Microsoft Copilot Governance: Fix Oversharing First

Microsoft Copilot governance starts with oversharing, because Copilot only shows each person what they can already open: it does not create new access, it makes existing access findable. Fix the broad grants first (sites open to every employee, broken inheritance, stale and ownerless sites), put temporary brakes on the sites you cannot fix this month, and run a gated pilot while the cleanup continues. The core controls come with the Copilot license and Microsoft 365 E3; a few need E5-class licensing.

Key figures (updated 23 October 2026)

• Copilot only surfaces organizational data a user can already view (Microsoft Learn).
• SharePoint Advanced Management, Microsoft's oversharing toolkit, is included once one Copilot license is assigned (Microsoft Learn).
• Restricted SharePoint Search: new enablement blocked since 31 July 2026 (Microsoft Learn); full retirement 31 January 2027 (notice MC1395311).
• US list prices as of October 2026, per user per month, paid yearly: Copilot add-on $30.00; Microsoft 365 E3 $39.00 and E5 $60.00 (with Teams); E7 $99.00 (Microsoft 365 plans and pricing; July 2026 price update).
• DLP that keeps labeled files out of Copilot needs E5-class licensing; DLP for prompts covers every Copilot and Copilot Chat user (Purview service description).
• Kickoff to a gated pilot: 6–10 weeks for a 200–2,000-person tenant (AIDOLS planning estimate).

Cite as: AIDOLS Research Team, Microsoft Copilot Governance: Fix Oversharing First, aidolsgroup.com, 23 October 2026.

This guide covers how Copilot decides what people see, the tool and license for each control, a 12-step checklist with owners, the rules that apply and how to keep it working.

Microsoft Copilot governance is the set of controls, owners and routines that decide what Copilot can find, use in an answer and record. It is part of AI governance and shared work: IT and security run the tools, the privacy officer and records manager set the rules, and site owners decide who sees their content. Microsoft has renamed Microsoft 365 Copilot to Microsoft Copilot and Copilot Chat to Microsoft Copilot Chat; price pages still use the old names, and Microsoft says nothing changes for security, compliance or privacy (Microsoft Learn).

Copilot finds what people can already open

In Microsoft's words, Copilot "only surfaces organizational data to which individual users have at least view permissions." But a salary workbook on a company-wide site was always open to everyone, protected only because nobody went looking; Copilot removes that obscurity. So the question is not "what will Copilot leak?" but "what can our people already open that they should not?"

Microsoft's blueprint: remediate, guard, comply

Microsoft's oversharing blueprint, Secure & Governed Data Foundation for Microsoft Copilot, has three pillars (remediate oversharing, set up guardrails, meet regulations), states that SharePoint Advanced Management (SAM) is included with the Copilot license, and replaced the older pilot, deploy and operate version (Microsoft Learn: the blueprint).

Why pilots stall here

In Gartner's 2024 survey, only 6% of respondents had finished a Copilot pilot and were moving to large-scale deployment, and Gartner found oversharing and security concerns significantly affect deployments (Gartner). The Australian Government's evaluation of its 2024 whole-of-government trial, run on an earlier version of the product, found that poor information management and permissions led to inappropriate access to and sharing of sensitive information (Digital Transformation Agency).

Copilot grounds answers through Microsoft Graph and the semantic index, and uses only items the person asking can at least view. Connector content appears only for users with permission to it, admins choose which agents are allowed, and prompts, responses and Graph data are not used to train the foundation models (Microsoft Learn).

Licensed Copilot vs Copilot Chat: what each can reach

Staff with only Copilot Chat, which comes at no additional cost with eligible plans, still create internal exposure. Chat is mainly web-grounded, but in Outlook it grounds on a user's mail, calendar, meetings, chats and a bounded set of files without a Copilot license (Copilot Chat overview), and Chat users can run agents, billed on a metered basis through an Azure subscription (Microsoft).

Neither grants new access; licensed Copilot adds Graph, Work IQ and semantic indexing across everything the user can open. Write the staff rule before Chat users point agents at internal content. Our free lesson on what staff may put into an AI tool gives the four questions to teach.

