Tenant permission sprawl
Review of role assignments, group memberships, and privileged accounts across the Microsoft 365 tenant.
Service · Copilot readiness · Perth + Remote
Microsoft 365 Copilot readiness assessment for Australian SMBs
Copilot surfaces whatever a user can already access. Before you enable it, you need to know what your tenant is exposing. We assess SharePoint and Teams permission sprawl, oversharing links, sensitivity labels, Purview DLP readiness, licensing, and your pilot group design. Perth-based, working with Australian SMBs nationwide.
1-2wk
typical assessment duration
9+
assessment areas covered
Read-only
scoped tenant access
Perth
in-person or remote AU-wide
01The problem
What Copilot changes about your data
Microsoft 365 Copilot does not create new access. It makes existing access much faster to exploit.
Before Copilot, a user who had accidental access to a confidential SharePoint folder probably never found it. After Copilot, they can ask a natural-language question and get a summary of that document in seconds. Oversharing that was invisible becomes a working data leak.
This is not a Copilot bug. It is the intended design. The fix is to get your permissions, labels and DLP policies right before you turn it on, not after. This assessment does that work systematically.
Note: this assessment covers the tenant before rollout. For teaching staff how to use Copilot effectively once it is live, see our Copilot training service. For a broad, organisation-wide AI opportunity review not specific to Copilot, see the AI readiness audit.
What changes when Copilot is enabledtenant risk
- !Broad SharePoint permissions become searchable. Any site a user can read, Copilot can summarise for them on request.
- !Organisation-wide sharing links are exploitable. A link shared to everyone in the tenant is now a prompt away.
- !Unlabelled files lose policy protection. Purview DLP and retention only apply to labelled content.
- !Old permissions accumulate over years. Staff who changed roles or left may still have lingering access.
02Scope
What we assess
SharePoint and Teams oversharing
Site-level and library-level permission review to identify where access is broader than the business requires.
OneDrive sharing links
Audit of organisation-wide and anyone links that could expose files to all staff or the public.
Sensitivity labels
Check whether labels are defined, published, and consistently applied to files, emails and Teams conversations.
Purview DLP readiness
Review of existing DLP policies for coverage gaps, especially around financial, personal and health-related content.
Label and retention coverage
Assessment of how much content is unlabelled or outside a retention policy, which Copilot can freely surface.
Licensing fit
Confirm the Copilot for Microsoft 365 add-on is correctly assigned and that prerequisite licences are in place.
Pilot group design
Advice on selecting a pilot cohort with appropriate data access scope so early issues surface in a controlled setting.
Admin and governance controls
Review of Copilot admin settings, plugin permissions, and governance policies for ongoing content creation.
03Before and after
Oversharing: the risk most rollouts miss
WITHOUT ASSESSMENT
A finance team SharePoint site was shared with all staff two years ago for a one-off budget announcement. The permission was never removed. Nobody noticed because staff did not browse to it. On day one of the Copilot rollout, any employee who asks Copilot "what is our salary budget?" gets a summary from the document they were never supposed to read.
WITH ASSESSMENT FIRST
The assessment surfaces the broad permission on the finance site before Copilot is enabled. Access is scoped to the finance team. Sensitivity labels are applied to budget documents and a DLP policy restricts sharing. When Copilot goes live, it can only surface finance content to users who are legitimately supposed to see it.
04Deliverables
What you get from the assessment
The output is a written report you can act on. It covers every area in scope, flags the findings by severity, and gives you a clear go/no-go recommendation on Copilot enablement. Where the answer is "not yet," the report explains exactly what needs to change first.
The remediation list is ordered by risk so your IT team or managed service provider can work through it in priority order. Findings that require ongoing DLP policy work are flagged separately. If you need those policies built and maintained after the assessment, that is the scope of our AI data loss prevention service, which pairs directly with this engagement.
Concerned about broader AI security posture, not just Copilot? See AI security for the wider scope.
Assessment design: how access and controls work
- ✓Read-only, scoped Microsoft Graph and SharePoint admin access. No global admin credentials required.
- ✓Go/no-go recommendation with clear criteria for each area assessed.
- ✓Prioritised remediation list ordered by data exposure risk.
- ✓Pilot group design guidance included in the report.
