The Guest Link You Forgot Is Now a Copilot Answer

Microsoft 365 Copilot is being sold to UK small firms as a productivity assistant that reads your email, chats, files and meetings so you don't have to. That is broadly true. What is less often said is that Copilot only shows what the signed-in user already has permission to see. On paper, that sounds reassuring. In practice, many small businesses have spent years giving "everyone" access to far too much. A folder that was meant to be a quick share in 2021 is still open. A guest link for a contractor still works. A Teams channel still contains the files from a project that finished two years ago. Copilot turns those old decisions into instant answers. If your SharePoint is a messy filing cabinet, Copilot is a very fast assistant who has read every file and will happily summarise the lot.

Copilot respects permissions, not your intentions

It is worth being precise: Copilot does not break permissions. It inherits them. If a member of staff can open a file in SharePoint or OneDrive, Copilot can use that file to answer their question. If they cannot open it, Copilot should not surface it. The risk is not that AI magically leaks data. The risk is that your permissions already allow more sharing than you realised, and AI makes that sharing far easier to discover.

A common example in small firms is the finance folder. It was set up so the managing director, the bookkeeper and the office manager could all get to the invoices. Over time, the whole company was added as members because it was easier than explaining why not. Nobody complained, because nobody had a reason to go looking. Then Copilot arrives and someone asks, "What did we spend on software last quarter?" and gets a tidy answer drawn from files they probably should not have been able to read. That is not a Copilot bug. It is a permission decision that was made casually and never revisited.

Where oversharing tends to hide

In most small Microsoft 365 tenants, the same handful of problems come up again and again. The first is the "Anyone with the link" share. These are links that can be opened without signing in, and they are easy to create and easy to forget. The second is the "People in your organisation" link, which feels safer but still means every member of staff can open the file if they have the URL. The third is stale guest access: contractors, former partners and one-off suppliers who were invited to a site or team and never removed.

The fourth is broad site membership. Owners and members are often added generously because small firms value a flat, friendly culture. That is understandable, but it means a site intended for the leadership team can end up readable by everyone. The fifth is the long tail of old sites, test sites and duplicate project sites that nobody owns. If a site has no clear owner, it is a permission risk by default.

A three-list audit you can finish in an afternoon

You do not need a security consultancy to make a start. For a small firm, a practical pre-AI permission audit can be built around three lists.

1. The site list

Open the SharePoint admin centre and list every active site. For each one, write down the owner, the purpose and whether it should still exist. Mark each site as keep, archive or delete. If nobody can tell you who owns a site, that is the first thing to fix. A site without an owner is a site where permissions drift.

2. The guest list

In Microsoft Entra ID, review the guest users. Look for accounts that have not signed in for 90 days or more, and for names nobody recognises. Check Teams guests as well, because a guest in Teams often has access to files in the underlying SharePoint site. Where guest access is still needed, set an expiry date so it does not become permanent by accident.

3. The sharing link list

Use the sharing reports in the Microsoft 365 admin centre and the "Manage access" screens in SharePoint and OneDrive. Look for anonymous links and organisation-wide links on files that contain anything sensitive. Close the ones that are no longer needed. Where a link is still required, replace a broad link with one that is limited to specific people. It takes longer to set up, but it is much easier to defend later.

Do not try to fix everything at once. Fix the files that would embarrass you if they appeared in a search result. For most small firms, that means HR, payroll, legal advice, board papers and client contracts with confidentiality clauses.

The noticeboard test and the no-go list

A simple rule helps staff make better decisions without needing a policy document. Ask: if you would not pin this file to the staff noticeboard, Copilot should not be able to answer from it. That is the noticeboard test. It is blunt, but it works.

Then create a short no-go list for Copilot. This is not a technical setting; it is a list of topics and file areas that should be restricted by permissions before Copilot is switched on. Typical entries include HR files, disciplinary records, redundancy planning, salary details, legal advice, board minutes, credentials and any client data that is subject to a confidentiality agreement. Move those files into a site with a small, named membership. Remove broad links. If you use sensitivity labels, apply them, but do not wait for a labelling project to finish before you fix the basics.

Before you switch it on

Pilot Copilot with a handful of users, not the whole company. Ask them to test prompts that could reveal oversharing, such as "summarise files about pay" or "what do we know about the redundancy process?" If the answers include files that should have been restricted, you have found a permission problem worth fixing. That is a useful result, not a failure.

Also remind staff that Copilot can draft emails and summaries using information they can access. It is still their responsibility to check what goes out. A short briefing is usually enough: Copilot is a helper, not an authority.

The boring bit is the point

The success of a Copilot rollout in a UK small business is less about clever prompts and more about tidying the filing cabinet first. A permission audit is not glamorous. It involves lists, owners and a few awkward questions about why a folder was shared so widely. But it means Copilot gives useful answers with fewer surprises. If you would like help running a pre-Copilot permission review across your Microsoft 365 tenant, 25Seven IT can work through the site list, guest list and sharing links with you.