Because every overly broad grant becomes an answer waiting for the right question. Microsoft's Content Management Assessment checks five signals: inactive sites (no activity in 180 days), sites with no owner or one owner, broken permission inheritance, content shared with Everyone except external users, and overly permissive sharing links. It runs in 2 to 72 hours, changes nothing without admin consent, and Microsoft suggests rerunning it every 30 days (Content Management Assessment).

Everyone except external users and public sites

Everyone except external users (EEEU) is a built-in group of every internal user, so sharing with it grants access to all current and future employees, and making a site public adds EEEU to its membership (EEEU report). Start there.

Broken inheritance and "specific people" links

Broken inheritance means a folder or file carries its own permissions instead of the site's, so a broad grant can hide inside a site whose membership looks tight. A "specific people" link makes the file appear in search and in Copilot for every user and security-group member added to it, so one sent to an all-staff group is a company-wide grant. Contrary to some guides, Anyone and "People in your organization" links do not make content searchable or available to Copilot until someone redeems them, though organization links sent from SharePoint, OneDrive, Outlook or a Teams chat are redeemed automatically for up to 100 individual recipients, and Anyone links need no sign-in and cannot be audited (how shareable links work).

Stale, ownerless sites feed stale answers

An ownerless site has nobody to approve or remove access, and an inactive one feeds Copilot superseded content. Microsoft recommends Microsoft 365 Archive for inactive but valuable content, which stops Copilot processing it, and retention and deletion policies for obsolete files (configuration guide). Our lesson on why a connected source returns superseded files shows the user's side.

Microsoft's configuration guide requires a Copilot license, SAM and at least the foundational Purview capabilities in Microsoft 365 E3, and mentions optimized features in E5 or E7 (configuration guide). One assigned Copilot license gives SharePoint admins SAM's Copilot features, from data access governance (DAG) reports and site access reviews to Conditional Access authentication contexts for sites; the sensitivity-label DAG report also needs E5 or G5 (SAM in Copilot licenses). E7 includes SAM through its bundled Copilot license (E3, E5 and E7 comparison).

Sources: Purview service description, Entra access reviews, Conditional Access, DSPM and the pages above.

What E3, E5 and E7 cost and include (October 2026)

Sources: Microsoft's July 2026 price update, the Copilot enterprise and Copilot Business pages and the E7 and Agent 365 announcement.

The short answer on E5: E3 plus Copilot licenses is enough to start the checklist below. Price E5-class licensing when you need the DLP label exclusion, automatic labeling, Insider Risk Management or Communication Compliance review of Copilot prompts. On Business Premium, read the Purview service description first: it lists neither the label exclusion nor retention of Copilot interactions for Business plans.

Restricted Content Discovery. Restricted SharePoint Search (RSS), an allow-list of up to 100 sites that was never a security boundary and limited organization-wide search for everyone, is retiring: new enablement has been blocked since 31 July 2026 (Microsoft Learn), and Microsoft's message center notice MC1395311 sets full retirement for 31 January 2027, with no extensions and no automatic migration of RSS settings (MC1395311). If your tenant relies on it, content it hid can become discoverable again unless you replace it.

Restricted Content Discovery: the temporary brake

Restricted Content Discovery (RCD) keeps one SharePoint site's content, including recently used files, out of organization-wide search and Copilot discovery, and removes the site's Copilot entry points. It does not change permissions or stop Copilot summarizing a document a user already has open, works on SharePoint sites only (not OneDrive), and on sites with more than 500,000 items an update can take over a week. Microsoft calls it "a temporary governance control" and warns that heavy use makes answers less complete (Microsoft Learn).

Restricted Access Control: the lock

Restricted Access Control (RAC) limits a site or OneDrive to members of up to 10 Microsoft 365 or Entra security groups. Everyone else loses access, even with earlier permissions or a sharing link, and Copilot and organization-wide search honor the restriction; shared and private channel sites need their own setting (Microsoft Learn).

Choosing the right control for each site

Site controls decide where Copilot looks; labels and DLP decide what it may do with a file or a prompt. Together they are the content layer of your AI guardrails.

