TL;DR: Copilot doesn't create a data leak. It reveals the permissions you already had. When an AI assistant reads everything a user can reach, every overshared SharePoint site and every unlabeled file shows up in an answer. Nine client calls between March 31 and August 21, 2026 hit this same wall. The fix starts with classification, because the data tier is what sets how much an agent gets to do.
A health system's security lead said it plainly on a June 24, 2026 call. If Copilot starts using people's permissions, it could find things they shouldn't know about. Then he added the part that stuck with me. Their "confidential" label was used sparingly, and only when a site owner remembered.
That's the whole problem in two sentences. The assistant didn't break a rule. The rules were never written down where a machine could read them.
Why does Copilot surface data nobody meant to share?
Copilot answers with whatever the signed-in user can already open. It doesn't get its own access. It borrows the user's. So if a budgeting site was left open to "everyone" three years ago and nobody noticed, Copilot notices. It reads the site and hands a summary to anyone who asks the right question.
Microsoft's own docs say this directly. Their Restricted SharePoint Search page states that the control "isn't a security boundary and doesn't change any permissions on SharePoint sites." Copilot responses "use existing SharePoint permissions." The tool honors what you set. The trouble is what you set, years ago, in a hurry.
Search used to hide this. A person had to know a site existed and go looking. An AI assistant doesn't need to know. It asks the index for everything matching "salary review" and the index delivers.
Your permissions didn't get worse when Copilot arrived. They got visible.
How often does this actually come up on client calls?
Nine times between March 31 and August 21, 2026, on calls with organizations that share almost nothing else.
March 31, 2026. A federal agency more than three years into Zero Trust. Identity centralized, MFA in place, segmentation deploying. Every pillar mature except data. The security lead's words: they don't have all their data properly categorized and labeled, so how do they limit AI from touching data it shouldn't.
May 11, 2026. An investment bank, same question, different industry.
June 24, 2026. Two calls in one day. A large technology company and the health system above, both with generative AI pilots landing on unlabeled data.
July 17, 2026. A credit union with a security team under ten people, mostly on Microsoft E3 licenses, early in inventory and tagging. Their own read was that the Copilot project would outrun classification.
August 10, 2026. A manufacturer, and the first call where data governance was the whole brief instead of a side note.
August 17, 2026. A university that had approved ChatGPT for confidential data with no data classification and no device inventory. Users wanted every plugin. When security asked whether they could say no, the answer was "of course not."
August 19, 2026. Another university with 2,800 Copilot chat users. Their team's phrase for the rollout was "unleashed the bots."
August 21, 2026. A holding company with 22 business units, facing the same question at 22 times the scale.
That's nine organizations across government, finance, health care, manufacturing, and higher education. Same wall each time. The pilot is live. The labels aren't. No vendor report gave me that count. My call notes did.
Why is classification the first control, not the last?
Because the data tier is the input that decides everything downstream. Before you can set what an agent is allowed to do, you have to know what it's allowed to touch.
In a governed setup, intake asks one question first: what data does this agent read or write. The answer sets the risk tier. The tier then decides two things. Which tools need an approval gate, meaning a human check before the action runs. And what autonomy level the agent starts at, including whether it can reach restricted data at all.
Skip classification and that chain has no first link. You end up guessing the tier, and a guessed tier means a guessed blast radius. Blast radius is the set of things an agent can damage if it goes wrong. The question of what your AI agent can access right now has no honest answer until the data it reaches has a label.
In the Agentic Trust Framework, the framework I built and CSA published in February 2026, this is the third of five questions. Who are you. What are you doing. What are you eating and serving. Where can you go. What if you go rogue. That third one is data governance, and it's the one most teams answer last.
The federal agency on the March call had done the hard identity work. They still couldn't approve a single AI use case. Not because identity failed. Because the data pillar was the one piece nobody had finished.
What should you do in the first 30 days?
Start with the sites, not the files. Files number in the millions. Sites number in the hundreds, and a handful of them hold most of the exposure.
Microsoft's deployment blueprint for Copilot, updated May 6, 2026, is built on three pillars, and the first one is remediating oversharing. It sits ahead of guardrails for a reason. You can read the Microsoft Copilot secure and governed deployment blueprint for the full activity list. The practical version fits in four moves.
Pull the report of sites shared with "everyone" or "everyone except external users." SharePoint Advanced Management ships this report, and Microsoft says it's included with the Copilot license. That list is your exposure map.
