In the first week of a Microsoft 365 Copilot trial, a normal question returned a summary of the HR salary review. Nothing was hacked: Copilot only surfaces what the user could already open, and years of "share with everyone" links did the rest. This video shows who gets hurt, where the open doors came from, and the three-step fix: measure with the SharePoint data access governance reports, pull the brake with Restricted Content Discovery, then clean up the sharing itself and label the crown jewels. And why turning Copilot off does not close a single door.
Lab names and made-up numbers only (contoso.com). No prices: they change by region.
Have you run the oversharing reports in your tenant before rolling out Copilot? Tell me in the comments, or watch the full video here: https://youtu.be/HvuBSAHcJuk
Thanks for reading! I'm Cuong, and on CD Security Lab I rebuild real Microsoft security cases in a safe lab and explain them simply. Follow along:
Got a question about your own tenant? Drop it in the comments.