# Copilot readiness starts with permissions, not prompts

> Microsoft 365 Copilot can see whatever each user can see. Fix oversharing before rollout, or Copilot will surface it for you.

By Abdul Basit · Published 2026-10-20 · Category: Copilot
Source: https://kaizenai.systems/blog/copilot-readiness-permissions-first/

The most common surprise in a Microsoft 365 Copilot rollout has nothing to do with AI. It is **permissions**.

Copilot answers using the content each user already has access to. That is the right design, but it means every overshared SharePoint site, "Everyone except external users" link and forgotten Teams channel suddenly becomes *very easy to find*.

## A short readiness checklist

1. **Find overshared content.** Start with sites shared to large groups or the whole organisation, and with "anyone" links.
2. **Fix ownership.** Every site and team needs an accountable owner. Orphaned sites are where oversharing lives.
3. **Label what is sensitive.** Use Microsoft Purview sensitivity labels on HR, finance and legal content so protection travels with the file.
4. **Pilot with a small group.** Choose people with real, repetitive knowledge work and track what they use Copilot for.
5. **Measure adoption, not licences.** A licence that nobody uses is the most expensive kind.

## Then build on it

Once the foundations are sound, the high-value work begins: **Copilot Studio agents** grounded in your own processes, and **Cowork** for multi-step tasks such as preparing a client briefing from CRM, email and meeting history.

---

*Want a readiness review? [Get in touch](https://kaizenai.systems/contact/?topic=Copilot%20%26%20Cowork).*