AI tools are transformative because they make business data dramatically easier for employees to access, search, and understand. Ensuring employees only have access to the right data is critical to keeping your business information secure.
In the first post of this series, we talked about putting an AI policy in place, so your team knows the rules. In the second, we talked about setting your AI direction: what you want AI to do for your business and where it fits.
This post is about the next step: ensuring your Microsoft 365 data is ready for AI.
AI Sees All
Ask an assistant to “summarize everything about our compensation plans,” and information a user has permission to access can suddenly become much easier to find.
This is incredibly useful when permissions are right. It’s a big problem when a spreadsheet containing executive compensation was accidentally dropped into the wrong SharePoint site years ago, and nobody noticed.
The Oversharing Problem Hiding in Microsoft 365
For many small and mid-sized businesses, Microsoft 365 is where much of the company’s knowledge lives: email in Outlook, files in SharePoint and OneDrive, and conversations in Teams.
Tools like Microsoft 365 Copilot and Claude are designed to respect a user’s existing permissions. The challenge is that those permissions may not be what you think they are.
In Microsoft 365 environments, we commonly find:
- Old sharing links that were created years ago and never removed.
- SharePoint sites and Teams with overly broad access, giving employees broader access than intended.
- Former employees, vendors, and guests who still have access.
- Stale data containing client, HR, financial, or other sensitive information.
- Inconsistent permissions, where folders and libraries have permissions that differ from the rest of the site.
- Complex permissions that are no longer monitored or maintained, especially unique permissions within SharePoint folders.
These problems were less visible when finding information meant knowing what file existed and where it was stored. Once AI is connected, information that might otherwise have remained hidden can suddenly become much easier to find.
Clean Up Access Before You Add More AI
The answer is to understand what information you have, who can access it, and whether that access still makes sense.
Start with an access review of SharePoint, Teams, shared OneDrive content, and other areas containing important company information.
Remove sharing links that no longer serve a purpose. Review public or broadly accessible Teams and SharePoint sites. Remove former employees, vendors, and guests who no longer need access. Tighten sharing practices so employees aren’t unintentionally granting broader access than necessary.
A useful question to ask is:
If an employee can find this information through AI tomorrow, are we comfortable with that employee seeing it today?
If the answer is no, the problem isn’t really AI. It’s access.
Classify and Protect Sensitive Information
Microsoft Purview sensitivity labels help businesses identify sensitive information and apply appropriate protections to it. Small and mid-sized businesses often skip configuring these labels because doing it properly takes time and effort. That becomes a bigger concern as AI makes information throughout Microsoft 365 easier to find and use.
For many businesses, classifications such as Public, General, Confidential, and Highly Confidential are enough to establish meaningful protections in the beginning. More complex rules can be added as your data controls mature.
Some information can be automatically classified using rules, but human review remains an important part of the process. A thorough review of your data should be planned and budgeted as part of your AI deployment project.
Once sensitivity labels are in place, Data Loss Prevention (DLP) can provide additional controls for particularly sensitive information, such as Social Security numbers, banking information, financial records, and other protected data.
Take a Deeper Look at Your Most Sensitive Data
Once data is classified, take a deeper look at how your most sensitive information is secured. For example, an HR SharePoint site should not simply be labeled “Highly Confidential.” You should know exactly who has access to the site, whether access is granted directly or through a Microsoft 365 or security group, whether outside guests are present, and whether any files or folders have been shared separately.
Do the same for finance, payroll, legal, executive, and other sensitive areas.
Look specifically for:
- People who no longer need access.
- Broad groups that provide more access than intended.
- Guest or external users.
- Old sharing links.
- Files or folders with unique permissions.
- Sensitive information stored somewhere less secure than it should be.
- Information that should no longer be retained.
For your most sensitive information, these reviews should happen regularly, not just when you’re preparing to deploy AI.
Someone Should Own the Data
Technology can tell you who has access. It can’t always tell you who should have access. That’s a business decision.
Your MSP can determine that 43 employees have access to an accounting SharePoint site. But your MSP may not know whether all 43 actually need that access. The CFO or controller is in a much better position to answer that question.
Assign a business owner to sensitive areas such as HR, finance, legal, operations, and executive information. The owner should periodically review who has access, which outside parties still need access, and whether the information still needs to be retained.
Assigning data ownership helps ensure that the right people are making the decisions needed to secure your data.
Don’t Keep Everything Forever
Old information creates risk.
Businesses accumulate years of files because storage is inexpensive and deleting information feels risky. Old client data, spreadsheets, contracts, reports, exports, and employee records can remain accessible long after they’re needed.
AI can bring that forgotten information back to the surface, making outdated or sensitive data much easier to find.
Create retention rules and policies based on business needs, contractual obligations, industry requirements, and applicable laws.
Keep information when there’s a legitimate reason to keep it. Archive or dispose of it appropriately when there isn’t.
Good data retention doesn’t just reduce risk. It can also make AI more useful. An employee asking about a current client shouldn’t have to sort through ten-year-old agreements, outdated pricing, and obsolete project documents to find today’s answer.
Your Microsoft 365 AI Readiness Checklist
Before rolling out AI with Microsoft 365 access, make sure you can answer yes to these questions:
- Do we know who can access our sensitive information?
- Have we removed unnecessary sharing links, guests, and outdated permissions?
- Have we identified and labeled confidential, regulated, and other sensitive information?
- Have we reviewed access to HR, finance, payroll, legal, executive, and other sensitive areas?
- Does each sensitive area have a business owner who decides who should have access?
- Do we have a plan for information we no longer need?
- Are we reviewing these controls regularly rather than treating AI readiness as a one-time project?
If any of the answers are “I don’t know,” that’s a good indication that cleanup is needed before you connect your Microsoft 365 environment to AI.
Get Your Data Ready Before AI Finds It
Capstan Services helps businesses assess their Microsoft 365 environments, identify unnecessary access, secure sensitive information, and prepare their data for AI.
If you’d like to see what an AI assessment could potentially discover in your Microsoft 365 environment, let’s talk.