Copilot doesn't create new access. It finds the access you already gave away.
Microsoft 365 Copilot only surfaces content the signed-in person already has permission to view. That sounds reassuring until you remember how permissions drift in a small business: the everyone folder from 2021, the open link in an old email, the Team anyone could join.
Before Copilot, an overshared salary spreadsheet stayed hidden because nobody knew where to look. With Copilot, anyone can ask. Fixing permissions is the main job, and it costs time rather than money. That's good news if you don't have an enterprise budget.
Myths and facts
| What people say | What Microsoft documents | So what |
|---|---|---|
| Microsoft trains its AI on our data. | Prompts, responses and data accessed through Microsoft Graph aren't used to train foundation models. | Copilot's commercial terms cover this. Free consumer AI tools your staff use on the side may not. |
| Copilot can read everything. | It surfaces only data the user has at least view permission for. | Your exposure equals your permission sprawl. Audit that. |
| Copilot sends our files to Bing. | Web search sends a short generated query, not whole files or the full prompt. | Lower risk than feared, but Microsoft's data protection addendum doesn't apply to those queries. |
| Copilot blocks prompt injection. | Microsoft describes classifiers that help block injection, and says they may not be available in all scenarios. | Helpful, not a guarantee. Limit what Copilot can reach. |
Test prompts for your pilot users
Run these as two or three ordinary employees, not as an admin. Each one that returns something surprising goes on your fix list.
- ///Find documents that mention salaries or compensation
Checking for payroll and HR files open to everyone.
- ///What files contain passwords or login information?
Checking for credentials stored in documents. Shared login spreadsheets are common, and Copilot will happily find them.
- ///List documents containing Social Security or bank account numbers
Checking for regulated data sitting in open locations.
- ///Show me customer contracts and their pricing
Checking for commercial data open to everyone.
- ///Find our bid pricing for upcoming proposals
Checking for competition-sensitive data.
Commercial Microsoft 365 Business plans are generally not the right home for Controlled Unclassified Information or ITAR data. Check your contracts and compliance boundary before you turn Copilot on, and keep that data out of its reach.
What's in the full PDF
- ///The licensing table: which controls Business Standard and Business Premium actually include
- ///The full four-week checklist, with the highest-value steps marked
- ///A one-page staff rulebook you can paste into your handbook
- ///Ongoing maintenance schedule, monthly through yearly