Last updated: 3 October 2026
Short answer: Microsoft 365 Copilot only draws on information each person can already open, so it is only as safe as your permissions. The real risk is not Copilot itself but old, overshared files it can suddenly find. Fix access first, then switch it on.
Is Microsoft Copilot safe for our business data?
Microsoft states that Copilot works within your Microsoft 365 tenant, follows your existing access controls and does not use your prompts or files to train the underlying models. That makes it safer than pasting company data into a public AI tool. It does not make careless permissions safe: if a salary spreadsheet is open to everyone, Copilot can surface it to anyone who asks the right question.
What are the main risks?
| Risk | Why it happens | How to reduce it |
|---|---|---|
| Overshared files | Old SharePoint sites and links shared with Everyone or entire teams. | Run a permissions review and remove broad access. |
| Unlabelled sensitive data | HR, finance and client files have no sensitivity label. | Apply sensitivity labels with Microsoft Purview. |
| Weak sign-in | Accounts without MFA can be taken over, giving an attacker Copilot too. | Require MFA for everyone, admins first. |
| Shadow AI | Staff paste company data into unapproved public tools. | Provide an approved option and write a simple AI policy. |
| Trusting the answer | Copilot can be wrong or out of date. | Train staff to check outputs before using them. |
How do we prepare for Copilot safely?
- Review SharePoint and OneDrive sharingFind sites and links open to everyone, and tighten them.
- Label sensitive dataMark HR, finance, legal and client files so protection follows them.
- Turn on MFA and conditional accessMake sure only trusted users and devices can sign in.
- Set an AI acceptable use policySay what staff may and may not do with AI tools.
- Pilot with a small groupStart with a few users, watch what Copilot finds, then roll out.
Can ABCOM get us ready for Copilot?
Yes. We review SharePoint and Microsoft 365 permissions, fix the gaps, set up labels and policies, and help you roll out Copilot with a short pilot. If you are not sure whether staff are already using AI tools you do not know about, we can check that too. Book a free IT review to get started.
Sources and further reading
Want this looked after for you?
ABCOM has supported Sussex businesses and charities since 1996 and is an NCSC Assured Service Provider – Cyber Advisor (Cyber Essentials). Talk to a real person about your IT.
Also read
How ABCOM can help
Talk to a real person at our Burgess Hill office. We are an NCSC Assured Service Provider and have supported Sussex businesses since 1996.