Is Your Business Ready for Microsoft Copilot? A Data Security Checklist for Australian SMBs

Summary

This guide helps you troubleshoot and resolve: Is Your Business Ready for Microsoft Copilot? A Data Security Checklist for Australian SMBs. Follow the steps below to fix the issue.

Common Causes

Microsoft Copilot can transform how your organisation works by surfacing insights across Microsoft 365, but it can only access data that your users already have permission to see. For Australian small and medium businesses, enabling Copilot without first reviewing SharePoint and OneDrive permissions risks exposing sensitive financial records, employee details, and client information. This checklist will help you audit and secure your data governance before you roll out Copilot to your team.

Quick Fix Steps

1. Run a permissions audit across SharePoint and OneDrive.
2. Remove broad access links and guest permissions where no longer needed.
3. Apply sensitivity labels to confidential documents.
4. Review and tighten external sharing settings.
5. Test Copilot access with a pilot group before organisation-wide rollout.

Detailed Instructions

Step 1: Audit SharePoint and OneDrive Permissions

1. Sign in to the Microsoft 365 admin centre using your global administrator account.
2. Navigate to SharePoint in the left-hand menu.
3. Select Active sites and review each site collection for unique permissions.
4. For OneDrive, select OneDrive from the admin centre menu, then review User files and individual site permissions.
5. Identify any folders or libraries with Full Control or Edit permissions assigned to Everyone or All Authenticated Users.

Step 2: Remove Broad Access Links

1. In the SharePoint admin centre, go to Policies > Sharing.
2. Review the External sharing settings for SharePoint and OneDrive.
3. Disable Anyone links where possible, or restrict them to specific domains.
4. Search for existing Anyone links using the Sharing reports and remove those pointing to sensitive folders.

Step 3: Apply Sensitivity Labels

1. Open the Microsoft Purview compliance portal.
2. Go to Information protection > Labels.
3. Create labels such as Confidential, Internal Only, and Public.
4. Configure encryption and access restrictions for the Confidential label.
5. Publish the labels to your users via Label policies so they can apply them in Word, Excel, PowerPoint, and Outlook.

Step 4: Review External Sharing and Guest Access

1. In the Microsoft 365 admin centre, select Settings > Org settings > SharePoint.
2. Under External sharing, ensure guest access is limited to trusted partners only.
3. Review Azure Active Directory (now Microsoft Entra ID) > External Identities for guest users who no longer require access.
4. Remove guest accounts for former contractors or completed projects.

Step 5: Pilot Copilot with a Controlled Group

1. Assign Copilot licences to a small pilot group first, such as IT and HR managers.
2. Monitor what Copilot surfaces during the pilot period.
3. If sensitive data appears in Copilot responses, trace the source permission and remediate it before expanding the rollout.

Troubleshooting

Copilot is not appearing in Microsoft 365 apps

• Confirm the user has a valid Copilot for Microsoft 365 licence assigned in the Microsoft 365 admin centre.
• Ensure the user has OneDrive for Business provisioned; Copilot requires a OneDrive location to function.
• Check that the user is on the Current Channel or Monthly Enterprise Channel for Microsoft 365 Apps.

Copilot is surfacing restricted documents

• Review the document's permissions in SharePoint or OneDrive.
• Check for inherited permissions from a parent folder or site.
• Apply a sensitivity label with encryption to restrict access further.
• Use Microsoft Purview Data Lifecycle Management to review retention and access policies.

External users can still access shared folders

• Run a Sharing report in the SharePoint admin centre to identify active Anyone links.
• Revoke the links or change them to People in your organisation only.
• Audit guest users in Microsoft Entra ID and remove those without a current business need.

Taking the time to secure your SharePoint and OneDrive environment before enabling Copilot protects your business from accidental data exposure. If you need assistance auditing your permissions or configuring sensitivity labels, Open a Ticket with 220 Internet Services.

Still Having Issues?