Copilot and AI data readiness
Make sure Copilot only finds what people should see.
Microsoft 365 Copilot works within the access your people already have, and makes it far easier to use. In two to three weeks we show you what is overshared, what is sensitive and what to fix before rollout.
Who it is for
Organisations that have bought Microsoft 365 Copilot licences or are planning a pilot, and want to know what it could surface first. It also suits anyone preparing internal data for other AI tools that read from Microsoft 365.
What we examine
- Oversharing across SharePoint, OneDrive and Teams: organisation-wide links, broad groups, public teams and broken inheritance
- Guest and external access, including accounts that outlived their purpose
- Where sensitive content lives, such as HR, finance, legal, board and customer data, and who can reach it today
- Sensitivity labels and data loss prevention in place, and what is missing
- Copilot and search settings that limit what can be discovered during a pilot
- Who owns each important site, and whether anyone reviews access
What you receive
- An exposure report ranking sites and content by sensitivity and how widely they are shared
- A minimum sensitivity label set that suits your organisation, ready to deploy
- A remediation plan, with the fixes to make before a pilot and the ones that can follow
- Go-live gates for Copilot: the conditions each department's content should meet before access widens
What we need from you
- Read access to the SharePoint admin centre and Microsoft Purview
- About two hours of your team's time across a kick-off and the readout
- Contacts for the teams that hold the most sensitive information
How it runs
- Scoping: the tenant, the pilot group and the questions the assessment needs to answer.
- Discovery: sharing, permissions, labels and sensitive content analysed across the tenant.
- Readout: the exposure report and plan walked through with IT, security and the business owners of sensitive data.
AI governance
Readiness also covers how your organisation uses AI, so staff know what is allowed and IT can see what is happening.
- An AI acceptable use policy that fits how you work
- An approved list of AI tools, and how new ones are requested
- Rules for which data can be used with which tools
- Discovery of AI apps already in use, through Microsoft Defender for Cloud Apps
- Monitoring of AI activity and sensitive data in Microsoft Purview
What happens next
North Ark can deliver the remediation as a fixed-scope project: permission clean-up, labels and data loss prevention, search restrictions for the pilot, and an owner and review process so access stays tidy. From there, the same engineers can help you run AI on your own infrastructure and data.
Questions buyers ask
Does Copilot give people access to things they couldn't see before?
No. It works within their existing permissions. The risk is that it makes overshared content much easier to find, which is why permissions need fixing first.
Do we need this if we are only running a small pilot?
A pilot still searches the whole tenant on behalf of the pilot users. Knowing the exposure first lets you restrict what the pilot can reach while the clean-up happens.
Do you sell Copilot licences or train users?
We don't resell Copilot licences or run end-user training. We make the data and permissions ready, and work alongside whoever handles Copilot licensing and adoption.
Will fixing permissions disrupt people's work?
Changes are agreed with site owners first and made in order of risk. Broad groups are replaced with the groups that need access, rather than removing access and waiting for complaints.
Is this only about Copilot?
No. The same oversharing affects any AI tool that reads Microsoft 365 data, and it is a security risk without AI too.
Start a conversation
Fix what Copilot would find before it finds it.
Tell us where you are with your rollout.
Talk to an Engineer