“Which information can Copilot find in our company?” Start with three questions: which product are you using, in what context and with which approved data sources?
The product name alone does not define access.
Businesses encounter different services and scenarios under the Copilot name. General chat, work within an open Office file, search connected to Microsoft 365 knowledge and an additional agent follow different data paths. Record the specific functionality as part of the rollout.
Microsoft has also changed product names: its documentation now refers to Microsoft Copilot and Microsoft Copilot Chat, while some interfaces and licences still use Microsoft 365 Copilot. For a technical decision, actual functionality is more dependable than a label copied from older material.
A permissions model depends on the permissions it starts with.
For Copilot connected to Microsoft 365 business data, Microsoft describes access within the user’s permissions. This does not imply blanket access to every internal file. It also does not mean that every existing permission is appropriate.
An obsolete group permission might make a costing spreadsheet readable by more people than intended. If the service uses that source, AI mainly changes how readily it can be found. Reviewing the actual reader groups before a broad rollout is therefore worthwhile.
A useful rollout checklist records concrete data paths.
- Chat and input
- What information is entered, uploaded or explicitly selected as context? Employees need clear rules on permitted data classes.
- App context
- Which open file, email or meeting does the feature use? App context is different from a search across company knowledge.
- Company search
- Which SharePoint, OneDrive or other sources are connected to this particular function? Which identity and permissions apply when retrieving information?
- Extensions
- Which agents or external connections are approved? Check their permissions, data recipients and possible actions separately.
What role do search restrictions play?
Restricted Content Discovery can limit organisation-wide discovery for selected SharePoint sites. It does not change existing permissions. Compare its scope with direct access, search within the site and documents already open. Appropriate source permissions remain essential for confidential information.
A new long-term architecture should not depend on the older Restricted SharePoint Search feature. Microsoft is retiring it, and new activation has been blocked since 31 July 2026. That is different from a blanket shutdown of every existing configuration.
A pilot must also test answers users should not receive.
A good test goes beyond asking for a generally available internal guide. It includes cases where an employee must not receive a confidential source. Test direct questions, equivalent wording, result titles and revocation of previously granted access.
Record what supports each answer as well. Copilot can summarise an authorised source incorrectly or fill a gap inappropriately. Checking sources, checking access and assessing the result serve different purposes.
From a licence to controlled use.
DAXS can work with your IT to map product scope, identities, sources and initial use cases. The result is a pilot with documented data paths and testable criteria. The workplace AI guide explains rollout and use; AI security examines permissions and oversharing in more depth.
Vendor documentation checked on 15 October 2026: Copilot Chat: protection and data context · Copilot: company data and permissions · Restricted Content Discovery · Restricted SharePoint Search. Features and licensing are checked again for the specific environment.
