Every Microsoft 365 tenant has content that is technically accessible to far more people than anyone intended. It has always been that way, and it has mostly been harmless, because nobody could find the files. An AI assistant that searches everything a user can see changes that overnight. Copilot does not create over-sharing. It reveals it.
For a public pension administrator preparing its rollout, that made the privacy and security review a data problem before it was a policy problem.
Measure the exposure
I led a reporting program using Microsoft Purview and Power BI to identify and mitigate security and privacy risks ahead of the rollout. Purview knows what content is sensitive and how it is labelled; the tenant knows who can reach it. Joining those two pictures, and putting the result in front of the people who own the content, turned an abstract worry into a list with names on it.
The dashboard answered the questions a privacy officer and a records manager actually ask. Where does sensitive content sit in sites open to everyone? Which libraries have labels missing? Which sharing links have no expiry? Each question became a view, each view had an owner, and remediation could be tracked as counts falling week over week.
Make the extract repeatable
A one-time report would have been out of date before the rollout. I documented an analytics operations process for continuous integration and delivery, from Purview extracts through to Power BI ingestion, so the exposure picture refreshed without a person rebuilding it. Governance reporting that depends on someone remembering to run it is not governance.
The migration underneath
None of this stood alone. The organization was migrating content from LAN drives and a legacy content management system into Microsoft 365, and I had run the collaborative workshops with eight business areas to capture their migration, metadata, and workflow requirements. A Power BI dashboard reconciled the migration in near real time, which meant the same tooling that tracked what moved could also show what moved into the wrong place.
The SharePoint governance model I documented tied short-term migration decisions to the enterprise taxonomy, so that the labels Purview relied on were the labels the migration applied. Requirements from every area lived in one backlog with a prioritization framework, which is the only way eight business areas agree on a sequence.
A workflow for the genuinely sensitive
One case needed more than a dashboard. Customer-sensitive information had to be shared between the pension administrator and a Crown insurer, securely, with a defined governance process for how the data was used and eventually disposed of. I designed and documented that workflow end to end. It is the kind of artifact nobody notices when it works and everybody asks for when a regulator calls.
The point
The technology to find over-shared content has existed for years. What Copilot supplied was urgency. Organizations that treat the AI rollout as a permissions and labelling project, measured with the tools they already own, get a safer tenant whether or not they ever switch the assistant on.