The permission inheritance problem
Ten years of SharePoint sites created with "share with everyone in the organisation" defaults, orphaned Teams with open membership, and OneDrive folders shared by link and forgotten. Users never found this content because search ranking buried it. Copilot ranks by relevance to the question, so it finds compensation spreadsheets and draft restructuring plans immediately.
Assess before you license
Run an oversharing assessment: sites with organisation-wide access, files shared with anonymous links, stale Teams with no owner, and any location containing sensitive labels alongside broad permissions. The output is a remediation backlog ordered by risk, and it is almost always larger than the client expects.
Labelling is the durable control
Purview sensitivity labels with automatic classification give you enforcement that survives future sharing mistakes. Configure Copilot to respect label-based restrictions, and the control persists as content moves rather than depending on a one-time cleanup.
A realistic six-week path
Weeks one and two: assessment and stakeholder alignment. Three and four: remediate the highest-risk locations and deploy labelling policy. Five: pilot with a controlled group and monitor what surfaces. Six: staged rollout with clear guidance on what to report. Skipping straight to licence assignment is how Copilot programmes acquire a bad internal reputation in week one.