Microsoft Copilot and data security: what Scottish SMEs need to know before switching it on

Microsoft Copilot only surfaces data your users already have access to. The question is: do you actually know what that is? We’ve seen this go wrong. Here’s what needs to be in place before you switch it on.

A digital illustration showing floating Microsoft 365 file icons and a glowing padlock on a dark navy background, representing data security risks when using AI tools like Microsoft Copilot.

We've big fans of Microsoft Copilot... But we're also the people who get the call when it has all gone wrong. And it does go wrong, it goes wrong a lot - but no because Microsoft did anything wrong. It goes wrong because businesses switched it on without doing the groundwork first.

99% of organisations have sensitive data dangerously exposed due to AI tools according to a 2025 study by Varonis (an AI cyber tool)

Copilot is built to be safe, within your own environment

Microsoft have put a lot of thought into how Copilot handles data and they've built guardrails into it. It works within your existing Microsoft 365 permissions, it doesn't go outside your tenant, and it's deeply integrated into the platform. That depth of integration is exactly what makes it so capable.

But here's the honest version of that story. Those guardrails mean Copilot only surfaces data the user already has access to, which sounds reassuring, until you think about what your users actually have access to.

As we said in a recent webinar: it's a bit like being handed a loaded gun and being told that you can shoot yourself in the head if you want to, that's up to you. The guardrails are there - what you do within them is your responsibility - and most businesses have permissions that are far messier than they realise.

Your data is the risk


One of the things we come back to again and again is this: AI feeds and thrives on data. Your data is no different; in fact, isn't internal company data far more sensitive than what ChatGPT or Gemini can scrape from public databases?

Every business using Microsoft 365 has a 365 tenant. Within that tenant, there's a lot of data: shared drives, SharePoint sites, Teams channels, HR documents, financial records, old project files. And within that environment, that's where you can do damage if you haven't thought it through.

Copilot will feed on any data it can reach - ask it a question, and it goes hunting. It returns data the user has access to, even if that user has never actually looked at that file, never knew they had access to it, and would be surprised to know they did. You don't even need to know you have access to something. Copilot knows. And it'll find it.

That's not a story to scare anyone, but it can and does happen, we've seen it happen, and it's a bit of a nightmare when it does.

A real example of this happening

Here's one we see all the time with new clients: a business does a SharePoint migration, they lifted and shifted the files across, told themselves they'd tidy the permissions up later, and then got on with running their business. That was two or three years ago.

Well, now is later.

If you switch Copilot on with messy permissions in your SharePoint environment, you're giving Copilot access to everything that everyone can access, whether that's intentional or not. Old project folders, HR files, salary information buried in a contract from 2019, documents from people who left the company years ago, even meeting transcripts if the access goes wide enough.

Copilot doesn't know what should be off limits, it knows what the access controls say - the ones that you've set. If the access controls are wrong, Copilot will return things it shouldn't. And once someone's seen something they weren't supposed to see, that's very hard to walk back.

What needs to happen before you switch Copilot on

And nobody likes this bit, because we all want to run off with the amazing time-savings that AI can generate for us, versus cleaning up years of disorganisation. But, we'd recommend these as a minimum:

But there's no tick list for AI...

Our CEO talks about the 'AI tax.' The idea is simple: doing this properly costs time and resource upfront. You have to be willing to pay that tax in the form of proper setup and expert guidance, or it will cost you more later in a different way.

There's no universal tick list for AI that you can download and work through. No checklist that tells you exactly what to do. Because AI needs to be built around your business, your data, your team, and your risk appetite. The businesses that treat Copilot like a feature to toggle on are the ones we hear from afterwards.

Unless you've mapped out your use cases, decided the access you're actually going to give it, and got all of that documented, our honest advice is: don't implement it yet. Wait until you've done the work.

The ones who get it right treat it as a project. They sit down and work through the opportunities and the risks together. They build a roadmap that actually adds something to the business rather than just ticking a box.

However, we are still big fans of Copilot


We want to be clear: Microsoft Copilot is a genuinely powerful tool, and we recommend it to a lot of our clients (almost all of them). The way Microsoft have built it, so deeply integrated into the entire 365 ecosystem, is exactly what makes it so capable.

But it's also what makes the data security question so important to get right before you start. Copilot has been marketed as safe because it works within your organisation, and it does. But within your organisation, there's a lot of data, and not all of it should be equally accessible to everyone.

That's not a Microsoft problem. That's an environment problem. And it's one worth fixing before you give AI the keys.

How we can help

If you're thinking about Copilot for your business, or you've already switched it on and you're not sure your permissions are in good shape, we'd recommend starting with a proper AI assessment. It's the kind of work our managed cyber security services team carries out regularly, and it's considerably less painful than the alternative.

We'll sit down with you, go through your environment, identify the risks and the opportunities, and build a roadmap that works for your business. Not a tick box. Not a generic checklist. Something built around you.

You can find out more here.

-

Further Reading

If you'd like to go deeper on any of this, these are worth your time:

-

About the Author

Becca Smith is a Marketing Manager for m3 Networks. She has spent 16+ years writing about cyber security and most recently AI security across the UK and Scotland.