How do we prepare our company for Microsoft Copilot?

By LAN Service Group · Reviewed October 4, 2026

Permissions are the whole project

Microsoft renamed Microsoft 365 Copilot to Microsoft Copilot and says security, compliance and privacy terms did not change. The data model did not change either: Copilot works through Microsoft Graph and only surfaces content each user already has at least view permission to. Microsoft also states that prompts, responses and data accessed through Microsoft Graph are not used to train foundation models.

That means Copilot does not create new access. It makes existing access searchable in plain language. If a payroll workbook or HR folder has been open to everyone for years, nobody noticed because nobody went looking. Copilot will find it for anyone who asks the right question.

What Microsoft's own checklist asks for

Microsoft's setup guidance for administrators lists readiness activities and security measures to complete before broad licensing:

• A test environment and a pilot with a select group of users, plus a communication plan.
• Conditional access policies reviewed, and multifactor authentication enabled for all users.
• Unified audit logging turned on in Microsoft Purview, with audit-log retention set to your compliance needs.
• SharePoint search and SharePoint Advanced Management policies reviewed to prevent oversharing.
• Microsoft 365 Apps on Current Channel or Monthly Enterprise Channel; Microsoft says Copilot is not available on Semi-Annual Enterprise Channel.

Find and fix oversharing

Microsoft's guidance is practical: export your 100 most-used SharePoint sites, run the SharePoint Advanced Management permission state report, compare it with the Microsoft Purview oversharing assessment, disable the "everyone except external users" group at the tenant level, start access reviews for overshared sites, and apply restricted access control to business-critical ones. Microsoft says that once at least one user has a Copilot license, SharePoint admins get the SharePoint Advanced Management features that support the deployment.

Where a review will take time, Restricted Content Discovery can keep a site out of organization-wide search and Copilot responses. Microsoft describes it as a temporary control that does not change permissions, so it buys time rather than fixing the underlying access. On very large sites, Microsoft notes an update can take more than a week to take effect.

Label what matters most

Sensitivity labels from Microsoft Purview add a second layer. When a label applies encryption, Microsoft states Copilot returns content only if the user holds the EXTRACT usage right as well as VIEW. Start with the few folders that would hurt most if exposed, such as finance, HR, legal, research and customer data, rather than trying to label everything at once.

Pilot, then deploy, then operate

Microsoft recommends three phases: a pilot with early adopters across business groups, a wider deployment, and an operate phase that watches usage and adjusts. Pick pilot users whose data you have already cleaned up, gather their feedback, and only widen licensing once the permission fixes for the next group are done. Usage and readiness reports in the Microsoft 365 admin center help you decide when to move on.

Common follow-up questions

Sources

• Microsoft Learn: Data, Privacy, and Security for Microsoft Copilot
• Microsoft Learn: Set up Microsoft Copilot and assign licenses
• Microsoft Learn: Restrict discovery of SharePoint sites and content
• Microsoft Learn: SharePoint Advanced Management features in Microsoft Copilot licenses