Is Your Business Data Ready for AI? Clean Up Files and Permissions Before Copilot Finds Them

An AI assistant can help an employee find a project document or summarize a meeting in seconds. But what if it finds an outdated policy, a confidential file shared too widely, or notes from a project that ended years ago?

That question is becoming more important as businesses use Microsoft Copilot alongside the files, emails, chats, and other information already in Microsoft 365. Copilot does not grant employees new access to company information: Microsoft says it surfaces organizational content a user already has permission to view. The risk is that old or overly broad permissions may let an employee discover information they should no longer need—or lead Copilot to draw on stale material for an answer.

This is not a reason to avoid AI. It is a reason to get your business data in order before expanding how employees use it.

The Issue Is Not AI Access Alone

Most businesses have some digital clutter. A shared folder was opened to an entire department for a deadline. A former employee’s project site still has access granted to outside collaborators. Several versions of a policy remain in different locations, and no one is sure which one is current.

Before AI, those problems were easy to overlook because finding the material took effort. An assistant that can search and summarize authorized content makes existing permissions and outdated files more consequential. Microsoft’s Copilot preparation guidance - Opens in new window specifically calls for identifying overshared, inactive, ownerless, and sensitive sites and files.

Think of it this way: Copilot can help employees navigate the filing system you have. It cannot decide on its own whether that filing system still reflects your business’s intentions.

Start With the Information That Matters Most

A complete cleanup of every file may be unrealistic. Start with information where incorrect access or an outdated answer could cause the most trouble:

• HR records and employee information.
• Financial documents, pricing, and contracts.
• Customer files and confidential project materials.
• Leadership discussions and strategic plans.
• Policies, procedures, and templates employees regularly rely on.

For each location, ask three questions: Who should see it? Who owns it? Is it still current? These questions give business leaders and their IT partner a manageable way to prioritize the review.

For example, an old pricing sheet may not contain sensitive personal information, but it could still create confusion if someone uses it to prepare a customer quote. An HR folder presents a different concern: the files may be accurate, but the access list may be too broad. Both deserve attention, for different reasons.

Review Sharing Before It Becomes a Surprise

In Microsoft 365, access can come from site membership, groups, folder permissions, individual file sharing, and links. Reviewing only the main folder’s name or its apparent owner may miss who can actually view its contents.

Have your IT team look for company-wide sharing links, access granted to “Everyone except external users,” outside collaborators who no longer need access, and sites whose permissions have grown far beyond the people doing the work. Microsoft recommends reviewing high-risk sites, removing excessive or anonymous access, narrowing sharing links to appropriate people or groups, and confirming site ownership.

The answer is not to lock down everything. Teams need to collaborate. The goal is to make access intentional: people should be able to find the information they need, while sensitive material is shared only with the people who should have it.

Give Old Content a Clear Status

Files do not become more useful simply because they remain searchable. Outdated procedures, duplicate templates, and inactive project materials can make it harder for employees—and AI tools—to identify the right answer.

Assign someone who understands the work to review important collections of files. Decide what should remain active, what needs a clear “superseded” label, what should be archived, and what can be deleted under your organization’s retention rules. Include old Teams recordings and transcripts in that review when they are no longer needed.

Microsoft announced new September 2026 capabilities to archive inactive SharePoint content without archiving an entire site. It says archived content remains subject to retention and legal holds and discoverable through eDiscovery, while dropping out of Microsoft 365 Copilot indexing until reactivated. Microsoft also described a separate, approved cleanup process for permanently deleting stale content. These are options to evaluate with your IT and records owners—not a signal to delete old files indiscriminately (Microsoft - Opens in new window).

Put Someone in Charge of Each Shared Space

A SharePoint site or shared workspace can outlive the project or employee who created it. Without a clear owner, no one may be responsible for checking membership, updating documents, or deciding whether the space should remain active.

A practical ownership review should establish:

• Who is accountable for the site or shared folder.
• Whether its members and guests still need access.
• Which documents are authoritative.
• Whether the space should stay active, be archived, or be retired.

Microsoft’s guidance calls for confirming ownership and addressing inactive or obsolete sites as part of ongoing Copilot readiness. This is not just an administrative task: a business owner can determine whether a document is current in a way an IT tool cannot.

Use Safeguards While Cleanup Is Underway

A business does not need to finish every cleanup task before it can make progress. If your IT team identifies a particularly sensitive or overshared site, Microsoft describes controls that can temporarily limit its discoverability in Copilot while permissions are reviewed and corrected. The appropriate approach depends on your Microsoft 365 configuration and licensing.

These safeguards are a bridge, not a replacement for fixing access. Once the right people can view the right content and ownership is clear, your IT partner can reassess the temporary restrictions. The lasting improvement comes from cleaner permissions and better-maintained information.

Make Data Readiness Manageable

For a small business, a focused first pass is more valuable than a sweeping cleanup that never gets finished. Begin with a handful of high-value sites or shared folders and work through a simple sequence:

1. Identify sensitive and frequently used content.
2. Confirm the business owner for each location.
3. Review who can access the site, folders, files, and sharing links.
4. Correct access that is broader than intended.
5. Mark outdated material, archive it where appropriate, or delete it under approved retention rules.
6. Repeat the review as teams, projects, and employees change.

Microsoft frames Copilot preparation around remediating oversharing, establishing guardrails, and maintaining data hygiene over time. The same work helps employees find more reliable information even if your business is not yet using Copilot.

A Better Foundation for Useful AI

AI readiness is not just about selecting a tool or buying a license. It is also about making sure the information that tool can use is accurate, appropriately shared, and owned by someone who can keep it that way.

If your organization is preparing to use Microsoft Copilot—or wants a clearer picture of how its Microsoft 365 data is currently shared—ExcalTech can help review permissions, identify priority cleanup areas, and plan practical safeguards. A more orderly information environment gives your team a better foundation for using AI confidently, without creating unnecessary complexity. Learn more about Microsoft 365 services with ExcalTech or click the button below to request a call.