We talk to a lot of organisations about SharePoint permissions, and increasingly those conversations are connected to Microsoft 365 Copilot. Sometimes an organisation is preparing for its first Copilot rollout, while others already have Copilot in use and are now taking a closer look at how their existing SharePoint permissions could affect what users are able to discover.
There is an important distinction to make here. Copilot doesn’t bypass SharePoint permissions. If a user doesn’t have permission to access a document, Copilot doesn’t suddenly give them access to it. The concern is the content that users can already access, but perhaps shouldn’t be able to.
That’s not a new SharePoint problem. Anyone who has managed a reasonably large SharePoint environment will know how permissions evolve over time. Sites are created for projects, people change roles, contractors come and go, content gets shared, Microsoft 365 Groups change membership and links are created for people inside and outside the organisation. Five years later, working out exactly who has access to a particular piece of content — and more importantly, whether they should still have access — isn’t always straightforward.
Copilot makes that existing problem more important because it changes how people find information. Previously, having permission to a document didn’t necessarily mean you were ever going to find it. You might not know the site existed, let alone the document. With Copilot, information that was technically accessible but practically buried can be much easier to surface.
So when people talk about being “Copilot ready”, I think SharePoint permissions need to be part of that conversation.
Do you actually know who has access?
One of the first things I would want to establish is how easily the organisation can answer a seemingly simple question: who has access to what?
In SharePoint that access can come from several places. A user might have direct permissions, inherit them from a site or library, be a member of a SharePoint Group or Microsoft 365 Group, or have access because somebody shared a file or folder with them. There may also be external users and sharing links to consider.
For a single site, investigating that might be manageable. Across several thousand sites, it becomes a very different exercise.
There’s also a second part to the question which is just as important: How does that person have access? Knowing that Sarah can access the Finance Forecasts site is useful, but understanding whether she has direct access, belongs to a group or received a sharing link gives you the context you need to do something about it.
IT doesn’t necessarily know who should have access
This is something I think gets overlooked in discussions about Copilot readiness.
A SharePoint Administrator can investigate how Sarah has access to the Finance Forecasts site. What they probably can’t tell you is whether Sarah should have access to it.
The Finance team can.
This becomes a real problem at scale. If you have 5,000 SharePoint sites, central IT can’t realistically understand the business purpose of every site, who should have access to its content, which external users are legitimate or whether a permission granted three years ago is still needed.
That’s why I think Site Owners have an important role to play in Copilot permissions readiness. IT and Security need the overall visibility and governance, but the people who own the content need to be involved in deciding whether access is appropriate. The challenge is giving those Site Owners enough information to make that decision without expecting them to become SharePoint permissions experts. This is one of the core problems we see repeatedly with large SharePoint estates.
External sharing is another area I’d look at closely
Most organisations need to share information externally. There’s nothing inherently wrong with that. The difficulty is knowing whether access that was appropriate when it was granted is still appropriate today.
A supplier may have needed access during a project two years ago. A contractor may have finished. A customer may have been given temporary access to a folder. Someone may have created an Anyone link and forgotten about it.
The useful questions aren’t simply “Do we allow external sharing?” or “How many guest users do we have?” I’d want to know which external users have access, what they can access, how that access was granted and whether somebody in the business still considers it necessary.
Again, that’s not specifically a Copilot problem. It’s an existing access-governance problem that becomes more relevant when you’re introducing a tool designed to make organisational knowledge easier to find.
The scale of the problem matters
One of the things we hear from customers is effectively: “We know our permissions are in a mess, but where do we even start?”
That’s understandable. An organisation might have thousands of SharePoint sites and millions of documents. Telling them to “review their permissions before rolling out Copilot” isn’t particularly helpful unless there’s a realistic way of doing it.
I don’t think the answer is necessarily to audit every permission on every document. A more practical approach is to understand the estate, identify where the greatest risks are, prioritise those areas and involve the relevant business owners in reviewing them.
And importantly, you need to be able to act on what you find.
We’ve all seen audits that result in an enormous spreadsheet of things somebody should investigate. Six months later, the spreadsheet still exists and the underlying permissions haven’t changed. A useful Copilot permissions-readiness process needs to get beyond reporting and into review and remediation.
So, how ready are your SharePoint permissions for Copilot?
There isn’t a single score or setting in Microsoft 365 that can tell you that your SharePoint environment is “Copilot ready”. Permissions are also only one part of the wider security and governance considerations around Copilot.
But I think there are some useful indicators.
Can you reasonably establish who has access to important content and understand why they have that access? Do you know where external access and sharing links exist? Can you identify areas that warrant further investigation? Are Site Owners involved in validating access to their content? When you find inappropriate access, can you remediate it efficiently? And do you have a process for reviewing these things again, rather than treating this as a one-off Copilot project?
If you’re unsure about some of those answers, we’ve created something that might help.
Copilot Permissions Readiness Assessment
We’ve put together a free Copilot Permissions Readiness Assessment based around six areas we think organisations should consider: permissions visibility, oversharing and risk, external access and sharing, Site Owner governance, remediation capability and continuous access governance.
It takes a few minutes to complete and gives you a score for each area, along with an overall readiness score and some recommendations about where you may want to focus.
It’s not intended to certify that your Microsoft 365 environment is secure or that you’re officially “Copilot ready”. It’s simply a useful way of thinking through the permissions side of Copilot readiness and identifying areas you might not yet have considered.
Where does DeliverPoint fit?
DeliverPoint is the technology we use to help organisations put much of this into practice.
It provides permissions reporting across SharePoint and Microsoft 365 so that you can investigate who has access and how that access has been granted, including direct and inherited permissions, group membership, external users and sharing links.
Where I think it becomes particularly useful for Copilot readiness is at scale. Rather than central IT manually visiting individual sites, DeliverPoint provides visibility across the estate and can help organisations focus their attention where it’s needed. Site Owners can then be brought into the process because they’re the people who actually understand the content and whether the access being reported is appropriate.
Once something has been identified, DeliverPoint can also be used to remediate permissions rather than leaving the findings sitting in a report. And because Microsoft 365 never stands still, the same reporting and review processes can be repeated over time.
That’s really how we see Copilot permissions readiness. It’s not a project to make every SharePoint permission perfect before somebody switches Copilot on. It’s about getting to the point where you understand your access well enough to identify problems, involve the right people in reviewing them, fix what needs fixing and have a sensible process for doing it again.
If you want to see where you currently stand, the Copilot Permissions Readiness Assessment is probably the best place to start:
