A survey of 279 enterprise technology, security, infrastructure and compliance leaders found that 66% had paused or abandoned rollout plans because of concerns over data that Copilot could retrieve through SharePoint. Nearly three-quarters, or 73%, feared AI tools were already surfacing sensitive material internally.
The findings underscore a widening gap between corporate enthusiasm for generative AI and the ability of organisations to control the information fed into such systems. Microsoft 365 Copilot can search emails, documents, meetings, chats and other workplace data that an employee is authorised to access, enabling it to draft content, summarise discussions and answer questions.
That capability can also make forgotten or misconfigured files easier to find. Information that was technically accessible but buried inside sprawling document libraries can be identified through a simple natural-language request, increasing the consequences of outdated permissions, anonymous links and excessive access rights.
Concern was strongest among senior decision-makers. Three-quarters of C-suite executives and vice-presidents said their organisations had delayed or cancelled deployment, compared with 60% of managers. Directors reported a figure of about 70%.
The caution reflects the potential exposure of board documents, legal correspondence, financial forecasts, redundancy plans, salary records and other confidential material. Such information may have remained largely unnoticed for years despite being available to employees who did not require it for their work.
SharePoint sharing practices emerged as a central problem. Organisations that had postponed Copilot were more than three times as likely to express serious concern about anonymous SharePoint links as those that had proceeded with deployment. The respective figures were 48% and 14%.
The security risk does not necessarily arise from Copilot bypassing established access controls. Microsoft says the service respects existing Microsoft 365 permissions and retrieves information available to the individual user. The difficulty is that those underlying permissions may already be too broad, poorly documented or no longer appropriate.
Many organisations have accumulated years of shared folders, inherited access rights, abandoned collaboration sites and links created for contractors or former employees. Rapid business expansion, acquisitions and hybrid working have added further complexity to corporate Microsoft 365 environments.
The survey indicated that 73% of organisations experienced growth in SharePoint storage during the past year. At the same time, 63% deferred or restricted user access reviews because the process required too much time, while 46% struggled to persuade employees to complete them.
Security confidence also appeared to exceed operational readiness. Although 62% of respondents described their Microsoft 365 security posture as established or advanced, 54% of that group lacked at least one fundamental control. The missing safeguards included mandatory multi-factor authentication for administrators, privileged access management and systems capable of detecting configuration tampering.
Administrator accounts were less consistently protected than ordinary employee accounts. Full multi-factor authentication was enforced for 55% of administrators, compared with 62% of standard users. Almost one-fifth of organisations applied weaker authentication requirements to accounts capable of altering security settings, granting permissions or accessing extensive corporate records.
Adoption of privileged access management has nevertheless increased. About 73% of organisations now use Microsoft Entra Privileged Identity Management or another privileged access system, up from 50% a year earlier. Administrative workload and the difficulty of designing restricted roles remain significant obstacles.
Configuration protection presents another weakness. Only 17% of organisations said they backed up their own Microsoft 365 configurations, while 37% believed Microsoft handled that task automatically. Data backups may preserve files and emails, but they do not always restore the permissions, policies and tenant settings that govern how information is accessed.
Microsoft has promoted data classification, sensitivity labels, information protection and data-loss prevention policies as foundations for secure Copilot adoption. Its Purview tools can identify sensitive content, monitor AI interactions and restrict the handling of regulated or confidential data.
The company maintains that prompts, responses and business information used by Microsoft 365 Copilot are covered by enterprise data-protection commitments and are not used to train the underlying foundation models. Organisations, however, remain responsible for deciding which users can access particular records and for correcting excessive permissions.
The deployment delays are therefore shifting corporate AI programmes towards phased adoption. Businesses are increasingly testing Copilot with limited user groups, excluding highly sensitive departments and auditing SharePoint estates before extending access across the workforce.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
