AI assistants are now bundled into products most businesses already pay for. They're useful. They also change what your existing permissions mistakes cost you.
The permissions problem
Microsoft 365 Copilot can only see what the user can see — which sounds reassuring until you check what your users can actually see. In most tenants we audit, there is at least one site or folder shared far more widely than anyone intended. Before Copilot, finding it required knowing it existed. Now you can just ask.
Questions to answer first
- Who can see HR, payroll and finance content? Fix that before enabling anything.
- Where is the data processed, and is that in your privacy notice? If personal data is involved, this belongs in your record of processing.
- Is the output being checked? These tools state incorrect things confidently. Fine for a first draft, not for advice to a customer.
- What are staff pasting in? A free consumer AI account is not a safe place for client data. Give people a sanctioned tool so they don't use an unsanctioned one.
We run a permissions review before turning these features on, which usually turns up a few surprises worth fixing regardless.