Copilot will not leak your client files. Your permissions will.

The sentence that sells Microsoft 365 Copilot into a law firm is the same sentence that should stop the rollout for a fortnight.

Copilot can only see what the person asking can already see.

It is true, it is the right design, and Microsoft documents it plainly. Copilot honours existing Microsoft 365 permissions; it does not grant access to anything a user could not already open for themselves.

In most businesses that is reassuring. In a law firm it is a question, because it quietly relocates a problem. Whatever your permissions currently allow is now not a filing habit. It is the firm's confidentiality posture, available on demand, in natural language, to anyone with a licence.

The gap between "could access" and "has ever accessed"

Every firm has content people are technically able to open and never do, because they do not know it is there. A matter folder on a legacy drive. A SharePoint site inherited from a department that was restructured. A Teams channel from a transaction that closed in 2022. A document library somebody shared with "everyone in the organisation" to solve a problem on a Friday.

That gap — between theoretical access and actual access — is load-bearing in a lot of firms, and nobody planned it. Obscurity was doing the work that permissions were supposed to do.

Copilot closes the gap. Not by breaking anything, but by making the content findable in one sentence rather than three correct guesses. A question like "what do we have on this counterparty" now returns what the permission model actually permits, not what the asker happened to know about.

Four findings we see in almost every legal tenant

1. The legacy matter drive

Migrated from a file server, permissions carried across as-is or flattened to make the migration finish. It is the single most common source of "I did not know I could open that".

2. Organisation-wide sharing links

Created for convenience, never revoked, and invisible unless you go looking. The person who created one usually remembers the document and not the link.

3. Departed-fee-earner OneDrive

Reassigned to a manager during offboarding, which is correct practice, and then never reviewed. Client material sits in a personal store with a new owner who has no idea what is in it.

4. Information barriers that exist on paper

The firm has a conflicts policy and an ethical-wall arrangement. Whether it is implemented in the tenant is a different question. Microsoft Purview information barriers are the mechanism that enforces it in Teams, SharePoint and OneDrive — and a wall that was only ever an instruction to staff is not a control Copilot will respect, because there is nothing there to respect.

What to settle before the first licence is assigned

In the order that actually reduces risk fastest, rather than the order a project plan would put them:

Find out what is overshared, before Copilot does

Not a policy review — a report. Which sites and libraries are reachable by more people than the matter team, which links are organisation-wide, which content has no owner. This is the whole job of Copilot SafeScan, and it is read-only, so it answers the question without changing anything while you are still deciding.

Reduce the blast radius while you fix it

Microsoft gives you two controls that are worth knowing about specifically because they buy time. Restricted SharePoint Search limits Copilot and search to an allow-list of sites, and Restricted Content Discovery takes named sites out of Copilot's reach without touching who can open them directly. Neither is a substitute for fixing permissions. Both let you start a pilot without betting the firm on the clean-up finishing first.

Label what matters, and mean it

Sensitivity labels are honoured by Copilot, and a label with encryption travels into what Copilot produces from the content. For a firm this is the difference between a confidentiality marking that is a footer and one that is enforced. It is also the only control on this list that keeps working after the document leaves the tenant.

Implement the wall

If the firm operates ethical walls, they need to exist in Entra and Purview, not only in the conflicts policy. This is the item most likely to need your COLP or compliance lead in the room rather than IT alone — the technical configuration is straightforward, but what it must enforce is a professional-conduct judgement, and it is theirs to make.

What Copilot keeps, and who can read it

The second question a careful firm asks is what happens to the prompts and the answers. The honest version:

• Interactions are stored in the user's mailbox, which means they are subject to the firm's retention policies and discoverable through eDiscovery like other mailbox content. Decide what your retention period should be before you have two years of it.
• Activity is audited. Copilot events appear in the Purview audit log, so "who asked what, and when" is answerable.
• Your prompts and responses are not used to train the foundation models. Microsoft states this explicitly in the privacy documentation, and it is the point to quote when the question comes from a client rather than from IT.
• Data stays inside the service boundary, with the EU Data Boundary applying where it applies. Where a client engagement imposes a residency term, that term is the thing to check it against — the architecture documentation is the reference.

The thing worth saying to the partners

Copilot does not create a confidentiality risk. It converts a dormant one into an active one, and it does so quickly and in public.

That is an uncomfortable framing and also a useful one, because it means the work is work the firm needed to do anyway. Oversharing is a problem on the day a file is wrongly disclosed, with or without AI in the building. What Copilot changes is the probability and the timeline.

A fortnight of looking before switching it on is, in our experience, the best-value fortnight in the whole programme.

Copilot SafeScan reports what Copilot would be able to surface in your tenant, read-only, before anybody gets a licence. If the answer is "more than we thought", that is the work we do next.