Professional IT support
We've solved the same IT headaches you're dealing with now, for hundreds of other Wiltshire businesses. Whether it's helpdesk support, network management, cloud solutions, cybersecurity or strategic IT consulting, get in touch and let's fix it.
Learn more ->IT Support
Outsourced IT Support Packages & Pricing Remote IT Support Proactive IT Support Switching Providers Pricing Estimator
Fully managed IT services
The technology behind your business should be invisible - until you need it. We manage it so it stays that way.
Learn more ->
Cyber Security services
Cybersecurity isn't a luxury item - it's the intelligent way to protect your business, your data, and your future.
Learn more ->Featured Posts
Micro-SaaS Vetting
Read more ->
How to Vet SaaS Integrations
Read more ->Frequently Asked Questions
The questions we get asked the most, answered straight in plain English.
Learn more ->Featured Posts
Governing Generative AI
Read more ->
Navigating the AI Landscape
Read more ->Our Vision
Our vision is to make the organisations we partner with the very best they can be.
Learn more ->Featured Posts
Is a managed service agreement right for my business?
Read more ->
Do you handle new starters and leavers for my business?
Read more ->Request free IT audit
Written by: Paul CoxDate: 11-07-2026
What Copilot can return in a tenant with broad permissions
If broad permissions are left unaudited, Copilot can inadvertently surface highly sensitive information. Microsoft's deployment guidance strongly recommends a comprehensive permissions review before enabling Copilot at any scale. Here are five examples of what a user could uncover:
What is everyone's salary?
Returns an HR compensation spreadsheet shared with a hiring manager for a recruitment process 18 months prior.
Summarise the [client] case
Pulls data from a SharePoint site where a user, added for a one-off project two years ago, still retains active access.
What deals are we currently working on?
Aggregates data into a single pipeline view by pulling from unclosed M&A data rooms, personal OneDrive trackers, and expanded Teams channels.
Find everything mentioning [former employee]
Surfaces confidential termination memos, severance calculations, and performance reviews never intended for anyone below partner level.
What's our markup on [client] engagements?
Outputs an internal pricing sheet from an unrestricted link originally shared between just two people for a proposal review.
Why a "small pilot test" is rarely as contained as you think
Limiting a pilot feels safe, but standard setups often create the highest-risk scenarios:
- Senior staff have broad access: Pilots usually involve senior partners who hold the widest permissions. A search run by them creates a much higher-risk preview of Copilot than one run by junior staff.
- Pilot drift:Licenses are frequently reassigned to whoever asks next rather than someone with an appropriate access profile.
- Irreversible exposure: Microsoft's audit logs only show what was searched after the event. Once Copilot summaries are displayed, that information cannot be recalled.
The cleanup to complete before any trial
For a firm of 25 to 100 people, these four tasks typically take four to eight weeks. They require collaboration between your IT provider and the partners who understand the data.
- SharePoint sharing audit: Use SharePoint Advanced Management to identify overshared patterns, inactive sites, and permission anomalies.
- OneDrive external share review: Retract forgotten files previously shared externally with clients.
- Teams membership review: Trim channel memberships so only current project members retain access to stored files.
- Sensitivity labels for confidential content: Use Microsoft Purview to apply encryption and Data Loss Prevention (DLP) policies. This blocks Copilot from processing or reading restricted documents.
The one question for your IT provider
Before committing to Copilot, ask whoever manages your Microsoft 365 environment:
"Can you show me a report of every file in our tenant that's accessible to more than ten people, and flag the ones containing client names, salary figures, or financial data?"
GOOD
If they can produce this in a few days: Your environment is actively managed, giving you a solid starting point.
BAD
If they need to "enable things first", SharePoint sharing reports have never been run, and permissions have not been audited.
Tell us what's slowing your team down - we'll show you how to fix it
Our mission is to provide technology guidance, expertise and support to enable our customers to grow their business.
Start Here
One email a month. Real IT tips, not filler, unsubscribe any time.
By Subscribing you are agreeing to receive our IT updates newsletter released each Month. You will not receive anything else.
