Before Copilot: review the information people can already reach

Begin with the access model

Microsoft 365 Copilot works with the user’s existing access. That makes the underlying permissions an important readiness question. A document may already be reachable even if few people knew where it lived. Before a rollout, identify sensitive collaboration locations and understand who can reach them. A review does not need to read every document to establish that a site has an overly broad membership or sharing arrangement.

Choose meaningful populations

Build an inventory of sites, Teams, owners and sharing settings. Prioritise locations associated with HR, finance, client work and internal administration. Sample selected locations using documented criteria, then examine membership, guests, links and ownership. A small sample cannot establish that every file in a tenant has appropriate permissions. Record unassessed locations so management can distinguish the initial readiness decision from the wider clean-up programme.

Look beyond the default setting

A tenant-level sharing restriction is only part of the evidence. Review site-level settings and existing access paths, including links created previously and guest memberships that remain active. Establish how owners approve external access and how it is removed. A deleted link is not evidence that every alternative access route disappeared. Where possible, validate the resulting effective access through a safe, agreed procedure.

Connect labels with operation

Sensitivity labels, retention and data-loss controls need a defined purpose, appropriate licensing and an operating owner. A label catalogue alone does not demonstrate adoption or enforcement. Examine selected policy assignments and records, clarify which locations are covered and distinguish a proposed improvement from an implemented safeguard. If the organisation uses Power Platform integrations, include connector and data-policy questions where they affect the same information boundary.

Plan a controlled rollout decision

Translate observations into conditions for the rollout: named location owners, reviewed high-priority permissions, approved exceptions, an agreed monitoring path and a documented residual-risk decision. Separate immediately necessary changes from a wider governance programme. The review should identify what evidence was available and what remained uncertain. It cannot guarantee that every future prompt, document or interaction will be safe.

Plan the operational handover

Information stewardship must survive the initial rollout. Set a practical review trigger for new sites, new guests and changes to sensitive business processes, and identify the team that can resolve an ownership dispute.

Related Atlant Security guidance: limiting evidence collection and connecting workplace service boundaries. Use these to connect the review with the evidence and responsibilities needed after it.

Prepare your brief

Use the Copilot security readiness review for an evidence-led scope and the SharePoint and Teams audit for the collaboration boundary. Ongoing stewardship may require defined operational responsibilities; our separate managed security services site helps scope that follow-through. No monitoring coverage or response commitment is implied by an audit.