Copilot Did Not Leak Your Files. Your Permissions Did.

The prompt that found the wrong file

The incident rarely looks like an attack. An employee asks Copilot an ordinary question about a customer, a project, or a pay band, and the answer comes back built from a document they had no business seeing: an HR file, a salary spreadsheet, a contract stored in a site that was shared with the whole company two years ago and never tightened. Nobody hacked anything. Nobody broke a rule. The employee had permission, granted long ago for a different reason, and Copilot simply did what it is designed to do. It searched everything that person can reach and summarized what it found.

Microsoft is plain about the mechanism in its own guidance. Copilot and its agents retrieve data from Microsoft Graph and respect existing permissions, sharing settings, and policies. Respecting permissions is not the same as correcting them. Microsoft also notes that SharePoint sharing settings are set to the most permissive option by default. For years, oversharing was a quiet risk, because finding a misplaced file required knowing it existed and where it lived. An AI assistant removes that friction. Every forgotten link and stale group membership is now one plain language question away from the wrong screen.

What the evidence says

ShareGate's State of M365 report for 2026, built on two surveys of nearly 1,800 IT professionals and leaders across nine countries, measured the gap between confidence and outcomes. In its AI governance survey of 851 IT leaders, 93 percent said they were confident their governance framework was sufficient to support Copilot and other AI tools responsibly. In the same survey, 29 percent said Copilot or another AI tool had already surfaced sensitive internal data that should not have been accessible, and another 8 percent said they were not sure whether it had. United States respondents reported the highest exposure rate in the study, at 37 percent.

What surfaced was not trivia. Among the organizations that reported an incident, the exposed content included customer data in 36 percent of cases, internal documents in 31 percent, personal data in 30 percent, HR data in 30 percent, financial data in 25 percent, and proprietary intellectual property in 21 percent. The visibility gap behind those numbers is just as telling: 53 percent of respondents said they do not have full visibility into what their Copilot agents can access. A company cannot correct access it cannot see, and most companies are correcting it late. Across the wider study, 65 percent of teams said they learn about governance problems after the fact, through quarterly audits or user complaints, and only 1 percent use a tool built specifically for Microsoft 365 governance.

The permission problem predates AI, and the same research shows how common it is. In the past year, 77 percent of organizations experienced at least one Microsoft 365 governance incident, counting oversharing, stale access, audit gaps, and shadow IT or AI. Thirty eight percent had left former employees or guests with access they should have lost. Thirty five percent hit an audit or compliance gap, and 26 percent had sensitive content reach the wrong people. Meanwhile the audience for that content kept growing: full Copilot deployment roughly doubled in a year, from 29 percent of organizations in 2025 to 56 percent in 2026, and 93 percent now have Copilot in production in some form.

Why permissions rot

Sharing was built for speed

Collaboration tools reward the fastest way to share, and the fastest way is usually the broadest: a link that works for anyone, a site shared with everyone in the organization, a folder opened to a whole department when one person needed one file. Each choice is reasonable in the moment. Multiplied across years of projects, they become an access model nobody designed and nobody would approve if they saw it written down.

Access arrives and never leaves

Permissions on Microsoft 365 content do not expire on their own. People change roles, finish projects, host guests, and leave the company, while the access granted to them stays exactly where it was. ShareGate found 38 percent of organizations had left former employees or guests with access they should have lost in the past year. Before AI, stale access mostly sat dormant. Now it is indexed, searchable, and quotable.

Nobody owns the cleanup

Sites get created for a project and outlive it. Owners leave and are never replaced. Microsoft's own readiness guidance treats ownerless and inactive sites as a core risk signal, alongside broken permission inheritance and broad organization wide sharing. When no named owner is responsible for a site, no one reviews who can reach it, and no one notices when the answer stops making sense.

Fix the permissions first, in this order

The cleanup has a sequence, and the sequence is most of the value. Microsoft's published readiness path and the incident data point to the same order.

1. 1See the estate clearly: run the SharePoint Advanced Management Content Management Assessment and the data access governance reports, starting with the site permissions baseline, the Everyone except external users report, and the sharing links activity reports
2. 2Shield the worst sites today: apply Restricted Content Discovery to high risk sites holding HR, finance, and customer data while their access is reviewed
3. 3Fix access at the source: remove stale users and guests, narrow organization wide links to named people, restore broken permission inheritance, and use Restricted Access Control to limit sensitive sites to a defined group
4. 4Give every site a living owner: assign owners to ownerless sites, run scheduled site access reviews that owners must answer, and archive or delete inactive sites
5. 5Tighten the defaults and keep watching: move tenant sharing settings away from the most permissive option, expire sharing links, rerun the assessment every 30 days as Microsoft recommends, and monitor continuously instead of waiting for a quarterly audit

Notice what this order avoids. It does not start by switching Copilot off, which punishes the productivity the business already paid for and leaves the permissions just as wrong for the next tool that reads them. It also does not start with a company wide lockdown that breaks legitimate work and teaches people to route around IT. It starts with visibility, protects the highest risk content first, and then repairs access site by site with the owners who understand the content.

What this means if you run a company in Oklahoma

For most Oklahoma companies, Microsoft 365 is not one system among many. It is where the business actually runs: bids and contracts in SharePoint, payroll and HR files in OneDrive and Teams, customer records moving through shared sites every day. The team is lean, the same person who administers the tenant also fixes printers and onboards staff, and a structured permission review has never made the priority list. That is precisely the profile the research describes, confident in the tools and exposed in the data underneath them. The questions are also arriving from outside now. Larger customers send security questionnaires that ask what your AI tools can reach. Cyber insurers ask how access is reviewed. A documented assessment, a short list of high risk sites, and evidence of reviews turn those from awkward silences into routine answers.

At Oklahoma Data Partners, this is the data foundation work we do before and during AI rollouts: inventorying where critical data lives across your tenant and databases, classifying it in terms the business can enforce, cleaning up who and what can reach it, and building the governed reporting and pipelines your approved tools can safely stand on. If Copilot is live in your company, or about to be, book a consultation and we will give you a straight account of what it can reach today and the order to fix it in.