In the first week of a Microsoft 365 Copilot trial, a normal question returned a summary of the HR salary review. Nothing was hacked: Copilot only surfaces what the user could already open, and years of "share with everyone" links did the rest. This video shows who gets hurt, where the open doors came from, and the three-step fix: measure with the SharePoint data access governance reports, pull the brake with Restricted Content Discovery, then clean up the sharing itself and label the crown jewels. And why turning Copilot off does not close a single door.
What the video covers
- Copilot showed a coworker's files (0:00)
- The story (0:33)
- Who gets hurt (0:51)
- Copilot only reads what you can read (1:10)
- Where the open doors came from (1:34)
- Search had the same hole (1:59)
- Step 1: measure it (2:16)
- Step 2: pull the brake (2:41)
- Step 3: fix the sharing itself (3:03)
- Label the crown jewels (3:23)
- What turning Copilot off would do (3:39)
- Prove it worked (4:03)
- Gotchas (4:21)
- Do this BEFORE the rollout (4:44)
- Checklist (5:03)
- Recap (5:25)
Sources (Microsoft Learn, checked 2026-10-29)
- Data, privacy, and security for Microsoft 365 Copilot: https://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-privacy
- Data access governance reports for SharePoint sites: https://learn.microsoft.com/en-us/sharepoint/data-access-governance-reports
- Restricted Content Discovery: https://learn.microsoft.com/en-us/sharepoint/restricted-content-discovery
- Learn about sensitivity labels: https://learn.microsoft.com/en-us/purview/sensitivity-labels
Lab names and made-up numbers only (contoso.com). No prices: they change by region.
Have you run the oversharing reports in your tenant before rolling out Copilot? Tell me in the comments, or watch the full video here: https://youtu.be/HvuBSAHcJuk
Thanks for reading! I'm Cuong, and on CD Security Lab I rebuild real Microsoft security cases in a safe lab and explain them simply. Follow along:
- ▶️ YouTube (daily Shorts + explainers): CD Security Lab
- 💼 LinkedIn: Cuong Do
- 📘 Facebook: CD Security Lab
- 📸 Instagram: @cdsecuritylab
- 📝 More posts like this: Dev.to
Got a question about your own tenant? Drop it in the comments.
Top comments (0)