SharePoint Permissions Before Copilot: A UK SME Cleanup Guide

Microsoft 365 Copilot does not create a permissions problem. It finds one and puts it in front of whoever asks the right question. A supplier contract that has been readable by every member of staff since 2021 stays readable, except now one typed sentence returns the file, the summary and the clause that matters.

We have run this audit on tenants with 40 users and tenants with 400, and the pattern barely changes. An old project site still carries a grant to Everyone Except External Users. Three people left last year and their access was never removed. A folder of HR case notes sits in a site whose owner left the business in 2023.

None of that mattered while enterprise search was poor. Copilot made search work.

What Copilot can actually read

Retrieval runs through Microsoft Graph and is trimmed against the signed-in user's existing rights. SharePoint and OneDrive permissions, mailbox delegation, Teams membership and the access control list on individual items all apply. There is no service account with tenant-wide read and no separate index that skips the permissions model, which Microsoft sets out in its Copilot readiness guidance for SharePoint.

That description is accurate, and it is the reason to worry. Every user now has a patient assistant that will read anything they were already entitled to see, and it will not pause to ask whether they should have been entitled to it at all.

Three ways a tenant ends up overshared

Permission inheritance does most of the damage. A file inherits from its folder, the folder from the library, the library from the site. One broad grant at site level propagates to tens of thousands of items, and that grant was usually made by someone trying to unblock one colleague for one afternoon.

The second mechanism is the special group Everyone Except External Users. It looks harmless in a permissions dialog, it is available in the people picker, and it resolves to every user holding a licence in the tenant. A grant to that group is a company-wide publication with a reassuring name.

Sharing links come third, and administrators forget them most often. An Anyone link needs no sign-in. A People in your organisation link crosses team boundaries. Both are real access grants that never appear in the site membership list where an admin would think to look.

Four signals to check first

You do not need to read every permission in the tenant. Five signals cover most of the risk, and Microsoft already reports on all of them.

A site with three of those signals goes to the front of the queue. A site with one signal and no sensitive content can wait until the next quarter.

Run the baseline before you buy Copilot for everyone

The site permissions report is the one to start with, under Reports and then Data access governance in the SharePoint admin centre. Microsoft states that the first run takes up to five days regardless of tenant size, that later runs complete within 24 hours, and that the data reflects the state up to 48 hours before the report is generated. You can rerun it every 30 days. The summary lists the top 100 sites by number of permissioned users, and the CSV download handles up to 1 million sites.

Pair it with the activity reports, which cover the last 28 days. One lists the sites where people created the most sharing links. Another lists the top 100 sites where content was shared with Everyone Except External Users. Activity shows where behaviour is happening now, while the snapshot shows where the accumulated exposure sits.

Licensing catches people out here. Microsoft 365 E5 gives access to the data access governance reports but not the snapshot reports or the remedial actions, and E5 activity reports are capped at 10,000 sites. Relying on E5 alone leaves you with a partial view and no built-in fix.

Assign one Copilot licence first

The sequence we recommend runs against what most resellers propose. Assign a single Microsoft 365 Copilot licence before you plan the rollout. Microsoft gives SharePoint Advanced Management to the tenant when at least one Copilot licence is assigned, so the SharePoint administrators get the governance reports, Restricted Access Control and Restricted Content Discovery without buying another product.

One licence provides the tools for deciding whether the other nineteen are safe. Buying the full estate first and cleaning up afterwards creates weeks of exposure you never needed.

Two exceptions apply. Restricted site creation by apps needs the SharePoint Advanced Management Plan 1 add-on, and tenants above 10,000 sites need SAM licensing whatever else they own. Neither usually matters to a business of 20 to 200 people.

What Restricted Access Control and Restricted Content Discovery actually do

Restricted Access Control is the one with teeth. You set up to 10 Microsoft Entra security groups or Microsoft 365 groups per site, and membership becomes a second key alongside the permission. A user needs both. Turn on site access restriction at tenant level under Policies and Access control, then apply it per site, and delegate the control to site admins so they manage their own sites instead of emailing you. Microsoft documents the steps in Restrict SharePoint site access with groups.