Fix the top 20 by traffic before you touch anything else. Twenty sites with tightened permissions beats two hundred with a plan.
Pick four labels, not seven. Public, internal, confidential, restricted. A holding company with 22 business units can't agree on seven tiers. Four they can live with.
Auto-label where the content gives itself away. Account numbers, health records, salary fields, and card numbers have patterns a scanner can catch. Let the tooling take the first pass so humans only argue about edge cases.
None of this finishes classification. It finishes the part that's carrying most of the risk, which is the part that decides whether a pilot can go forward.
Is Restricted SharePoint Search a fix or a stall?
A stall, and Microsoft says so. Their docs call it "a short-term solution" that "isn't intended or scalable for long-term use." It caps at 100 sites. And as of July 31, 2026, new enablement is blocked, because the feature is retiring in favor of Restricted Content Discovery.
You can read the current Restricted SharePoint Search guidance yourself. The important line is that it "doesn't guarantee that only sites on the allow list show up." A site a user visited last week still appears. So does anything shared with them in Teams or Outlook.
I've watched teams treat that allow list as the finish line. It's the starting gun. The docs end with "after you validate permissions and governance controls, disable Restricted SharePoint Search." The control exists to buy you time to do the classification work. It was never meant to replace it.
There's a cost to leaving it on, and Microsoft names it. With the restriction enabled, Copilot "has less information available to reference," which affects the accuracy of its answers. Less exposure, less useful. The only way out of that trade is to fix the permissions underneath.
What does a small team do when classification will take a year?
Scope the pilot to the data you've already labeled, and grow it as the labels grow. This is the same move a small security team uses to govern AI without a new program, applied to one control instead of all of them.
The credit union on the July call had this exact constraint. A team under ten people on E3 licenses, and a business that wanted Copilot now. Their own read was that the project would outrun the labels. That read is correct, and it's also the reason to write the scope down before the pilot starts rather than after.
A written scope gives you two things. A pilot that can ship. And a boundary you can defend when someone asks what the assistant could reach.
The trap is the other direction. A rollout to 2,800 users with no labels doesn't get easier to fix later. Every answer Copilot gives from an overshared site is a small incident nobody logged.
Key takeaways:
Copilot reads with the user's existing permissions. Microsoft's docs state it "doesn't change any permissions on SharePoint sites." Oversharing you had in 2023 becomes visible in 2026.
Nine client calls between March 31 and August 21, 2026, across government, finance, health care, manufacturing, and higher education, hit the same wall: pilot live, labels missing.
Data classification sets the risk tier, and the tier sets autonomy and approval gates. Skip it and every downstream control is a guess.
Restricted SharePoint Search caps at 100 sites and blocks new enablement as of July 31, 2026. It buys time. It doesn't finish the job.
Fix the top 20 overshared sites first and pick four labels, not seven. A holding company with 22 business units won't agree on more.
Frequently asked questions
Does Copilot bypass SharePoint permissions?
No. It uses them exactly as set. That's the problem. Permissions set loosely years ago were hidden by the fact that nobody knew to look. An assistant that searches everything a user can open removes that cover.
We turned on Restricted SharePoint Search. Are we done?
You've started. The 100-site allow list is a temporary filter while you fix the underlying access. Microsoft's own process ends with disabling it. Users who recently visited a site or had it shared in Teams still see it in answers.
How many classification labels should we use?
Four to start. Public, internal, confidential, restricted. Every extra tier is one more thing 22 business units have to agree on. Add a fifth only when a regulator or a contract forces it.
Should we pause the Copilot pilot until classification is finished?
Scope it instead. Limit the pilot to sites you've labeled and reviewed. Grow the scope as labels grow. A paused pilot produces shadow use within weeks. A scoped one produces a boundary you can defend.
Where does this fit in Zero Trust?
Zero Trust is the foundation, and data is one of its pillars. The federal agency on the March call had built every other pillar and still couldn't approve AI, because the data pillar was the one that lagged. Agents need one more check on top of that foundation: a data tier that sets how much they get to do.
Is this only a Microsoft problem?
No. Any assistant that grounds answers in a user's reachable data has the same shape. The university that approved ChatGPT for confidential data with no classification had the problem without a single Copilot license. Microsoft is just where most teams meet it first.
The ledger says the same thing nine times. Your AI pilot will go live before your labels are done. The only choice you get is whether the scope is written down before that happens.