Who can see what. That is the whole answer, and it is less obvious than it sounds.

Copilot does not get access to anything new when you turn it on. It works with whatever access each employee already has, and it searches all of it at once, in response to a plain question. So if the salary spreadsheet has been sitting in a folder that half the company can technically open (nobody knew, nobody looked), Copilot will pull it up for any of them who ask. Before you switch it on, somebody has to find out what your people can actually reach and close off what they should not.

That somebody does not have to be you, and it should not be your IT person working nights for a month. Below: where the problem comes from, three things you can do this week without touching a setting, and what a readiness assessment looks like when it is built for the owner instead of the administrator.

Why can Copilot see files nobody was looking at?

For twenty years, “nobody was looking” did the job that permissions were supposed to do.

Think about how sharing happens in a real office. Someone opens a folder to the whole company for a project in 2019 and never takes it back. A new department site gets created and, because of how it was set up, everyone can see it. A new hire is added to a Teams group for a weekly meeting and inherits the group’s entire file library along with it. Then 2020: access got opened up so people could work from home, and almost nobody went back afterward to close it.

None of this caused problems, because finding a file meant knowing where to click. If you did not know the HR site existed, you never saw it.

Copilot does not click. Ask it what the salary ranges are and it searches every file, site, and channel your account can reach, then gives you the best match. The Concentric AI 2025 Data Risk Report, which reviewed more than 550 million records, put the share of business-critical files that are overshared at 16 percent in the average organization. Those files were exposed all along. Copilot just makes them easy to find.

We see the same thing locally. In the SAFE assessments Facet has run for Central Illinois companies, most turned out to have financial or client information reachable by people with no reason to see it, and in every case it came from ordinary sharing that nobody ever went back to revisit.

Why do most businesses stall on Copilot readiness?

The standard advice is written for companies with a security team.

Microsoft’s readiness guidance is thorough and none of it is wrong. Access reviews, sensitivity labels, oversharing reports, the works. If you have people whose actual job is data governance, it is a reasonable program to run. If you have 60 employees and the office manager is also the Microsoft 365 admin, it reads like a second job, and nobody has the hours to open every folder and make a decision about every file.

So most businesses do one of two things. They put Copilot off, or they turn it on and hope for the best.

What does SAFE do differently?

SAFE (Facet’s Secure Access Framework for Enablement) starts from the other end. Instead of sorting through the files, it looks at the doors.

Most oversharing in Microsoft 365 traces back to a small number of wide-open doors: a site shared with everyone, a group that hands out access nobody meant to give, a folder that inherited permissions from somewhere broader. Close those and the files behind them are covered, without anyone opening a single one. Labels still have their place, but on the handful of documents that need them rather than everything in the tenant.

This is not a different destination from Microsoft’s guidance. It is the same one, reached in an order a small business can actually follow: close the doors first, label the few things that need it after. Companies that go this way tend to end up with Copilot fully turned on, instead of walled off from the parts of the business where it would help most.

What can I do this week without touching a setting?

Three things. None of them are technical, and each one makes the later work faster.

Find out what AI your team is already using. Just ask. Most owners learn that employees are pasting company information into free chatbots on personal accounts, which is a bigger exposure than Copilot will ever be, since Copilot at least stays inside your environment. A short survey, or five minutes with each department head, is plenty to start.

Write a one-page AI use policy. Which tools are approved, what can never be pasted into an AI tool (client data, payroll, anything under a contract), and who to ask when someone is not sure. It does not have to be polished. It has to exist and be read.

List what has to stay private, and who should see it. Payroll, client lists, pricing, board notes, personnel files. Next to each, the people or departments that should have access. This list is the most useful thing you can bring to any readiness conversation, and you are the only person who can write it.

What does a SAFE assessment ask of me?

A few hours, mostly spent answering questions only you can answer. What information would be a problem if the wrong person saw it? Who should be able to see each of those things? Which departments have information that should stay inside the department? If you made the list above, you have already done most of this.

Facet takes it from there. We map who can actually reach what across your Microsoft 365 environment, compare that against your answers, and write up the gaps in plain English. The report reads something like “these 14 people can open the finance site and three of them should,” with a recommendation next to each item.

What happens next is your call. SAFE is the assessment and the recommendations, and nothing in your environment changes without your sign-off. For managed and co-managed clients, Facet does the cleanup, working with whoever owns each site so nobody loses access they need on a Tuesday morning. If you have your own IT team, they work from the report at whatever pace suits them.

How long does it take before we can turn Copilot on?

Up to you. A business with 20 to 250 employees that wants to move can go from first conversation to a pilot group using Copilot for real work in a few weeks. Others spread it across a quarter alongside everything else on the calendar.

The pilot is worth taking seriously. A handful of people from different departments use Copilot for a week and ask it pointed questions about the company. What they can and cannot find is the clearest test of whether the cleanup held. After that, the rest of the company comes on in stages.

Is this a one-time project?

It can be. Whether it should be depends on how fast your business changes.

The assessment happens once. Some businesses take the report, make the changes, and stop there, which is a legitimate choice and a great deal better than turning Copilot on blind.

The thing to know is that access starts drifting the day after any review. Someone shares a folder for a bid. A new hire lands in six groups. A department spins up a site without checking what it inherited. Give it a quarter and the picture has moved.

A full SAFE engagement continues past the assessment for exactly that reason. Facet keeps watching for drift, updates the record, and flags anything that opened back up. The record matters as much as the cleanup: when a cyber insurer asks how access to sensitive data is controlled, or an auditor wants proof, you hand them a dated report rather than describing something somebody did once.

How Facet Technologies handles Copilot readiness

Facet Technologies runs SAFE for businesses across Central Illinois that are getting ready for Copilot or have already turned it on. The assessment maps real exposure across SharePoint, Teams, and OneDrive, including the access nobody remembers granting, and produces a written record of what should change and why.

For managed services clients, Facet does the cleanup and the rollout inside the existing relationship, and ongoing monitoring runs alongside quarterly planning. For businesses with their own IT staff, it works as a co-managed engagement: your team runs the environment and makes the changes, we bring the assessment and, if you want it, the monitoring afterward.

If you would rather get a quick read on where you stand before talking to anyone, the AI Readiness Assessment on our site takes a few minutes and does not ask for a form.

Frequently asked questions

Does Microsoft Copilot create new security risks?

Not by itself. Copilot uses the access each employee already has and does not grant anything new. The risk is that it makes existing oversharing visible, because it searches everything an account can reach, including sites and folders the person has never opened. Fixing access before deployment removes most of that risk.

Do I need to be technical to get ready for Copilot?

No. A SAFE assessment asks the business owner which information is sensitive and who should see it. Facet does the technical mapping, reports the findings in plain language, and handles the cleanup for managed and co-managed clients. Your part takes a few hours.

Can we turn on Copilot for a few people first?

Yes. Copilot is licensed per user, so a pilot group of five to ten people from different departments is a normal first step. Having them ask Copilot pointed questions about company data during the pilot week is the clearest test of whether access has been tightened properly.

Ready to find out what Copilot can see?

Start by finding out what your employees can reach today. Facet Technologies runs SAFE assessments for Central Illinois businesses, and for managed and co-managed clients handles the cleanup, pilot, and rollout as well.

Call (309) 689-3900 or reach us at facettech.com/contact-us to start the conversation.