Why Copilot readiness starts with permissions
Microsoft 365 Copilot uses permissions when accessing organisational information. It does not make an overshared file private. If someone already has access to a folder they should not see, adding AI can make that information easier to discover and use.
Consider an old HR site shared with a company-wide group. The underlying problem is the sharing permission, whether or not anyone has used Copilot to find the files. Correct that permission with the site owner instead of relying on staff not to ask a particular question.
Microsoft’s deployment guidance puts oversharing and governance at the start of preparation. Our Microsoft Copilot training page covers the adoption side: helping people use the tool well alongside decisions owned by the organisation’s IT team.
Nine areas for a Microsoft 365 security review
Record what was examined, what evidence was available and any limitations. Check the actual licences and enabled features in the tenant. A product appearing in a subscription does not prove it has been configured or is protecting every relevant user.
1. MFA and Conditional Access
Check MFA registration and enforcement separately. Include administrators, ordinary users, guests, emergency access arrangements and any exclusions. Establish whether legacy authentication or an overlooked account provides an alternative route into the tenant.
Microsoft’s security defaults offer baseline protection, including MFA registration and blocking legacy authentication. Conditional Access provides more configurable controls for appropriately licensed tenants, including Microsoft Entra ID P1 and Microsoft 365 Business Premium.
Do not switch between approaches without an implementation plan. Work with the tenant administrator to understand application dependencies, emergency access, user communications and how the changes will be tested.
2. Administrator roles
List privileged accounts, their owners and the work each role is needed for. A person who resets passwords does not necessarily need Global Administrator access. Use the least privileged role suited to the task, with narrower scope or time-limited access where appropriate.
Microsoft recommends limiting Global Administrator assignments and maintaining two cloud-only emergency access accounts following its specific guidance. Review emergency arrangements as carefully as ordinary accounts; they should not become everyday shared logins.
3. External sharing and guests
Review organisation-wide settings for SharePoint and OneDrive, then the settings on important sites. An Anyone link can allow access without signing in. Check which link types are available, the default staff are offered and any expiry controls.
Review guests and their ongoing need for access. A former supplier’s invitation may remain relevant to a historic record but not justify continuing access to live documents. Agree the intended audience with the content owner before changing permissions.
4. SharePoint and OneDrive oversharing
Look for broad groups, sites shared with “Everyone except external users”, unnecessary edit access and sensitive material stored in general-purpose folders. Start with the information whose accidental disclosure would matter most.
Microsoft’s data access governance reports can help identify potentially overshared content. Check the current SharePoint Advanced Management prerequisites and licensing for the reports you intend to use.
Restricted Content Discovery can temporarily limit discovery of selected SharePoint sites through organisation-wide search and Copilot while a review takes place. It does not change permissions, does not cover OneDrive sites and is not a replacement for correcting access. Users with existing access can still reach content directly.
5. Mailbox rules and forwarding
Review automatic external forwarding, mailbox-level settings, inbox rules and the relevant alerts. A forwarding rule may have a legitimate purpose, but it can also be created after an account compromise.
Microsoft’s external forwarding guidance explains that the “Automatic – System-controlled” setting can behave differently in some existing organisations. Agree a deliberate policy and verify its effect. Also check mail-flow rules and remote-domain controls rather than treating one switch as the whole configuration.
6. Defender for Office 365 and Secure Score
Identify which users have the relevant protection licences and which policies apply to them. Review the coverage of Standard or Strict preset security policies and any exclusions. Microsoft 365 Business Premium includes Defender for Office 365 Plan 1, but licence ownership alone does not prove the intended coverage.
Use Microsoft Secure Score to organise recommended actions. Treat it as one input to the review. A score is not a certification, a penetration test or proof that the business cannot be compromised.
7. Sensitivity labels and information protection
Where licensing supports them, check whether sensitivity labels are defined, published and used in a way staff understand. Decide which documents need stronger protection, who can change the labels and how external collaboration should work.
Microsoft’s sensitivity-label guidance explains how labels and encryption interact with Copilot. Labels should follow an agreed information-handling approach rather than being applied indiscriminately. Test representative documents and user roles before widening a policy.
8. Audit logging
Verify the actual auditing status. Microsoft documents that auditing is not enabled by default for Microsoft 365 Business Basic, Business Standard and Business Premium. Its standard audit retention is 180 days, with retention affected by licences and policies.
If unified auditing is disabled, the evidence available for later investigations is limited. Turning it on later does not recreate events that were never recorded. Other services have their own logs, so also establish which evidence is available, who can search it and how long it is retained.
9. Copilot agents and connected applications
List approved agents, enterprise applications and other integrations. Record their purpose, owner, permissions and data sources. Review consent and access when a trial ends, a supplier changes or the person who introduced a tool leaves.
