Can Microsoft 365 Copilot See SharePoint Files I Can't Open?
Want a second set of eyes?
Get a SharePoint permissions audit from our team
We review who can see what across your sites, flag oversharing before you roll out Copilot, and help you put a cleanup plan and governance in place.
The question comes up in almost every Copilot rollout: if we turn it on, will it show people files they shouldn't see? The accurate answer is a little different from the worry. Copilot doesn't get its own back door into SharePoint. It works with the access each person already has.
Can Copilot see files I can't open?
No. Per Microsoft's data, privacy and security article, Copilot only surfaces organizational data to which individual users have at least view permissions, and its semantic index honors the user's identity-based access boundary. If you can't open a file, Copilot won't return it to you.
So where does the risk come from?
From content people can open but shouldn't. Before Copilot, a salary spreadsheet in a site everyone technically had access to stayed hidden because nobody went looking. Copilot goes looking, in seconds, for whoever asks. The usual causes:
- Everyone except external users (EEEU). A built-in group that includes every internal user, and nobody outside your organization. Sites and files shared with it are open to the whole company.
- Organization-wide sharing links. A "People in your organization" link gives access to anyone inside, and links get created and forgotten.
- Broken permission inheritance. A folder with its own permissions that nobody has reviewed in years.
- Open sites and large groups. A site anyone can join, or a group with thousands of members.
What shapes what Copilot can return
| Control | What it does | Changes who can open the content? |
|---|---|---|
| Permissions and sharing links | Decide who has access in the first place. Copilot follows them. | Yes, this is the source of truth |
| Sensitivity labels with encryption | Encrypted content follows the usage rights granted to the user, per Microsoft. | Limits what a person can do with it |
| Restricted Content Discovery (RCD) | Keeps selected sites out of organization-wide search and Copilot discovery. | No, it changes discoverability only |
| Restricted Access Control (RAC) | Limits access to a site to the members of chosen security groups. | Yes |
| Agents | An agent that Copilot calls has its own privacy statement and terms; admins choose which agents are allowed. | Check each agent |
What Restricted Content Discovery does and doesn't do
Restricted Content Discovery is the switch most people mean when they ask to "hide a site from Copilot". Per Microsoft's page:
- It doesn't change permissions, and people with access can still open the content directly.
- It limits discovery of the site's content in organization-wide search and in Copilot, and Microsoft's page says that includes recently interacted files. (An older Microsoft feature table says a user's recent interaction can still surface it, so test with a real account.) It also removes AI entry points such as the Copilot button on that site.
- It doesn't remove content from the search index, so Purview features such as eDiscovery keep working.
- It doesn't affect searches that start from inside the site, or summarizing a document someone already has open.
- It's described as a temporary control for sites that need review, and Microsoft cautions against overusing it.
So it buys time. It doesn't fix the underlying problem. For that, see our guide to Restricted Access Control, Restricted Content Discovery and Restricted SharePoint Search.
Five checks you can run this week
- Run the reports Microsoft gives you: find overshared sites with Data Access Governance and the Content Management Assessment.
- Find what is shared with the whole company: audit "Everyone except external users".
- Review the links already out there: SharePoint sharing links explained.
- Check one site end to end: who has access to this SharePoint folder.
- Walk the full list: the Copilot data readiness checklist, or take the free oversharing self-assessment.
Need help before a Copilot rollout?
If you want someone to run the audit and fix the findings, see our Copilot readiness and permissions audit, or get in touch.
Related
Frequently asked questions
Can Copilot see files I don't have access to?
No. Microsoft says Copilot only surfaces organizational data to which the individual user has at least view permission, using the same underlying access controls as other Microsoft 365 services.
Then why do people worry about Copilot and SharePoint?
Because Copilot searches everything the person can open, and many people can open far more than anyone intended: sites shared with Everyone except external users, organization-wide sharing links and sites with broken permission inheritance. Content that was hard to find becomes easy to find.
Does Restricted Content Discovery change permissions?
No. Microsoft says it doesn't change existing permissions, and people who already have access can still open the content directly. It limits discovery in organization-wide search and Copilot for the sites you choose, and Microsoft describes it as a temporary control while you review permissions.
Does Copilot respect sensitivity labels?
Per Microsoft, when data is encrypted by Microsoft Purview Information Protection, through sensitivity labels or restricted permissions, Copilot honors the usage rights granted to the user.
Is my SharePoint data used to train Copilot?
Microsoft says prompts, responses and data accessed through Microsoft Graph are not used to train the foundation language models behind Copilot.
How long does Restricted Content Discovery take to apply?
It depends on how many items the site holds. Microsoft says that for sites with more than 500,000 items, an update could take more than a week to fully show in search and Copilot.
Was this page helpful?
One click. No form, no email address.
Missing something in SharePoint Smart Permissions? Feature requests and bug reports go straight to the developer on GitHub — no account needed to read, free account to post.
Request a featureRelated tool
SharePoint Smart Permissions
Visual permissions audit + Excel export. No PowerShell. Free, MIT licensed, no sign-up.
Keep reading
Restricted Access Control and Overshared Sites: Preparing SharePoint for Microsoft 365 Copilot
Copilot exposes oversharing that is already there. Here is how the three SharePoint restriction controls differ, when to use each, and how to set up Restricted Access Control with PowerShell.
How to Find Overshared SharePoint Sites with Data Access Governance Reports and the Content Management Assessment
How to run the Content Management Assessment and Data Access Governance reports to find overshared SharePoint sites, and how to fix what they find.
SharePoint Advanced Management (SAM) Explained: What a Copilot License Unlocks
What SharePoint Advanced Management includes, how you get it, which features come with a Copilot license, and what you still have to pay for.
Want a second set of eyes?
Get a SharePoint permissions audit from our team
We review who can see what across your sites, flag oversharing before you roll out Copilot, and help you put a cleanup plan and governance in place.
About the author
Sean Regan
SharePoint & Microsoft 365 consultant with 20+ years of hands-on experience building SPFx web parts, migration tooling and tenant-grade automation. Maintainer of the open-source SharePoint Smart Solutions suite.