Free checklist · Microsoft 365

Before you turn on Copilot: a sharing checklist

Copilot can use any file a person in your business can open. Tidy who can open what first, in about an hour, in your own Microsoft 365 account.

“Copilot for Microsoft 365 utilizes all data that a user has access to, which may include broadly shared files that the user is unaware of.”

Microsoft Learn ↗

8 steps, done in your own account

Your progress

0 of 8 done

1. Remove "Anyone" links you no longer need
Each person opens the files they have shared in OneDrive and SharePoint and removes links that let anyone with the link open the file, unless a client still needs it.
EveryoneOur suggestion
2. Make "Specific people" the default link
In the SharePoint admin center, under Policies > Sharing, set File and folder links to "Specific people", so new links only reach the people named.
Your adminMicrosoft: sharing settings ↗ (opens in a new tab)
3. Make "Anyone" links expire
If you still allow "Anyone" links, use Link expiration in the advanced settings for "Anyone" links to require them to expire, and set the maximum number of days. Check how it treats links that already exist before you save.
Your adminMicrosoft: sharing settings ↗ (opens in a new tab)
4. Check sites shared with the whole company
Site owners open each site’s permissions, look for "Everyone except external users", and narrow access to the people who need it. Microsoft also suggests your admin hide that group from the people picker so it is not picked by accident.
File and site ownersMicrosoft Learn: Copilot and SharePoint ↗ (opens in a new tab)
5. Close or tidy sites nobody uses
Old project and client sites still count. Remove people who no longer need access, or archive sites nobody uses. Before deleting anything, check how long deleted sites can be restored.
File and site ownersMicrosoft Learn: Copilot and SharePoint ↗ (opens in a new tab)
6. Keep each client’s files with that client’s team
Put client folders in a site or folder shared only with the people working on that client, not in a company-wide area.
File and site ownersOur suggestion
7. Add Copilot to your AI tool register
Write down who has Copilot, what client information it may be used with, and who approves changes. The free AI tool list or the AI Use Register Kit gives you the format.
Your adminOur suggestion
8. Tell the team what Copilot can see
One message: Copilot uses what you can open, so if a file should not be in your answers, it should not be shared with you.
EveryoneOur suggestion

Ticks are kept only on this screen and clear when you reload.

You do every step in your own account; nothing here is sent to us. Menu names change, so follow the vendor link on each step. These steps tidy who can open what; they are not a security review or a compliance determination.

Microsoft 365, Copilot, SharePoint, OneDrive, Excel and Word are trademarks of the Microsoft group of companies. Google Workspace, Gemini, Google Drive, Google Sheets and Google Docs are trademarks of Google LLC. Notion is a trademark of Notion Labs, Inc. TechEd Analyst is not affiliated with, endorsed by or sponsored by these companies.

Next: write down how your team uses Copilot

List your AI tools for free in about 10 minutes, or get the AI Use Register Kit ($49) for a register and usage policy that work in Google Workspace, Microsoft 365 or Notion.

List your AI tools — free →See the kit →

Using Google Workspace? See the Gemini checklist →