Most businesses already have the ingredients for AI productivity in Microsoft 365. What they often lack is an agreed way to protect the information AI can reach.
Microsoft Copilot can help employees draft correspondence, summarise reports, prepare policies and work more effectively in Word, Excel, Outlook and Teams. But adding licences is only the beginning. Before a business lets Copilot work with organisational documents, somebody needs to check access permissions, sensitive information, external connections and accountability.
For Australian organisations using Microsoft 365, here are eight practical controls worth reviewing before a rollout.
First, does Microsoft use company documents to train its AI?
With an eligible work or school account, Microsoft says its enterprise-protected Copilot services do not use prompts, responses or organisational content accessed through Microsoft Graph to train foundation models. Those protections differ from using a personal Microsoft account or an unrelated third-party AI product.
That is an important safeguard, but it is not permission to upload anything. Documents are still processed to provide the requested service. Existing access permissions, retention rules, web-search options and agent terms all matter.
The goal is not to ban AI from confidential work. It is to make sure confidential work happens in the right approved environment.
Eight settings and safeguards to review
1. Require the company work account
Start with identity. Employees should open Copilot through their organisation's Microsoft 365 work account—not a private Microsoft account. Verify Entra ID sign-in, multifactor authentication and any Conditional Access requirements. Train staff to recognise the work-account indicators in Copilot.
Where appropriate, IT can restrict personal-account sign-ins on managed devices. Test the impact first so legitimate business workflows are not disrupted.
2. Fix SharePoint and OneDrive access before scaling
Copilot respects Microsoft 365 permissions. That is useful when permissions are correct; it can be uncomfortable when old SharePoint sites still have overly broad access.
Review:
- Files and sites shared with everyone or large groups.
- External guests and “anyone with the link” sharing.
- Old project libraries, inherited access and ownerless sites.
- HR, Finance, executive and commercially sensitive material.
Microsoft's Restricted Content Discovery can temporarily reduce Copilot discovery of selected high-risk SharePoint sites while permissions are reviewed. It is not a substitute for fixing those permissions.
3. Keep third-party agents and plugins restricted
An agent may do far more than answer a question. Depending on its permissions, it can access connected systems, retrieve data or take actions.
For an initial deployment, limit agent installation and use. Block unapproved external publishers and review every connector's permissions, vendor terms and information flows. Microsoft provides agent controls through the Microsoft 365 admin centre.
4. Review third-party AI model providers
Not every model provider within an AI ecosystem has the same contract.
Microsoft distinguishes between AI subprocessors, operating under Microsoft's enterprise commitments, and certain independent processors with their own terms. An organisation should review these categories and avoid enabling independent processors until their legal, privacy and security terms have been assessed.
5. Decide whether Copilot needs public web search
Copilot can use public web information to improve answers. Microsoft explains that the Bing web-search component follows different data-handling arrangements from Microsoft 365 organisational data.
If the first pilot is focused on internal document drafting and formatting, disabling web search initially is a defensible option. Organisations that need current external research can selectively allow it or use supported data-loss prevention rules to reduce the risk of sensitive details reaching external search services.
6. Configure data-loss prevention rather than relying on staff memory
A written AI policy is important, but staff can make mistakes.
Microsoft Purview can apply rules to Copilot interactions, including protections for sensitive information appearing in prompts. More advanced protections can prevent selected labelled files and emails being used as grounding content.
Check the actual licence entitlements. Microsoft lists prompt-focused Copilot DLP safeguards for business plans, while restricting Copilot's processing of labelled files and emails requires qualifying higher-level licences. Merely applying a “Confidential” label is not, by itself, a universal Copilot block.
7. Control meetings, screen access and new features
AI summaries can be useful for ordinary team meetings, but HR investigations, employee matters, legal discussions and sensitive negotiations call for specific controls.
Review Teams meeting policies, recording/transcription requirements and participant consent. During an initial pilot, also consider limiting screen/camera sharing, optional image-generation features and previews that have not yet been assessed.
8. Stop uncontrolled purchases and measure the pilot
Disable unnecessary self-service purchases and review usage-based agent billing before it creates surprises.
A practical pilot might start with five to ten users across management, administration, Finance, HR and operations. Record which tasks were approved, how much time was saved after checking the output, and whether any unsafe data handling or incorrect results occurred.
A licence is valuable only when it helps people work better without undermining trust in company information.
Can Finance and HR use Copilot safely?
Yes. Excluding whole departments usually misses the point.
A Finance team may benefit from formatting a budget narrative, improving a procedure or drafting commentary. HR may need help writing onboarding packs, position descriptions and internal policies.
The decision should be based on the document and approved workflow, not the department name. A business can grant standing approval for a narrowly defined confidential use case in its work-account Copilot environment. Named medical records, payroll files, bank details, disciplinary cases and other restricted information require stronger controls and specific assessment.
For financial figures, AI is not the authoritative ledger. Totals, calculations and conclusions must still be reconciled against the approved source system.
A sensible rollout sequence
- Assess: Understand licences, sensitive content, permissions and priority business tasks.
- Secure: Configure identity, approved AI features, agents, web access, DLP and governance.
- Pilot: Train a small group on approved, useful tasks.
- Verify: Check accuracy, document handling, staff feedback and measurable value.
- Manage: Reassess permissions, new Copilot features, licences and departmental needs as the rollout grows.
There is no universal list of switches that makes AI completely safe. The right configuration depends on your Microsoft 365 subscriptions, data classifications, organisational risk and the work people are expected to perform.
How Solidity Technology helps
Explore our Microsoft 365 Copilot setup, security and user management service.
Solidity Technology supports Australian businesses with practical AI adoption and Microsoft 365 governance. As part of our Virtual IT Manager and Fractional CIO services—or through a focused project—we help with:
- Microsoft Copilot readiness and licence assessments.
- Secure user provisioning, access and administrator configuration.
- SharePoint, OneDrive and Microsoft 365 permission reviews.
- AI acceptable-use policies, staff instructions and training.
- Data classification, DLP planning and documented departmental workflows.
- Pilot delivery, adoption reporting and ongoing Copilot management.
You get senior, Australian-based technology leadership focused on enabling useful AI without losing control of your data.
Considering Copilot for your business? Book a consultation, call 1800 490 660, or email hello@soliditytechnology.com.
For the broader picture, read our Automation and AI Enablement guide and explore our Microsoft 365 and technology services.