Before Copilot: Fix Permissions, Label Sensitive Data, and Turn On DLP

How Copilot Uses Your Permissions and Labels

Copilot searches the SharePoint sites, OneDrive folders, email, and Teams content a user has permission to see, then draws on the most relevant items to answer. According to Microsoft’s documentation on Purview protections for Microsoft 365 Copilot, when a sensitivity label applies encryption, a user needs both the VIEW and EXTRACT usage rights for Copilot to return that data. New content Copilot creates from labeled files inherits the highest-priority label automatically.

That gives a firm two levers: control who can reach content in the first place, and label the sensitive content so its protection travels with it. Both are part of the data-first approach behind our AI-powered IT solutions.

Step 1: Clean Up SharePoint Permissions

Most SharePoint environments were built by users over years without review. A first permission audit usually turns up the same three problems:

• Company-wide sharing: sites or libraries shared with “Everyone except external users,” which means the entire organization, often without leadership realizing it.
• Stale external access: guest links created for a single project that never expired and still work.
• Orphaned permissions: access that outlived a role change, or accounts that were never fully cleaned up.

The audit runs in four stages: inventory every site and its permissions, identify oversharing and stale access, remediate by tightening permissions and expiring old links, and set governance so the problems do not return, such as expiration on guest access and periodic access reviews. Purview’s oversharing analytics help find the highest-risk sites first.

Step 2: Label Sensitive Content

With access cleaned up, sensitivity labels tell people and Copilot how each file should be handled. A simple scheme works best, such as Public, Internal, Confidential, and Highly Confidential. Labels can apply encryption, restrict sharing, and add visual markings, and the protection stays with the file wherever it goes.

Manual labeling alone leaves gaps, because people forget or pick the wrong label. Auto-labeling closes them: policies detect patterns such as Social Security numbers, bank account numbers, or custom keywords, and service-side auto-labeling applies labels to content already stored in SharePoint and OneDrive without relying on users.

Step 3: Turn On Data Loss Prevention

Data loss prevention (DLP) catches sensitive data on its way out. Standard DLP policies watch email, Teams, SharePoint, and OneDrive and can warn, block, or log when regulated data is shared inappropriately. Endpoint DLP extends the same rules to the device itself, covering actions such as pasting sensitive content into a browser-based AI tool, uploading files to unsanctioned sites, or copying labeled documents to USB drives.

Endpoint DLP works best rolled out in stages:

1. Audit: log matches without blocking anything, to see real behavior and tune out false positives.
2. Warn: show users a policy tip and let them proceed with a business justification.
3. Enforce: block the highest-risk actions outright once the rules are accurate.

Skipping straight to enforcement tends to produce a flood of false positives and pushback that undermines the program. A short note to staff explaining what the prompts mean, and why they protect clients, makes the rollout far smoother.

Why the Order Matters

Labels applied on top of overshared sites still leave the wrong people with access. DLP rules without labels have less to act on. Permissions first, labels second, and DLP third means each control builds on the one before it. For the broader checklist of what to review before rollout, see our pre-Copilot audit guide.

How VirtuWorks Implements These Controls

Every VirtuWorks managed plan establishes the identity foundation, MFA and Conditional Access, and base Microsoft Information Protection labels during onboarding. The full program is delivered through the Compliance and AI Readiness Add-On, $59.99 per user per month on any managed plan: Purview oversharing analysis and SharePoint remediation, an expanded label scheme with service-side auto-labeling, DLP across email, Teams, and SharePoint, Endpoint DLP rolled out in stages, retention labels, and Defender for Cloud Apps discovery of unsanctioned AI services.

Where to Start

Pull a report of every SharePoint site shared with “Everyone except external users.” That list usually shows how much cleanup stands between you and a safe Copilot rollout. Schedule a Call and we will review your tenant’s permissions, labeling, and DLP posture and map the order to fix them.