The EXTRACT right in plain terms

The EXTRACT right ("Copy and extract content") is part of the Editor and Full control permission levels and of Encrypt-Only, but not Do Not Forward, and whoever applied the encryption always keeps it. Without EXTRACT, Copilot can point to a file but not summarize it, so Microsoft suggests encrypting without EXTRACT for content Copilot should never summarize. Plan around three gaps: a label on a site, team or group is not inherited by the files inside it; unless DLP is used in Edge, Copilot in Edge can reference encrypted content in the active tab without EXTRACT; and labels that protect Teams meetings and chats are not currently recognized by Copilot (Purview considerations for Copilot).

DLP for Copilot: four policy types and their limits

A Purview DLP policy on the "Microsoft 365 Copilot and Copilot Chat" location can do four things (DLP for Copilot):

1. Exclude labeled content. Copilot stops using files and emails with chosen labels, though they can still appear as citations. It covers stored and open files and emails sent from 1 January 2025 (not calendar invites), and needs E5-class licensing.
2. Refuse sensitive prompts. Copilot declines prompts containing chosen sensitive information types (preview, rolling out); DLP for prompts is licensed for every Copilot and Copilot Chat user.
3. Block web search for sensitive prompts. Copilot answers from internal data and skips external web search.
4. Exclude email from external senders from grounding, to reduce prompt-injection risk (preview; it checks the sender domain only).

The limits: DLP cannot scan files uploaded directly into a prompt, and a change can take up to four hours to reach Copilot. Run every policy in simulation mode first.

Yes: researchers have shown it, and Microsoft fixed it. Tenant settings cannot prevent a flaw in Microsoft's service, but they decide how much an injected instruction can reach. Indirect prompt injection, where instructions hide inside content Copilot reads, is the class to plan for.

EchoLeak in brief

The Microsoft Security Response Center (MSRC) published CVE-2025-32711 on 11 June 2025, an AI command injection flaw in M365 Copilot that "allows an unauthorized attacker to disclose information over a network," rated CVSS 9.3, Critical. Microsoft fully mitigated it in the service, customers had no action to take, and MSRC lists it as not exploited and credits Aim Labs, part of Aim Security, among its finders (MSRC). An academic case study shows the chain: one crafted email, with no click from the victim, could make Copilot leak data from its context after evading Microsoft's cross-prompt injection (XPIA) classifier (EchoLeak case study).

What you can control: blast radius, inputs and detection

MSRC describes indirect prompt injection as an inherent risk of probabilistic language models and says its data-access impact "can be deterministically mitigated using fine-grained permissions and access controls" (MSRC blog). Every overshared site you fix is also prompt-injection defense. Then:

• Treat Copilot's built-in jailbreak and XPIA classifiers as one layer; Microsoft says they may not be available in every scenario (Microsoft Learn).
• Turn on the DLP external-email exclusion (preview), which targets EchoLeak's route: mail from outside senders.
• Watch the audit log: Copilot records list every resource used for a prompt and flag detected injection (XPIADetected) and jailbreak attempts (JailbreakDetected) (audit logs for Copilot).
• Red-team the pilot: plant hostile instructions in test documents and emails and confirm what Copilot does with them.

Treat every agent and connector as a new door into your data.

• Agents. Admins approve agents under Integrated apps in the Microsoft 365 admin center (Microsoft Learn). For Copilot Studio agents, Power Platform data policies have been enforced in every tenant since early 2025: use them to require sign-in, by blocking the "Chat without Microsoft Entra ID authentication in Copilot Studio" connector, and to block HTTP requests, connectors used as tools, event triggers and unapproved publishing channels (Copilot Studio data policies).
• Connectors. Graph connectors are now Microsoft 365 Copilot connectors. Synced connectors carry an access control list on each item, so Copilot shows items only to people with access in the source system; federated connectors fetch data live through the Model Context Protocol (Copilot connectors). A connector is only as tight as the permissions mapped at setup, so review the mapping before the first crawl, and send third-party vendors the AI vendor security questionnaire before you sign.
• Channel Agent in Teams. It checks the EXTRACT right only for the person asking, so it can summarize items some channel members cannot open; DLP label exclusion and information barriers are not supported for it, and admins can turn it off (Purview considerations). Firms that rely on ethical walls should keep it off until tested.

Twelve steps with named owners, and 6–10 weeks from kickoff to a gated pilot for a 200–2,000-person tenant. Every duration is an AIDOLS planning estimate; steps 5 to 11 run in parallel once sites are tiered.

