Copilot Data Readiness Checklist for SharePoint (2026): 10 Steps Before You Roll Out

Before you buy Copilot seats, you need to know what people will be able to find with them. Copilot works within existing permissions, so it does not create new access. What it does is remove the friction that used to hide overshared content: a file nobody would ever have browsed to can now appear in an answer. This checklist puts the cleanup in an order that works, using Microsoft's own tools first and our free tools where they save time. It follows the three pillars in Microsoft's foundational deployment guidance: remediate oversharing, set up guardrails and meet regulations.

For what Copilot costs and how seats are licensed, see our Copilot licensing guide.

What Copilot does and does not change

Microsoft says Copilot only surfaces organizational data to which a user has at least view permissions, and it honors usage rights from sensitivity labels. Two things follow. If a site is open to everyone, Copilot can draw on it for everyone. And fixing permissions fixes Copilot: there is no separate Copilot permission model to maintain.

The 10-step checklist

1. Decide your scope and pilot group

Pick the first group of users and the sites they are likely to touch. You do not have to clean the whole tenant before the first pilot, but you do need to clean what that group can reach, which is usually far more than their own sites.

2. Confirm you have SharePoint Advanced Management

SharePoint Advanced Management is included once at least one Microsoft Copilot license is assigned in the tenant, and the user does not need to be an admin. You also need a qualifying base license, for example Microsoft 365 E1, E3 or E5. Organizations on SharePoint-only plans can buy the SharePoint Advanced Management Plan 1 add-on instead. Some features, such as the sensitivity labels report, need E5.

3. Run the data access governance reports

In the SharePoint admin center, the data access governance reports show permission state for sites, OneDrive sites and files, the sites a given user can reach, a sensitivity label snapshot, sharing link activity over the last 28 days, and Everyone except external users insights. Start here to size the problem. If you want a second view you control, run the free Smart Permissions report on your most sensitive sites and export it to Excel.

4. Remove the broadest access first

Work through the highest-exposure items in this order:

• Content open to Everyone except external users. See how to audit it before Copilot.
• Organization-wide and Anyone sharing links, especially on sensitive libraries. See sharing links explained and the external sharing report.
• Broken inheritance with unclear owners: unique permissions on folders and files nobody remembers granting.
• Large groups used as access shortcuts, such as an all-staff group on a finance site.

5. Hand reviews to the people who know the content

Site access reviews let you delegate review of a data access governance report to the owners of overshared sites. Admins cannot judge whether access is right, owners can. Send the review, set a deadline, and track what comes back.

6. Put guardrails on the riskiest sites

Two controls are included with Copilot licensing. Restricted Content Discovery is a per-site toggle that keeps a site's content out of org-wide search and Copilot discovery while you fix permissions. It does not change access, and Microsoft calls it a temporary control. Restricted Access Control limits a site to members of up to 10 Microsoft 365 or Entra security groups, so people outside those groups are blocked even if they hold an old link. Use the first as a stopgap and the second for sites that should stay locked down.

7. Label what is sensitive

Sensitivity labels let Copilot honor usage rights, and a data loss prevention policy can stop Copilot from summarizing content with selected labels. Microsoft Purview Data Security Posture Management also runs risk assessments over your most-used SharePoint sites and suggests fixes. Start with the content that would hurt most if surfaced: HR, legal, finance, board and M&A material.

8. Retire stale and ownerless sites

Old sites keep old access. Site lifecycle management offers three policies: site ownership, inactive sites and site attestation. Each runs in simulation mode first and then in active mode. They notify owners and can set sites to read-only or archive them. They do not delete sites. Retiring dead sites shrinks both your oversharing surface and your storage bill.

9. Pilot with a small group and test with real prompts

Assign licenses to the pilot group only, then ask Copilot the questions that would embarrass you: salaries, reorganization plans, legal matters, customer pricing. If an answer surfaces something it should not, trace the source file and fix the access, not the prompt.

10. Keep monitoring

Sharing keeps happening after the cleanup. Re-run the reports on a schedule, review new sharing link activity, and repeat site access reviews each quarter. Treat it as an ongoing control, not a project with an end date.

Where our tools fit

Microsoft's reports are the starting point. Smart Permissions adds a browsable view of who has access to each site, library, folder and file, with Excel export, and it is free and open source. Take the Copilot oversharing self-assessment to see where you stand. If you want a second opinion or a hands-on readiness review, get in touch or see our Copilot readiness and permissions audit.

Related

• Microsoft 365 Copilot licensing explained
• Audit "Everyone except external users" before Copilot
• Sharing links and Copilot readiness with Smart Permissions
• SharePoint permission levels explained
• SharePoint governance: complete reference