- ✓Sensitive findings handled under a confidentiality agreement.
05Clients
What our clients say
Josh and the VibeZero team turned a mess of ideas into a working product faster than I thought possible. They actually listened to what we needed, didn't overcomplicate things, and delivered something our team could use straight away. Genuinely one of the best tech experiences I've had as a business owner.
NK
Natasja KleinmanFounder, Flexi Tribe
Working with VibeZero was refreshingly straightforward. No jargon, no upselling, just solid work delivered on time. They understood our business from the first call and built exactly what we asked for. I'd recommend them to any small business looking to actually get results from AI.
BG
Blake GoodDirector, Good Designs
06Related
The full capability list
Consulting, automation, security and training, plus the build and fix work when you need it. These are the eight we lead with; 32 in total. Your AI consultant in Perth, working nationally.
01
AI Consulting
Map your ops, find where AI makes sense, build an implementation plan your team can follow.
Learn more02Automation
n8n, Make, Power Automate, custom integrations. The boring weekly tasks, automated.
Learn more03AI Security & DLP
Stop data leaking into AI tools. Usage policy, M365 controls, Privacy Act and Essential Eight aligned.
Learn more04AI Training
Train your whole team to use AI well. Role-based programs, workshops and coaching across Claude, ChatGPT and Copilot.
Learn more05App Development
Apps, tools, MVPs and internal systems built with AI-assisted dev, with senior engineering oversight.
Learn more06Vibe Code Audit & Fix
Built with Claude, Cursor, Bolt or Lovable? We find what's broken, patch it, hand it back production-ready.
Learn more07AI Agents
Custom agents for CRM, accounting, project management. Built with Claude, GPT and MCP.
Learn more08Agentic Coding
Autonomous coding agents build features end-to-end. We review, steer, and ensure production quality.
Learn more07FAQ
Frequently asked questions
It is a fixed-scope review of your Microsoft 365 tenant conducted before you enable Copilot for your organisation. We examine permission sprawl across SharePoint, Teams and OneDrive, check whether sensitivity labels and Purview DLP policies are in place, confirm your licensing covers the features you need, and design a pilot group plan. The output is a written report with a go/no-go recommendation and a prioritised remediation list so you can act on findings before the rollout.
The critical areas are: oversharing across SharePoint sites and Teams channels, wide-open sharing links in OneDrive, missing or inconsistently applied sensitivity labels, gaps in Purview DLP policies, whether your licences include the Copilot add-on and the prerequisite Microsoft 365 E3/E5 or Business Premium plan, and whether your admin controls and governance settings are configured to restrict what Copilot can surface. Staff readiness matters too, though training comes after the tenant is in order. Our assessment covers all of these systematically.
Yes, that is the core risk. Microsoft 365 Copilot surfaces content based on the permissions the querying user already holds. If a SharePoint site grants broad access, or an old sharing link gives everyone in the organisation read rights to a sensitive document, Copilot can retrieve and summarise that content for any user who asks for it. Oversharing that was harmless before, because staff did not know to look, becomes actively searchable the day Copilot turns on. The assessment identifies exactly this class of exposure.
The safest path is to assess the tenant first, remediate the high-priority findings (typically permission sprawl and missing sensitivity labels), then run a controlled pilot with a small, well-chosen group before expanding broadly. Ongoing DLP controls and a clear governance policy for new site creation and sharing links should be in place before the wider rollout. This assessment pairs well with <a href="/services/copilot-training" class="text-[#00f0ff] hover:underline">Copilot training</a>, which covers what the tool can and cannot access, and with <a href="/services/ai-data-loss-prevention" class="text-[#00f0ff] hover:underline">DLP implementation</a> if your policies need building from scratch.
The scope is agreed up front before work starts. A typical assessment covers one Microsoft 365 tenant and runs for approximately one to two weeks depending on tenant size and the number of SharePoint sites and Teams in scope. Access is read-only and uses scoped Microsoft Graph and SharePoint admin permissions. We do not require global admin credentials. Pricing is quoted per engagement after a short discovery call.
Know your tenant is ready before Copilot goes live
Book a Copilot readiness callTake the free AI Risk and Readiness Check
Copilot readiness assessment, Perth or remote across Australia.