1. Name the owners (CIO or IT director; 1 week): an accountable executive plus a SharePoint admin, security lead, privacy officer and records manager.
2. Baseline the exposure (Microsoft 365 admin; 1–2 weeks): the Content Management Assessment, DAG reports and DSPM's default data risk assessment, which covers only your top 100 sites by usage and shows first results after four days (DSPM data risk assessments).
3. Tier the sites (records manager with site owners; 1 week): restricted, confidential and general, using the worksheet below.
4. Brake the restricted tier (SharePoint admin; 1 week, longer on very large sites): RCD or RAC on every restricted site, plus the DLP label exclusion if you hold E5-class licenses.
5. Remove broad grants (site owners, tracked by the SharePoint admin; 2–6 weeks): EEEU, public settings and broken inheritance, via site access reviews.
6. Secure the defaults (SharePoint admin; 1–2 weeks): restrict company-wide sharing groups and Anyone links at tenant level, require site labels at creation and default business-critical sites to RAC, as the configuration guide recommends; set link expiration too.
7. Publish labels (privacy officer with security lead; 2–4 weeks): a short taxonomy, plus an encrypted "do not summarize" label without EXTRACT.
8. Turn on DLP for Copilot (security lead; 1–2 weeks): prompts, web-search block, label exclusion where licensed and external-email exclusion, in simulation first.
9. Tighten identity (identity admin; 1–3 weeks): Conditional Access, with authentication contexts on restricted sites, and access reviews of site-granting groups.
10. Govern agents and connectors (Power Platform admin; 1–2 weeks): data policies, agent approval and a permission review for each connector.
11. Confirm the evidence trail (records manager with legal; 1 week): Copilot interactions visible in Audit (Standard), a retention decision and one test eDiscovery search.
12. Pilot, red-team and expand in waves (CIO or IT director; 4–8 week pilot), starting with departments whose sites pass the gates.

Template: the site-tiering worksheet

A restricted or confidential row is done when it shows no EEEU or public setting, a label, two or more owners and a named reviewer.

Template: the one-page Copilot rule for staff

Our lesson on writing a one-page AI ground rule explains why one page beats a long policy at the moment someone pastes. For Copilot, six lines:

• Use it for: three named tasks, such as meeting follow-ups and first drafts from approved templates.
• Green: documents already published or shared with your whole team.
• Red: named document types that never go into a prompt or onto a broad site, such as client matter files, patient records and payroll.
• Amber: ask the privacy officer, who answers within one working day.
• Check: every figure, citation and name in a Copilot draft is traced to its source before it leaves.
• Report: if Copilot shows you something you should not see, send IT the link and do not forward the content. Those reports are how oversharing gets found.

Not a clean tenant, but a closed restricted tier and a way to see what Copilot touches. Microsoft's own sequence puts interim protections (Restricted Content Discovery and DLP) before remediation and removes them once permissions are fixed (configuration guide).

The seven gates

These gates are an AIDOLS planning standard, not a Microsoft requirement:

1. Every restricted-tier site is reviewed or behind RAC or RCD.
2. No restricted-tier site has EEEU or a public setting.
3. Labels are published and the DLP prompt policy is on.
4. Audit is confirmed and a retention decision for Copilot interactions is recorded.
5. Pilot users are trained on the one-page rule.
6. A named person reviews DSPM and the audit log every week.
7. An incident path exists: who staff tell when Copilot surfaces something it should not, and who fixes it, by when.

Expanding in waves, and the first 30 days

Add departments one at a time, each when its sites pass gates 1 and 2 and its managers have named the workflows Copilot should help with; our Microsoft Copilot adoption plan covers that side. For the first 30 days, watch audit records that touch restricted-tier files, injection and jailbreak flags, and DLP matches. Measure adoption with the Copilot usage report, not audit data, which Microsoft says is not intended for usage reporting (Purview considerations).

No statute names Copilot, but privacy and professional rules converge on need-to-know access, security proportionate to sensitivity, an impact assessment where the law requires one, and records you can show. Oversharing remediation is the evidence. This guide is general information, not legal advice; check your regulator's or law society's current guidance before relying on it.

