Microsoft Copilot is built on a simple rule: it can show each person anything they already have permission to open. That’s what makes it useful, and it’s also the main risk. If an HR spreadsheet or a folder of client contracts has been shared too widely over the years, nobody may have noticed. Copilot will find it in seconds.

The good news is that the fixes are mostly housekeeping you’d want anyway. Here’s how to get Copilot ready safely, and the habits that keep it that way.

What Microsoft does with your data

With a work account, Copilot comes with Microsoft’s Enterprise Data Protection. In plain English:

Your prompts, Copilot’s answers and the files it reads aren’t used to train the AI models behind it.
Prompts and answers are stored and encrypted under the same contract terms as your email and files, and your administrator can search them and set how long they’re kept.
Copilot only shows people content they could already open. It doesn’t change anyone’s permissions.
When Copilot searches the web for you, the query goes to Bing with your name and organisation removed.

One point for UK businesses: Microsoft’s EU Data Boundary keeps processing inside the EU for EU customers, but the UK is outside it. Microsoft says customers outside the EU may have their queries processed in the US, the EU or elsewhere, and processing inside the UK is expected by the end of 2026. Copilot can also use models from Anthropic and OpenAI if your administrator allows it, and Microsoft notes that Anthropic models are currently outside the EU Data Boundary. Make those choices deliberately and record them in your data protection paperwork.

Fix oversharing before you switch it on

Microsoft’s own deployment guidance starts here, and it’s where we start with clients too. SharePoint’s default sharing settings are the most permissive option, so most businesses have more open than they think.

Review sharing settings in the SharePoint admin centre and tighten anything you don’t need, such as “Anyone” links that work without signing in.
Look for sites shared with “Everyone except external users”. That means every member of staff, and therefore every member of staff’s Copilot.
Find old sharing links to sensitive files and remove the ones nobody needs.
Hide the most sensitive sites from Copilot with Restricted Content Discovery, which keeps a site out of Copilot and organisation-wide search without changing who can open it. Microsoft includes these SharePoint Advanced Management tools with Copilot licences; check which ones your plan unlocks.

Microsoft is retiring an older setting called Restricted SharePoint Search and says it isn’t a security boundary, so don’t rely on it.

Label your most sensitive files

Sensitivity labels, such as “Confidential” or “HR only”, travel with a document. Copilot respects the protection they apply, and new content Copilot creates from a labelled file inherits the label. With the right Microsoft Purview licensing you can also stop Copilot processing files with certain labels altogether. Start with a handful of labels people will actually use, rather than a complicated scheme nobody follows.

Check what Copilot writes

Microsoft is clear that AI answers can be wrong, and asks people to use their judgement when reviewing them before sending anything on. Make that a rule:

Check figures, dates and names against the original email or file. Copilot shows where it got its answer, so click through.
Read drafts as if a new member of staff wrote them: fine as a starting point, not to be sent unchecked.
Be careful with meeting summaries of sensitive conversations, and tell attendees when Copilot is in use.

Be wary of content from outside

When Copilot summarises an email or web page, it reads whatever text is in it, including instructions hidden there by an attacker. This is called prompt injection. Microsoft has filters to catch it, but says they may not be available in every Copilot scenario, and the UK’s National Cyber Security Centre warns that prompt injection may never be fully solved.

In practice: treat summaries of outside emails and websites as information, never as instructions, and never let a Copilot answer be the only check before you pay an invoice, change bank details or share files.

Keep agents under control

Agents can search, summarise and, in some cases, take actions for people. Your administrator decides which agents are allowed under Integrated apps in the Microsoft 365 admin centre. Microsoft recommends approving agents before they’re shared across the business, giving each one a named owner, and removing ones nobody uses.

Set the rules for your team

Technology settings only go so far. Staff need to know which AI tools they can use, what must never go into them and who to ask. Our guide to AI acceptable use policies covers what to include.

Sources

Microsoft Learn: Data, privacy and security for Microsoft Copilot (8 October 2026)
Microsoft Learn: Enterprise data protection in Copilot (29 May 2026)
Microsoft Learn: Copilot deployment blueprint for oversharing (6 May 2026)
Microsoft Learn: Get ready for Copilot with SharePoint Advanced Management (16 July 2026)
Microsoft: In-country data processing for Copilot (updated April 2026) (3 April 2026)
NCSC: Prompt injection is not SQL injection (8 December 2025)
Microsoft Learn: Agents admin guide (30 September 2026)

Details are correct at the time of writing. Microsoft updates Copilot often, so check the sources above for the latest features and terms.

Want help with this in your business? Call 01787 209 003, see our cyber security service, or book a free IT consultation.

How to use Microsoft Copilot safely in your business