Before you switch on Microsoft Copilot, ask your IT provider one question
Before any firm we work with enables Microsoft Copilot, we suggest sending the people who manage your Microsoft 365 environment a single question:
“Can you show me every file in our tenant that’s currently accessible to more than ten people?”
If a useful report lands in your inbox within a few days, your environment has been actively managed. If the reply is “we’d need to enable a few things first,” that itself is the answer to your Copilot readiness question. The audit needs to happen before the trial does.
Why this matters for a professional services firm
Copilot answers questions and drafts content by reading files, emails and chats through each user’s existing Microsoft 365 permissions. The phrase in Microsoft’s own documentation is short: Copilot can only summarise content the user is authorised to access.
That sounds reassuring. The problem is the gap between what your users should be able to access and what they actually can. In most firms we look at, that gap has widened quietly over years of staff turnover, ad hoc Teams channels, client folders shared during a deal and never revoked, and external sharing links that never expired.
For a manufacturer, this matters but the consequences are usually contained. For a solicitor, accountant or financial adviser, the files are the product. Client matters, settlement amounts, fee notes, deal terms, payroll figures. The confidentiality of that material is the business. And it’s often sitting in folders that were never properly scoped.
What Copilot will happily return
A few examples of the sort of answer Copilot can give in an unaudited tenant:
- “What’s everyone’s salary?” – returns the pay file HR shared with a hiring partner eighteen months ago and never recalled.
- “Summarise the Henderson matter.” – pulls content from a SharePoint site set up for a different team, because someone added during a one-off project two years ago still has read access.
- “What’s our markup on the O’Brien engagement?” – surfaces the pricing sheet that was shared during a proposal review and never re-secured.
- “Find everything mentioning [former partner].” – surfaces termination correspondence, severance figures, the performance file. Material that was never meant to be findable below partner level.
Whether anyone would ask these queries is a separate question from what Copilot can return. Microsoft’s own deployment guidance is built around the second question.
The “small pilot” trap
A pilot with three or four people feels like a safe middle ground. In practice, those three or four are almost always senior, which means their access is the widest in the firm. A pilot with three partners produces a higher-risk preview of Copilot than a pilot with three trainees.
Pilots also drift. Licences get reassigned to whoever asks next, which isn’t the same as whoever has the most appropriate access profile.
What we do before any rollout
Four pieces of work, usually four to eight weeks for a firm of 25 to 100 people.
- A SharePoint sharing audit.
The Advanced Management report surfaces inactive sites, oversharing patterns and broken permission inheritance. If this has never been run on your tenant, this is where we start. - An external share review.
Files sent to clients for review and never recalled are particularly common in legal and accountancy work. - A Teams membership review.
Channels that grew during a busy project are a frequent source of unintended access. - Sensitivity labels for confidential content.
Without Microsoft Purview labels in place, Copilot has no way to treat a client settlement memo differently from a catering invoice.
Some of this is engineering work we can do for you. The judgement calls – which document categories deserve which label – are best made with input from the partners who understand the material.
The soft landing
If your tenant has been actively managed, this might be a couple of weeks of tidy-up before you switch Copilot on. If it hasn’t, the audit is the most useful thing you can do before any AI tool gets near your data, whether you eventually roll out Copilot or not.
If you’d like a second set of eyes on your tenant before you click “start trial,” we’re happy to take a look.