Analysis · curated 20 Jul 2026
Copilot Didn’t Overshare Your Data. Your Permissions Did
First reported petri.com
Coverage timeline
Single-source analysis — first reported, latest, and curated coincide.
Why it matters
Microsoft 365 Copilot converts dormant permission sprawl into instant, searchable data exposure, meaning defenders must treat AI rollout as a data-governance and access-control problem before confidential content is surfaced at scale.
Amy Babinchak argues that Microsoft 365 Copilot's tendency to surface confidential documents, emails, and SharePoint content is not a Copilot bug but a reflection of pre-existing permission sprawl — EEEU groups, broken inheritance, and unexpired sharing links — that plain-language prompts now make instantly discoverable. Citing Concentric AI research that 16% of business-critical data in the average tenant is overshared, the piece recommends restricting Copilot discovery from high-risk areas and using Purview and SharePoint Advanced Management to remediate.