Admin guide
Nightschool AI: stop Microsoft 365 Copilot oversharing, for admins
Copilot does not break permissions. It finds what was already shared too widely.
Microsoft says Copilot only surfaces data a user already has at least view permission to, so oversharing is a permissions problem. Restricted SharePoint Search can't be newly enabled after 31 July 2026; plan around Restricted Content Discovery, and read the weekly DSPM for AI assessment of your top 100 SharePoint sites.
Published
Key Takeaways
- Copilot only surfaces data the user has at least view permission to.
- Restricted SharePoint Search can't be newly enabled after 31 July 2026.
- Restricted Content Discovery is the control Microsoft Purview points to for a site.
- DSPM for AI assesses your top 100 SharePoint sites weekly, with no activation needed.
The full guide
Tap any section to open it.
About this guide
This page is for the admin who just heard that Microsoft 365 Copilot showed someone a file they should not have seen. It explains the permission rule Microsoft documents, which control to plan around now that Restricted SharePoint Search is retiring, and how to find the next overshared site before a user does.
The ruleCopilot follows the permissions you already have
Microsoft's privacy page for Microsoft 365 Copilot says it only surfaces organizational data that the individual user has at least view permissions to access. If a manager sees a salary file through Copilot, they could already open it.
That makes the fix sharing and discovery, not a Copilot switch. Turning Copilot off leaves the same file open to anyone who searches for it.
ChecklistOversharing checklist you can copy
Run this before a wide Copilot rollout, then weekly.
1. State the rule
Copilot surfaces only what a user can already view. Put that sentence in your rollout note.
2. List sensitive sites
HR, finance, legal and executive sites first.
3. Restrict discovery
Use Restricted Content Discovery on those sites while you clean up.
4. Skip RSS
Restricted SharePoint Search can't be newly enabled after 31 July 2026.
5. Read DSPM weekly
Open the weekly DSPM for AI assessment of your top 100 sites.
6. Assign owners
Each flagged site gets a named owner and a fix date.
SourcesWhere each fact comes from
Microsoft, "Data, privacy and security for Microsoft 365 Copilot": learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy. Microsoft, "Restricted SharePoint Search": learn.microsoft.com/en-us/sharepoint/restricted-sharepoint-search.
Microsoft, "DSPM for AI": learn.microsoft.com/en-us/purview/dspm-for-ai.
Each fact on this page was read on that vendor page on 2026-11-08. Open the source and your own admin console before you rely on a detail here.
Train the admins, then the people they support
This page covers one admin task. The Nightschool AI admin and governance course walks the whole Microsoft 365 Copilot setup in order: licensing, data protection, oversharing, Purview DLP, audit and retention, web search, agents and model providers, with every step checked against Microsoft's own documentation.
Frequently Asked Questions
Can Microsoft 365 Copilot see files a user can't open?
Microsoft says no: Copilot only surfaces organizational data the individual user has at least view permissions to access.
Can we still turn on Restricted SharePoint Search?
Not as a new setup. Microsoft says Restricted SharePoint Search can't be newly enabled after 31 July 2026.
What replaces Restricted SharePoint Search?
For keeping a site out of Copilot and search discovery, Microsoft Purview points to SharePoint Restricted Content Discovery.
How do we find overshared sites?
DSPM for AI in the Microsoft Purview portal runs a weekly data risk assessment of the top 100 SharePoint sites by usage, with no activation needed, and you can run custom assessments.
Should we turn Copilot off until sharing is clean?
That leaves the same files open to search. Fix sharing on the riskiest sites first, restrict discovery on them meanwhile, and read the weekly assessment.
Do we need to switch on the DSPM for AI assessment?
No. Microsoft says the default data risk assessment runs weekly with no activation needed. Custom assessments are optional.
Keep going
Related Guides and Courses
Set it up once, write it down, then teach it
Write down who owns each Copilot setting before the day someone asks you to change it.
Nightschool AI is independent and not affiliated with, sponsored by or endorsed by Microsoft. Microsoft 365 Copilot, Microsoft Purview and SharePoint are Microsoft's products, named here only to describe them. Facts checked against Microsoft's public pages on 2026-11-08; confirm in your own admin console before you change a setting.