Microsoft 365 Copilot rollout with permissions first

Architecture and data flow

Organisation size

300–100000 employees

Data classes

confidential, personal

Constraints

Microsoft 365 already in place, with the licences Copilot requires; someone who owns SharePoint and OneDrive permissions and can correct over-sharing; agreement that content may be processed by Microsoft under the Products and Services DPA

Industries

Professional services, Financial services, Insurance, Public sector, Technology

Jurisdictions

any

No hardware profile was sized for this answer.

Change managementchange-management

operations

Compliance and governancecompliance-governance

compliance

Identity and SSOidentity-sso

security

Security hardeningsecurity-hardening

security

Workflow automationworkflow-automation

operations

Commands are copied from each project’s own documentation, and the page they came from is linked under the step. 0 of 9 steps currently open an evidence record. The rest are linked to their source; §10 says which of those documents were fetched and which were fetched without their anchor being found — two different states, named differently there.

1. 01

   Inventory what Copilot will be able to read, before anyone gets a licence

   Assessment

   Copilot answers from content the user can already open. Microsoft states it "only surfaces organizational data to which individual users have at least view permissions", and that the "Semantic Index honors the user identity-based access boundary". That is a promise about retrieval; it is not a promise that your permissions are right. Produce one list: every SharePoint site, Team and OneDrive folder shared organisation-wide or with an everyone-type group, with the file count and the named owner of each. That list is the project.

   Source documentation

2. 02

   Correct the over-shared sites and the content nobody owns

   Assessment

   Work down the list. Re-scope tenant-wide sharing, repair broken permission inheritance on the libraries that matter, and archive or delete content with no owner. Two categories cause most of the surprises: a finance or HR site opened to an everyone-group years ago, and a leaver’s OneDrive re-shared during a handover. Neither is visible while people browse for documents. Both are visible the moment retrieval is switched on. Finish this before licences are assigned, not after the first complaint.

   Source documentation

3. 03

   Give the corpus a lifecycle, or it drifts straight back

   Assessment

   A one-off clean-up decays within two quarters. Set the default sharing link so a new link is not a tenant-wide one — Microsoft documents this as a way to "help prevent users from oversharing" — require a named owner per site, put a recurring review on organisation-wide sharing, and apply retention so superseded documents leave the index instead of ageing in it. The test of success is that a site created next quarter cannot become over-shared without somebody deciding to make it so.

   Source documentation

4. 04

   Label the content that must never be summarised

   Assessment

   A sensitivity label is the one control that travels with the file. Where the label applies encryption, Microsoft states that "Copilot and agents return data from an item only if the user is granted permissions to copy" from it — so a label that withholds the extract right keeps a document out of an answer even for a reader who may open it. Label the small set that actually matters (board papers, deal files, HR cases, client matters under a duty of confidence) rather than attempting to label the estate.

   Source documentation

5. 05

   Read the enterprise data protection scope, then write down what it excludesversion-sensitive

   Assessment

   Microsoft describes organisational use of Copilot as covered by the Products and Services Data Protection Addendum and the Product Terms, "with Microsoft acting as a data processor", and states that prompts, responses and data accessed through Microsoft Graph are not used to train foundation models. The exclusions are what you write down. Web search queries leave that scope for the Bing search service, where Microsoft states it "acts as an independent data controller responsible for complying with all applicable laws and controller obligations". Decide whether web grounding stays on, and record who decided.

   Source documentation

6. 06

   Establish where prompts are processed, not only where files are storedversion-sensitive

   Assessment

   These are two different questions and only one of them is answered by your tenant location. Microsoft states that "Customers outside the EU may have their queries processed in the US, EU, or other regions", and that models provided by Anthropic as a subprocessor "are currently excluded from the EU Data Boundary". A committed in-country storage location is a separate, paid add-on: for Advanced Data Residency Microsoft states that "ADR does not impose a minimum licensing threshold; however, 100% license coverage is required to establish and maintain a data residency commitment". If a residency rule is driving this project, price that add-on before promising anything.