Do not assume that a user without a paid Copilot add-on cannot expose business information to an AI workflow. Copilot Chat can receive uploaded or open content, and pay-as-you-go agents can access organisational data. Check the specific experience, configuration and permissions in use. Microsoft’s Copilot overview explains these differences.
Five checks to discuss with your administrator today
Use this as a starting conversation, not a list of switches to change without understanding the consequences.
- Sign-in: which policy enforces MFA, and which accounts or applications are excluded?
- Privileges: who holds Global Administrator or other powerful roles, and why?
- Sharing: which important sites or files can be opened by broad groups or anonymous links?
- Forwarding: is external forwarding intentionally controlled, and are rules and alerts reviewed?
- Evidence: is auditing enabled, what is retained and who can investigate an unusual event?
If an answer is unknown, record an owner and next action. Unknown settings are useful findings; they are not evidence that the tenant is either secure or compromised.
Microsoft 365 review or wider cyber security audit?
A tenant review looks closely at one platform. A wider review should also address devices, patching, local networks, backups, other cloud services and supplier responsibilities. Our cyber security audit guide explains how to scope that work.
For Cyber Essentials, Microsoft 365 is only part of the picture. Cloud services cannot simply be excluded from the assessment, and the organisation must also meet the other applicable requirements. Use our Cyber Essentials checklist to prepare and confirm scope with an IASME-licensed certification body.
Neither this guide nor a configuration review provides a certificate. A penetration test is also a separate activity requiring its own methods, authorisation and appropriately qualified provider.
What to request from a reviewer
Before commissioning a Microsoft 365 security audit, agree:
- the tenant, users, services and policies in scope;
- who will conduct the work and their relevant experience;
- the evidence and reports they will examine;
- how findings will be prioritised for your business;
- who will authorise and implement changes;
- whether remediation and a recheck are included or separately priced;
- how sensitive evidence will be handled and when access will end.
A useful report distinguishes observed problems, recommended improvements and things that could not be checked. It should also explain licence dependencies so a recommendation does not become an unexpected purchase.
Plan access and changes with the system owner
Use named access with the least permissions needed for the agreed tasks. Read-only roles may be appropriate for parts of a review, but their coverage varies by service and report. Ask the tenant administrator to choose roles rather than handing over a permanent Global Administrator account by default.
Agree a change plan for remediation, including affected users, testing, recovery and communication. Keep a record of what changed and verify the result. A Copilot pilot should follow the relevant access decisions; it should not be used to discover whether sensitive folders were shared correctly.
Never send passwords, recovery codes, secret keys or unredacted customer information through an enquiry form or ordinary email.
Price and timetable: compare the scope
There is no reliable universal price or turnaround for a tenant review. User count, tenant complexity, licence mix, evidence availability and the depth of work all affect it.
Request a written scope and quote. Separate assessment, remediation, licence costs and follow-up checks so you can compare like with like. An inexpensive review of a few settings is a different purchase from a detailed tenant assessment with supervised remediation.
Discuss your Copilot project
Blue Canvas works on AI adoption and workflows. If you are planning Copilot alongside a security review, book a free 15-minute call to discuss the project and what needs to be agreed with your IT provider.
For the wider practical priorities, read cyber security for small business. For checks you can organise yourself, use the DIY audit checklist.
FAQ
What should a Microsoft 365 security audit include?
Agree a scope covering sign-in, privileged access, sharing, forwarding, email protection, information protection, logging and connected applications. Ask for evidence, prioritised findings, limitations and clear ownership of any fixes. The relevant features depend on the tenant’s licences and configuration.
Do we need a review before rolling out Copilot?
Reviewing permissions first helps identify content that users can already access too widely. Microsoft’s deployment guidance starts with oversharing and governance. The depth of review should reflect your data, users, integrations and intended rollout.
We only use free Copilot Chat. Does this still matter?
Yes. Users can supply files or open content, and pay-as-you-go agents can access organisational data. Available features depend on licensing and configuration, so review the actual agents, permissions and data sources in use.
Will a review change our Microsoft 365 settings?
That depends on the agreed scope. An assessment and remediation are different tasks. Any changes should be approved by the system owner, tested and recorded, with affected users and recovery arrangements considered in advance.
Does this cover Cyber Essentials?
A Microsoft 365 review can inform part of your preparation, but Cyber Essentials also covers other systems and controls in scope. Certification is a separate assessment through IASME or a licensed certification body.
Is this the same as Microsoft Security Copilot?
No. Microsoft Security Copilot is a separate Microsoft product for security work. This guide concerns the settings and permissions in the Microsoft 365 environment your staff use, including preparation for Microsoft 365 Copilot.
.svg){kind=small}
.svg){kind=small}