Canada. A tenant-wide Copilot rollout is likely to be treated as a section 3.3 information-system project, so ask your person in charge of the protection of personal information to decide early and record it in an AI risk assessment. Canadian prompts may be processed in the US, the EU or other regions (Microsoft Learn), and Microsoft does not expect local inferencing for Canada until 2027 (Microsoft Copilot blog), so cover data residency in a section 17 assessment too. Our guide to Canadian AI compliance under PIPEDA and Law 25 has the wider picture.

EU. Article 4 has applied to deployers, including any organization using Copilot internally, since 2 February 2025; the Digital Omnibus amendments entered into force on 27 July 2026 (Regulation (EU) 2026/1744), and supervision and enforcement apply from 2 August 2026 (see our EU AI Act compliance overview). EU users' Copilot traffic stays within the EU Data Boundary, except for Anthropic models offered inside Copilot (Microsoft Learn).

Healthcare. Microsoft offers a Business Associate Agreement that lists Microsoft Copilot and Copilot Chat as in scope for commercial and GCC customers, but states that using its services "doesn't on its own achieve HIPAA compliance" (Microsoft: HIPAA offering). A clinic-wide site full of referral letters is still an access-control problem once the BAA is signed.

Law firms. Rules vary by state and law society, so check yours. Information barriers restrict collaboration in Teams, SharePoint and OneDrive, but Microsoft's page on Purview protections for Copilot does not list them and Channel Agent in Teams does not support them, so test your ethical walls with Copilot before the pilot. Our guide to AI training for law firms covers the people side.

Put it on a calendar with owners; posture drifts as people create sites and share files.

• Weekly (security lead): review DSPM, Copilot audit flags and DLP matches.
• Monthly (SharePoint admin): rerun the Content Management Assessment and act on inactive sites.
• Quarterly (identity admin and site owners): Entra access reviews of the groups that grant site access (Microsoft Learn); site access reviews of restricted sites; RCD off fixed sites.
• Twice a year (records manager): test an eDiscovery search and a retention deletion.

Five metrics show whether it is working: restricted-tier sites with no EEEU or public setting (target: all), label coverage on restricted and confidential sites, sites under interim controls (should fall monthly), sites with two or more owners, and DLP matches per 100 Copilot users as a trend.

Microsoft features and licensing change, as the Copilot rename, the RSS retirement, DSPM replacing DSPM for AI and Graph connectors becoming Copilot connectors show, so re-read the documentation quarterly and date your internal guidance. The AI governance maturity model shows where Copilot controls sit in a wider program, and the free AIDOLS AI Governance Charter names seven governance roles and three risk tiers you can adapt.

• A small firm with a few well-run sites. Run the light version (baseline, remove EEEU, DLP prompt policy, staff rule); all 12 steps may cost more than the risk they remove.
• No Copilot licenses yet. SAM arrives with the first Copilot license, but write the staff rule now: Copilot Chat already grounds on mail and a bounded set of files in Outlook.
• Restricted data mixed into sites you cannot split quickly. Keep those users out of the pilot rather than leaning on a temporary control for months.
• Content that must stay searchable but out of Copilot, without E5-class licenses. The DLP label exclusion is the clean way; encryption without EXTRACT keeps Copilot to a link but also stops people copying text, so each site becomes a trade-off.
• No named workflow. Governance without a use case is cost without value; map one workflow first.
• Prompts that must be processed in Canada before 2027. Microsoft's stated timeline does not meet that; our Copilot vs ChatGPT Enterprise vs Claude comparison covers where each alternative stores data and runs inference.

With even one Copilot license, run the Content Management Assessment this week; it shows how big the cleanup is. Then pick the next step:

• Staff who use Copilot safely. The AI Fluency course is vendor-neutral, and every written lesson is free to read with no sign-up. Paid enrollment adds guided builds, cohort office hours, a graded capstone, and roster and completion reporting for organizations, useful evidence of AI literacy measures. Individual enrollment is not open yet; organizations can ask about a cohort.
• A use case worth governing. The free workflow map covers one workflow: AI agents interview the 2–3 people who run it, and within three business days you get a one-page map and a written verdict on what each bottleneck needs (software, a process change, or AI). No obligation.
• A second opinion. Book a 15-minute call to walk through your baseline and gates.

We are model- and solution-agnostic and build training around each team's own tools and tasks. AIDOLS works within each client's SOC 2, HIPAA or PIPEDA regime.