   Source documentation

7. 07

   Confirm the audit and eDiscovery path for prompts before the pilot

   Assessment

   Interactions are logged. Microsoft states the audit records "contain details about which user interacted with Copilot, when the interaction took place, and where it occurred", and that they "include references to files, sites, or other resources" Copilot read to generate the response. Those resource references are also your over-sharing detector: an answer grounded on a site the person should never have reached shows up in the log. Establish the retention period, the export path and who is allowed to search it — then tell employees that prompts and responses are recorded and discoverable.

   Source documentation

8. 08

   Pilot with one department and treat wrong answers as findings

   Assessment

   Thirty people, six weeks, three named tasks, and a before-and-after measure agreed in advance. Collect two lists: answers that were wrong, and answers that were correct but should not have been available to that person. The second list is the more valuable one — every entry is a permission to fix, and finding it in a pilot costs less than finding it in a subject access request.

9. 09

   Only then consider a Copilot Studio agent

   Assessment

   Copilot Studio is "a graphical, low-code studio for building and managing AI-powered agents and workflows", and it is where a department-specific assistant with its own instructions and knowledge sources gets built. Treat it as a second project: separate grounding sources, a separate billing basis, a separate review. Starting it before the tenant-wide permissions work is finished means debugging two problems at once, and the answers will not tell you which one you are looking at.

   Source documentation

Structured issue-spotting to support your own review — not legal advice. Verify against the cited primary sources and your counsel.

• A neutral enterprise assistant across mixed systems

  When the knowledge lives across Microsoft 365, Google Workspace and other systems equally, a connector-based assistant such as Glean may fit the estate better than a Microsoft-native one — at the cost of a second vendor relationship.

  • — Indexes across mixed systems rather than assuming Microsoft 365
  • — A separate vendor, contract and permissions model to run

  gleanchatgpt-enterprise

• Self-hosted, where confidentiality rules out a processor

  Where professional secrecy or a residency rule makes processing by Microsoft unattractive, run the assistant on your own infrastructure and remove the processor question entirely.

  • — No vendor in the data path
  • — You build and operate the stack, and lose the Office integration

  open-webuivllmpgvector

• Enterprise SaaSEnterprise SaaS assistant with governance controlsA business or enterprise plan from an established vendor — ChatGPT Enterprise, Microsoft 365 Copilot, Glean or an equivalent — connected to your identity provider, scoped by existing permissions, covered by a DPA, and rolled out behind a written policy.
• Self-hostedPrivate company knowledge base (self-hosted RAG)Open WebUI as the employee interface, vLLM serving a Qwen2.5-14B-Instruct model on a single 24 GB GPU, PostgreSQL with pgvector for chats and embeddings, and OIDC single sign-on — all in Docker on one server in your office or colocation rack. Ollama replaces vLLM for teams under about 20 users; a 48 GB GPU lets you run a 32B model for better answers.

Not yet in the ledger

1. Microsoft — Copilot surfaces only data the user can already see

   Vendor page

   not yet fetched

2. Microsoft — Semantic Index honours the user access boundary

   Vendor page

   not yet fetched

3. Microsoft — Microsoft Copilot and data residency

   Vendor page

   not yet fetched

4. Microsoft — Anthropic models and the EU Data Boundary

   Vendor page

   not yet fetched

5. Microsoft — Enterprise data protection in Microsoft Copilot and Microsoft Copilot Chat

   Vendor page

   not yet fetched

6. Microsoft — Copilot use is covered by the DPA with Microsoft as processor

   Vendor page

   not yet fetched

7. Microsoft — Copilot web queries go to the Bing search service

   Vendor page

   not yet fetched

8. Microsoft — Advanced data residency in Microsoft 365

   Vendor page

   not yet fetched

9. Microsoft Purview — Sensitivity labels and Copilot usage rights

   Docs

   not yet fetched

10. Microsoft Purview — Default sharing link type for SharePoint and OneDrive

    Docs

    not yet fetched

11. Microsoft Purview — Audit logs for Copilot and AI applications

    Docs

    not yet fetched

12. Microsoft Purview — Audit records name the resources Copilot read

    Docs

    not yet fetched

13. Microsoft — Copilot Studio overview

    Docs

    not yet fetched

Deployed this stack, or hit something this page does not cover? Corrections, sources and implementation reports are what keep a recipe worth reading.

If you would rather not build it, we can introduce a forward-deployed engineer who has deployed this stack before. The enquiry form starts from this recipe.