AI
Is your SharePoint ready for Microsoft 365 Copilot? A 10-point checklist
By the Trigno team · · 6 min read
Microsoft 365 Copilot answers questions using the files and messages each person already has access to. That is reassuring, and also the problem: in most organisations, people have access to far more than anyone realises. Before you roll Copilot out, work through this checklist.
Why SharePoint matters so much for Copilot
Copilot respects your existing permissions. It will not show someone a file they cannot open. But if a salary spreadsheet was shared with “Everyone” three years ago, Copilot can find it and summarise it in seconds. And if your libraries are full of old versions, Copilot may answer from the wrong one.
The checklist
- Find content shared with “Everyone” or “Everyone except external users” and tighten it, starting with HR, finance and board folders.
- Review sharing links, especially “anyone with the link” links that have never expired.
- Make sure every site has a named, current owner who is responsible for who has access.
- Archive or remove stale content: old projects, duplicates and “Final_v7” files that confuse answers.
- Mark one current version of key documents such as price lists, policies and templates, and move old versions to an archive.
- Apply sensitivity labels to confidential content so it is protected wherever it goes.
- Restrict search for sites that should not feed Copilot at all. SharePoint Advanced Management includes options for this.
- Check Teams: files shared in chats and channels live in SharePoint and OneDrive too.
- Test with real questions: ask Copilot the 20 questions your staff will ask, as different users, and check what it finds.
- Train champions in each team to spot and report bad answers or unexpected access.
Tip: You do not need to fix everything before starting. Fix the sensitive areas first (HR, finance, leadership), then pilot Copilot with one team while you tidy the rest.
What good looks like after the clean-up
- Access matches people's roles, and every site has an owner.
- Copilot answers from current, approved documents and cites them.
- Sensitive files are labelled and stay protected.
- You can measure adoption and time saved per team, so the licences pay for themselves.
Common questions
Can Copilot see files I don't have access to?
No. Copilot works within each user's existing permissions. The risk is that many people have access to files they shouldn't, which Copilot makes easier to find.
How long does Copilot readiness take?
For a small or medium business, typically two to four weeks: scan and fix the sensitive areas, tidy key libraries, then test with real questions.
Do we need extra licences to secure SharePoint?
Basic permission clean-up uses tools you already have. Some advanced controls, such as SharePoint Advanced Management and sensitivity labels, depend on your Microsoft 365 plan; check what yours includes.