Copilot didn't create your permissions problem. It just made it searchable.
The day Copilot is switched on, a decade of ad hoc cumulative SharePoint sharing decisions becomes an exposure. This is an assessment of what your staff can find now that Copilot is turned on, and what to do about it before someone finds it by accident — or intentionally.
The self-check is answered from your own tenant. Nothing is submitted to us unless you ask for the written interpretation.
Five minutes, your own tenant
Go and look at one thing to see the exposure
- 1Open the SharePoint admin centre and sort your sites by the date they were created.
- 2Pick any site that holds client work.
- 3Open its sharing settings and look for “Everyone except external users”.
If it is there, every licensed person in the firm can now ask a question and get an answer drawn out of that site. Nobody granted that deliberately. It was the default option that made assigning permissions internally easier, and it was set back when finding anything required knowing it existed.
Implications of SharePoint permissions
Access is granted once, and kept forever
Permission handed out for one file on one matter persists for years. Before Copilot, browsing never surfaced it. Now a prompt does.
Labels published, never applied
Sensitivity labels that exist but sit unapplied give you nothing to enforce against. Restricting Copilot after the fact then becomes a blunt instrument that staff work around.
No record of what was surfaced
Without audit retention configured and reviewed, you cannot answer the question a client or an insurer will eventually ask: what did it return, to whom, and when?
What the assessment does
Fixed scope, fixed price. Remote, against your tenant, with read access granted for the engagement and revoked at the end.
What is covered
What you keep
What we won't recommend
A great deal of what gets recommended after an assessment like this sits behind Microsoft licence tiers a smaller company will never buy. We scope to what Business Premium and Business Standard actually include.
We'll say plainly when a control you have been sold on requires an upgrade — what it would cost, and whether it is worth it for a firm your size.
Fixed scope and a fixed price, both agreed on a short call before any work starts. Tenants above roughly 100 seats, or with more than one tenant in play, are scoped separately.
What happens after
A permission map is accurate on the day it is produced and starts ageing immediately. New sites get created, matters close, people change roles, and the sharing decisions that created the original exposure carry on being made.
Ongoing governance monitoring picks that up: new over-broad shares and anonymous links flagged as they appear, label coverage tracked against the plan, and Copilot audit retention checked so the record is there if it is ever asked for. You get a monthly exception report rather than a dashboard nobody opens.
It is not a condition of the assessment, and the permission map and remediation plan are yours regardless.
Book the assessment
Fixed price, fixed scope, delivered remotely against your tenant. Send the details below and we will confirm scope and the price on a short call before any work starts.
Start with the self-check
Six questions about your own tenant. You get a rating and a plain explanation of what it means, on the spot, without handing over an email address.
Or call (02) 8313 0464 and talk it through first.