A five-minute diagnostic identifies review priorities. Checking which files employees can actually open requires a review inside Microsoft 365.
New York, NY, Oct. 23, 2026 (GLOBE NEWSWIRE) -- In June 2026, Microsoft began rolling out a Microsoft Purview data loss prevention control for Microsoft 365 Copilot in its government clouds (GCC, GCC High, and DoD) that stops Copilot from returning a response when a prompt pulls in sensitive data. The control reduces oversharing risk, but it works on top of the access model a tenant already has, so eSoftware Associates (ESW) advises regulated organizations preparing for Copilot to pair a readiness assessment with a review of who can access sensitive files.
Copilot can surface organizational content the signed-in user already has permission to access. Files shared more broadly than intended can therefore appear in its responses, even though Copilot grants no new permissions.
What the readiness assessment provides
ESW's AI readiness assessment is a free, five-minute diagnostic across six areas, including governance and Copilot readiness. Its report includes severity information, a dollar exposure range and a prioritized 90-day plan. The diagnostic does not inspect tenant permissions; confirming actual access requires a review of the organization's Microsoft 365 environment. The Purview control works the same way. It blocks prompts that pull in labeled sensitive data, but it relies on files being correctly labeled and permissioned first, which is what the access review establishes.
ESW's regulated-environment work includes more than 200 migrations into Microsoft 365 GCC and GCC High with zero data loss and its Microsoft consulting team is 100% U.S.-based.
Access settings to check before rollout
Start with sensitive records: engineering drawings and export-controlled files in manufacturing, construction bid files, biotech research records, patient information, and government contract data. Review how access was granted and whether it is still needed.
- Organization-wide sharing links: Identify sensitive files shared with everyone in the organization. Confirm the intended audience with the information owner, then replace unnecessarily broad links with access for approved users or groups.
- Sites from completed projects: Check who can still open the site and which records must be retained. Keep access needed for ongoing work, audits or records obligations, and remove access that no longer has an authorized purpose.
- Guest accounts from past vendors: Confirm whether each guest still has a current engagement and needs access to the shared content. Remove access that is no longer required.
“Just because a project is finished doesn’t mean everyone’s access should stay the same. The team responsible for the files needs to check who still needs them before IT updates permissions,” said Russell Kommer, founder and CEO of eSoftware Associates.
Frequently Asked Questions
Question: What is oversharing in Microsoft 365, and why does it matter for Copilot?
Answer: Oversharing is access broader than a file's sensitivity warrants. This includes sensitive files open to the whole organization through sharing links, project sites that still include people from finished work and guest accounts that outlast a vendor engagement. Copilot does not create that access. It makes the access easier to act on, because a single prompt can draw on content from files the user is already allowed to open.
Question: Can a Copilot pilot begin while other access issues are being fixed?
Answer: Yes, if the pilot group's access is checked first. Review the content and permissions those users can reach, and correct or restrict any serious exposure before turning Copilot on for them. Keeping the group small does not limit what Copilot can surface.
Question: Which findings should be resolved before Copilot access expands?
Answer: Start with findings tied to regulated data, such as patient records, export-controlled files or contract data that people outside the responsible team can reach. Other findings can be handled alongside expansion once the risk review confirms they do not expose sensitive information and required control does not depend on fixing them.
Question: Is Microsoft 365 Copilot HIPAA compliant?
Answer: Microsoft says Copilot and Copilot Chat support HIPAA compliance when properly configured. Covered entities and business associates need a Business Associate Agreement covering the services used, along with appropriate administrative, physical and technical safeguards. Web search queries are not covered by Microsoft's Data Protection Addendum or BAA. A BAA alone does not make an organization compliant. Confirm coverage and settings for the specific service and environment before using protected health information.
Question: Can Copilot be used with ITAR or controlled unclassified information?
Answer: Microsoft positions GCC High for organizations that handle CUI or whose contracts require DFARS, ITAR or EAR compliance. It positions GCC for workloads that do not involve ITAR, DFARS-regulated CUI or DoD mission data. The data involved, applicable regulatory obligations and contract requirements determine the appropriate environment, and the organization should confirm that the planned Copilot capabilities are available there before licensing them.
Organizations preparing a rollout can review ESW's Microsoft Copilot and AI agents consulting.
Source: Microsoft 365 Roadmap — Feature ID 561892.
About eSoftware Associates (ESW)
ESW builds secure business apps, workflows, portals, and automations across Power Apps, SharePoint, Dataverse, SPFx, Copilot & AI Agents, and Azure. 100% U.S.-based since 2006.
