Skip to main content

Buyer guide

Microsoft Copilot Data Readiness & Oversharing Checklist

Check Copilot's access and retention before enabling answers from work data. Review SharePoint and Purview controls alongside the model settings.

Reading time
2 min read
Sources
13 cited
In this piece
Microsoft Copilot−3 Mixed

Check what Copilot can read before assigning licenses. It uses anything the user can open and stores interactions with other Microsoft 365 content under your retention policies. Some models process data outside the EU Data Boundary. Decide the permitted processing locations before rollout.

When you need this

  • Security or legal asks what Copilot can see, how long prompts are kept, and whether data leaves your region.
  • You are about to assign paid licenses that ground Copilot in Microsoft Graph.
  • You operate in the EU, EFTA, or UK, or under sector rules on where data is processed.

Evaluation criteria

  1. Access: what Copilot can read

    Is every site and file a user can open one they should open?

    Look forFind overshared sites with SharePoint Advanced Management reports. Copilot answers from any content a user can already open. Restrict content discovery on high-risk sites and reduce Anyone links. Tony Redmond's late-2026 advice is to buy a few licenses first, since they turn these tools on, and to clean up SharePoint before a full rollout.

  2. Labels and DLP

    Will sensitivity labels and DLP keep confidential content out of answers?

    Look forApply sensitivity labels by default where the plan allows and configure DLP for Copilot. One Reddit admin labels everything because preventing sharing proved too hard. Another warns that staff label documents public to evade restrictions. Check actual use of labels.

  3. Training and storage

    Are users covered by enterprise data protection?

    Look forRequire work-account sign-in for enterprise data protection. Microsoft excludes prompts, responses, and Graph data from foundation LLM training. Interactions stay with other Microsoft 365 content. Copilot services opt out of Azure OpenAI abuse monitoring.

  4. Retention and eDiscovery

    Have you set how long Copilot interactions are kept?

    Look forSet Purview retention policies for Copilot interactions and enable audit. Use Content search for review. State in the use policy that admins can see prompts and responses through these tools.

  5. Models and region

    Which model providers may process your prompts, and where?

    Look forReview the subprocessor toggle with an AI Administrator or Global Administrator. Anthropic models default to on for most commercial tenants outside the EU, EFTA, and UK and fall outside the EU Data Boundary. Some advanced Anthropic models that retain data fall outside Microsoft's customer agreement. Cowork can use Anthropic models, and admins can disable individual models.

  6. Agents and new features

    Who approves agents and features before users see them?

    Look forRequire admin approval for organization-built agents and review the Agent Registry. Check new features against the data protection impact assessment. One admin redid a DPIA after Copilot Chat added conversation history.

Questions to ask vendors

  1. Which sites would we put under restricted content discovery today?
  2. Do our retention policies cover Copilot interactions, and does legal agree with the period?
  3. Should Anthropic models be on for our tenant, given where they process data?
  4. Who reviews new Copilot features in the Message Center before they reach users?

Red flags

  • Skipping the permissions cleanup because Copilot grants no new access.
  • Users signing in to Copilot with personal accounts, outside enterprise data protection.
  • Anthropic models left at their default without a decision from privacy and legal.
  • No retention policy for Copilot interactions.

Products in this piece

Sources

Official documentation
8
Public source
5
  1. Microsoft Learn: Data, privacy, and security for Microsoft CopilotOfficial documentationlearn.microsoft.com
  2. Microsoft Learn: Enterprise data protection in Microsoft Copilot and Microsoft Copilot ChatOfficial documentationlearn.microsoft.com
  3. Microsoft Learn: Overview of Microsoft Copilot ChatOfficial documentationlearn.microsoft.com
  4. Microsoft Learn: SharePoint Advanced Management overviewOfficial documentationlearn.microsoft.com
  5. Microsoft Learn: Prepare for Microsoft Copilot by comparing E3, E5, and E7 license featuresOfficial documentationlearn.microsoft.com
  6. Microsoft Learn: Anthropic models in Microsoft Online ServicesOfficial documentationlearn.microsoft.com
  7. Microsoft Learn: Copilot Cowork FAQOfficial documentationlearn.microsoft.com
  8. Microsoft Learn: Manage agents in the Microsoft 365 admin centerOfficial documentationlearn.microsoft.com
  9. Microsoft 365 for IT Pros: Preparing a Microsoft 365 tenant for Copilot in late 2026, by Tony Redmond (Sep 4, 2026)Public sourceoffice365itpros.com
  10. Reddit r/sysadmin: Pre-enterprise rollout of Copilot, mitigating oversharing links (Jun 19, 2025)Public sourcereddit.com
  11. Reddit r/sysadmin comment on auditing sharing links before enabling Copilot (Jun 22, 2025)Public sourcereddit.com
  12. Hacker News comment from an M365 admin on SharePoint agents switched on by default (Oct 5, 2025)Public sourcenews.ycombinator.com
  13. Reddit r/sysadmin comment on tracking Copilot use in Microsoft Purview (Jan 17, 2025)Public sourcereddit.com

Keep reading

  1. Buyer guideMicrosoft Copilot Rollout PlaybookClean up overshared sites first, then pilot paid licenses with champions on named tasks and reassign them by measured use.
  2. Buyer guideChoosing Microsoft Copilot Licenses: Chat, Business, Enterprise, or E7Match each group's data and agent needs to Copilot Chat, Microsoft 365 Copilot Business, the enterprise add-on, or Microsoft 365 E7.
  3. Buyer guideMicrosoft Copilot Agents & Credits Cost ControlsControl who builds and publishes agents. Separate included use from metered Copilot Credits, then set billing policies and budgets.
Read the research