Restricted Content Discovery is narrower than most people expect. It keeps a site out of organisation-wide search and Copilot grounding, yet a permitted user with a recent interaction can still see the content and direct navigation still works. Treat it as cover during remediation, not as an access boundary.

The cleanup sequence that holds

This order works on a small tenant and still holds at 500 users. The tooling belongs to Microsoft. The discipline belongs to you.

• Change the defaults. Turn on site access restriction at tenant level and set the default sharing link to Specific people. Both are single settings that stop the problem regenerating while you fix the past.
• Run the baseline and the sharing link report. Accept the five-day wait on the first run. Starting the report on a Friday costs you nothing.
• Rank by sensitivity and audience. Sensitive content with a large audience and no owner is the top of the list. Everything else can be scheduled.
• Send site access reviews to named owners. Give them two weeks and three choices: confirm the audience, reduce it, or archive the site.
• Clear the Everyone Except External Users grants. Replace each one with an Entra security group, or delete it when nobody can justify it. Hiding the claim in the people picker stops it coming back.
• Expire the links. We treat any Anyone link older than 12 months as forgotten until proven otherwise, and we set a default expiry so new links die on their own.
• Apply Restricted Access Control to the crown jewels. Payroll, HR case files, board papers, transaction data and privileged legal advice. Keep the control group tight, because ten groups per site is a limit, not a target.
• Test with a standard account. Ask Copilot three ordinary questions about remuneration, redundancy and acquisition activity. Record the citations rather than the content, and treat every surprising citation as a finding.
• Fix provisioning. New sites get an owner, a review date and Restricted Access Control where the content warrants it. Otherwise the next project recreates the problem in a fortnight.

Step four is the one SMEs skip, and skipping it is expensive. Permission changes made by IT without the owner present tend to be either too timid to help or broad enough to break a weekly process, and both outcomes cost more than the review would have.

If that list looks like a quarter of work, it usually is the first time. We run it alongside in-house IT teams through our SharePoint consultancy, and the owner review is the part nobody can do for you. The rest is project management.

How long the work takes

On a 100-user tenant with around 150 sites, we typically see 40 to 60 hours of combined admin and owner time spread across three to four weeks. A 25-user business with 30 sites usually needs 8 to 12 hours.

Those figures come from our own projects rather than a Microsoft benchmark, and a messy tenant will exceed them. Reporting is rarely the bottleneck. Owner availability is, and twelve owners answering an email in the same fortnight decides whether the cleanup lands before the Copilot pilot or three months after it.

Where this goes wrong

• Buying Copilot for the whole company first. The exposure window lasts as long as the rollout, and it opens before anyone has looked at the permissions.
• Treating Restricted Content Discovery as protection. It reduces discovery. It does not stop access, and it is not an audit answer.
• Handing the cleanup to a partner without owners. A partner can run the reports in a day and then stall for a month waiting for decisions only the business can make.
• Forgetting OneDrive and channel sites. Private and shared channel sites have their own site collections and drop off a list built from the main team sites. OneDrive holds the same leaked spreadsheets as SharePoint.
• Leaving the sharing default alone. A cleanup with organisation-wide links still enabled has a shelf life of about a month.

Microsoft should have made Specific people the default years ago. It has not, so the setting is yours, and it removes more risk in five minutes than most security products remove in a quarter.

The 90-day target

A tenant that is ready for Copilot looks like this.

• No grant to Everyone Except External Users outside the intranet.
• Default sharing link set to Specific people, with an expiry.
• Baseline report run quarterly, activity reports monthly.
• Every site has a named owner who still works for the business.
• Restricted Access Control applied to the 10 to 20 sites that carry sensitive data.
• A documented test showing what a standard user's Copilot account can and cannot cite.

That last item is what auditors and insurers ask for, and it is the only real proof that the cleanup worked. A screenshot of a report shows intent. A recorded test with citations shows the result.