Briefing note. Microsoft documents that Microsoft 365 Copilot only surfaces organizational data that a user already has at least view permission to [1]. That is the right design. It also means the assistant inherits every permission mistake in the estate. In a regulated bank, fix access, oversharing and classification before broad licensing, not after.
The assistant does not create access. It exposes it.
An enterprise artificial intelligence (AI) assistant answers questions by retrieving content the user is allowed to open. Microsoft 365 Copilot reaches emails, chats, meetings and documents through Microsoft Graph, the service layer that connects Microsoft 365 data. It presents only the data each individual can access, using the same access controls as other Microsoft 365 services [1]. It does not bypass permissions.
That is exactly the issue. Most large estates carry years of loose sharing. A file shared with the whole organization years ago was hard to find. Nobody knew to look for it. An assistant changes the cost of discovery from “know where it is” to “ask in plain language”. Obscurity was never a control. Now it is not even a habit.
I have spent nearly a decade in large global banks, where technology must perform at global scale under close regulatory scrutiny. One lesson holds across AI deployment in that setting. Permissions, not software, set the pace of a rollout.
Where oversharing usually hides
The patterns are common to most large Microsoft 365 estates:
- Sites and teams opened to organization-wide groups for convenience at creation.
- Sharing links scoped to everyone in the organization, with no expiry.
- Sites with no active owner after a reorganization or a project close.
- Broken permission inheritance, where a folder deep in a site is open wider than the site itself.
- Sensitive content with no sensitivity label, so no policy knows it is sensitive.
None of these are AI problems. All of them become AI problems the day the assistant goes live.
Regulators already expect the fix
No new AI rule is needed to justify this work. Guideline B-13 on technology and cyber risk, from the Office of the Superintendent of Financial Institutions (OSFI), Canada’s federal prudential regulator, has applied since January 2024. It expects institutions to “identify, classify and protect structured and unstructured data based on their confidentiality classification”, with periodic discovery scans [2]. It also calls for least privilege and regular attestation of access [2]. An assistant simply makes the gap between policy and practice visible to every user at once.
OSFI and the Financial Consumer Agency of Canada (FCAC) add a related warning in their joint report on AI risk. They flag employees using public generative AI tools and recommend controls that stop confidential data from being entered into prompts [3]. Since January 2025, Microsoft has offered Microsoft 365 Copilot Chat to commercial customers free of charge [4]. AI chat is now a default capability to govern, not an optional purchase to approve.
Readiness checklist before the first licence
| Control | Done means | Owner |
|---|---|---|
| Site ownership | Two named owners per site | Business line |
| Broad access | No organization-wide groups on sensitive sites | Identity team |
| Sharing links | Wide links reviewed, expiry set | Collaboration team |
| Labels | Default label on new content | Data governance |
| Encryption | Applied to the most sensitive tier | Data governance |
| Data loss prevention | Covers client, payment and personal data | Security |
| Attestation | Owners re-certify access on high-risk sites | Business line |
| Retention | Prompts and responses held under records policy | Compliance |
Two product behaviours make this checklist work. Copilot honours the usage rights granted to a user on content encrypted through sensitivity labels [1]. Prompts and responses are stored with other Microsoft 365 content, and administrators can manage them through Microsoft Purview search and retention [1]. Confirm both against current vendor documentation before you rely on them. Product behaviour changes.
Roll out in gated phases
- Discover. Run oversharing reports. Rank sites by sensitivity and exposure. Microsoft publishes a deployment blueprint for oversharing, and it announced that Copilot licences would include SharePoint Advanced Management capabilities from early 2025 [5].
- Contain. Remove organization-wide access from the highest-risk sites. Assign owners to orphaned sites. Where a site cannot be fixed quickly, restrict who can reach it until it is.
- Pilot. License a small cohort. Include people from control functions, not only enthusiasts. Run a structured red-team exercise: ask the assistant for compensation data, deal names, client records and board papers. Log every hit.
- Fix and re-test. Every hit becomes a remediation ticket with an owner and a date. Re-run the same prompts after the fix.
- Expand by business line. A line goes live only when its sites pass the checklist.
- Operate. Run quarterly attestation, track label coverage, and keep a standing red-team prompt set.
The gate between phases is evidence, not calendar time.
What to tell the risk committee
A chief risk officer needs four answers in plain terms:
- What can the assistant see? The same content each user can already open, and no more [1].
- What did we fix before go-live? Counts of sites remediated, links removed and owners assigned.
- What remains? Named residual risks, with owners and dates.
- How will we know if something goes wrong? Red-team results, data loss prevention alerts and audit logs.
Report a small set of metrics every quarter:
| Metric | Target |
|---|---|
| Sensitive sites with two owners | 100% |
| Organization-wide links on sensitive sites | Zero |
| Content with a sensitivity label | Rising each quarter |
| Red-team prompts returning restricted content | Zero |
The bottom line
An AI assistant is a mirror held up to your access model. If the reflection is untidy, the fix belongs in the estate, not in the assistant. Do the permission work first. It is cheaper before go-live than after the first incident.
References
- Microsoft, “Data, Privacy, and Security for Microsoft 365 Copilot,” Microsoft Learn, 2024.
- Office of the Superintendent of Financial Institutions, “Guideline B-13: Technology and Cyber Risk Management,” July 2022 (effective Jan. 1, 2024).
- Office of the Superintendent of Financial Institutions and Financial Consumer Agency of Canada, “OSFI-FCAC Risk Report: AI Uses and Risks at Federally Regulated Financial Institutions,” Sept. 24, 2024.
- J. Spataro, “Copilot for all: Introducing Microsoft 365 Copilot Chat,” Microsoft 365 Blog, Jan. 15, 2025.
- S. Patton, “Accelerate Microsoft 365 Copilot adoption with built-in content governance,” Microsoft 365 Copilot Blog, Microsoft Tech Community, Nov. 19, 2024.