant and look at the output. Four things compound in every single one, and they are all boring:

• Inherited permissions nobody has ever traced. A site collection gets a broad grant. Subsites and libraries inherit. Three reorganisations later, the group that grant refers to contains a hundred people who have no relationship to the original purpose.

• Default sharing links. Tenant-wide, the default for years was an organisation-scoped link. Every "share this with Lars" produced an artefact readable by the whole company. Multiply by a decade.

• Personal OneDrive as a filing cabinet. People keep HR exports, salary models, and copies of contracts in OneDrive, then share a folder once, for one reason, and never revoke it.

• Mail. The single worst offender in every review we run. Passports, driver's licences, payment card details, pen-test reports, active credentials — all sitting in mailboxes and in the attachments Copilot can now summarise.

Microsoft's own mitigations tell you they know. Restricted SharePoint Search exists specifically so that panicking administrators can cap Copilot's reach to an allow-list of sites while they sort out permissions. It is explicitly described as temporary, it is capped at a small number of sites, and it works by making search worse again. You are paying for a retrieval product and then switching off retrieval. That is a tourniquet, not a treatment.

The order of operations most organisations get wrong

The standard remediation plan is a permissions project. Audit the ACLs, tighten the grants, remove the org-wide links, run oversharing reports, then deploy.

I understand why it is the first instinct, and some of it has to happen. But run the numbers on it. A mid-sized tenant has millions of items and tens of thousands of unique permission scopes. You are attempting to reason about the correct access level for every one of them, in an estate where the business context that justified each grant is gone and the people who made them have left.

Meanwhile the deployment date does not move, because Copilot licences are already bought.

There is a cheaper operation available first. Most of what you are trying to protect should not exist.

In the reviews we run, a large share of what sits in mailboxes and file shares is redundant, obsolete or trivial: superseded drafts, old exports, copies of copies, personal data retained years past any lawful purpose. That material has no owner, no retention justification, and no defence if a regulator asks why you still hold it. It is also, unhelpfully, exactly the kind of content a semantic index loves — high in personal data, low in business value.

Deleting it is a smaller problem than permissioning it. There is no ACL to reason about on a file that is gone. It does not need review, it does not need an exception process, and it cannot be retrieved by anyone, with any prompt, ever.

So the order is: run a GDPR scanner across mail, OneDrive and SharePoint to establish what you actually hold, get every data owner to confirm what still has a purpose, delete the rest and prove it, and then do the permissions work on the fraction that survives. You will be tightening access on a far smaller estate, with the business context still attached.

The sequencing matters more than the tooling. A permissions project on an uninventoried estate is unbounded. A permissions project on an estate you have already halved is a Tuesday.

The uncomfortable part

Copilot is not creating a new risk category. It is producing the first honest audit of your data estate that anyone has ever run, and doing it in public, one employee prompt at a time.

Every organisation deploying it is about to find out what it has been keeping. The ones who classified and deleted first will find that reassuring.

If you want to know what is actually sitting in your unstructured data, we run a free review.

Take care out there.

/A