What can my AI access in my environment?
Alex HunteFounder & Lead ArchitectPublished 20 October 2026 · 5 min readIf your AI is Microsoft Copilot, the short answer is: everything the person using it can already open. Copilot reads email, calendars, Teams chats, meetings and files through Microsoft Graph, and it only shows content the user has at least view permission for. It gets no new access of its own. What it changes is how easy it becomes to find what people could already reach, and that is where the risk sits.
Copilot sees what the user can see
Microsoft describes Copilot as connecting a large language model to your organisation's content: the user's documents, emails, calendar, chats, meetings and contacts, combined with what they are working on right now. Its own words are that Copilot "only surfaces organizational data to which individual users have at least view permissions" (Microsoft Learn).
Two things follow from that. A file someone cannot open, Copilot cannot use for them. And a file someone can open, Copilot can use, even if they never knew it was there. Where a document is encrypted with a sensitivity label, Copilot honours the usage rights the label gives that user.
The real question is what your people can already see
Most businesses have years of sharing that nobody has looked at since: a site opened up to everyone for a project, a folder shared with "everyone except external users", a Teams channel that outlived its purpose, guests who were never removed. Before AI, finding any of it meant knowing where to look. Now anyone can ask.
If a spreadsheet of salaries sits on a site the whole company can open, anyone can ask Copilot about pay and get an answer drawn from it. Copilot has broken no rule. The permission was already there.
Microsoft’s own guidance is to use the permission models in Microsoft 365 to make sure the right people have access to the right content. Fixing oversharing is the work that makes Copilot safe to switch on.
Beyond Copilot: agents, connectors and other apps
Copilot is rarely the only AI with a route into your data. Each of these reaches it a different way, and each has its own control:
| What | What it can reach | Who controls it |
|---|---|---|
| Copilot | Email, files, chats and meetings the user can already open | Your Microsoft 365 permissions and sensitivity labels |
| Graph connectors | Data brought in from other systems, such as a ticketing tool or a wiki | The permissions carried over from the source system |
| Agents | Whatever the agent is built to query, on the user’s behalf | Your admin, who chooses which agents are allowed in the Microsoft 365 admin centre |
| Other AI apps | What a user agreed the app could read when they signed in with a work account, such as their mailbox | Your Microsoft Entra user consent settings |
| Web search | A short search query, sent to Bing with user and tenant identifiers removed | Your admin, who can turn web search off |
The fourth row is the one most often missed. By default, any user can let an app read data on their behalf for permissions that do not need an administrator, such as reading their own mailbox. Microsoft recommends allowing user consent only for apps from verified publishers (Microsoft Learn). An AI note-taker or email assistant a colleague signed up for can hold exactly that kind of access.
How to find out what your AI can reach
- Run SharePoint's Data Access Governance reports. They show which sites are shared with everyone or with large groups, and which sites need an owner to review them.
- Keep your most sensitive sites out of Copilot while you fix them. Restricted Content Discovery stops a site turning up in organisation-wide search and Copilot without changing anyone's permissions. Restricted Access Control limits a site to named groups, even for people holding an old link.
- Review the enterprise apps in Microsoft Entra: which apps users have consented to, and what each one can read. Tighten the user consent setting so new apps need a verified publisher or an administrator.
- Check which agents are allowed under Integrated apps in the Microsoft 365 admin centre, and read the terms and privacy statement of each one.
- Label what matters. Sensitivity labels that encrypt a document decide what Copilot can do with it for each user.
The short version
Your AI can access whatever the person using it can access. Copilot adds no permissions, but it makes existing ones easy to exploit by accident, so the safe way to roll it out is to fix oversharing first. Then check the other routes in: connectors, agents, and the apps your users have let into their mailboxes.
If you do not know what AI is already running in your estate, our AI and agent readiness assessment inventories every AI system and agent, classifies the risk, and gives you a prioritised plan.
More insights
Are my AI chats safe?It depends on the tool and the account. What Microsoft promises for Copilot chats on a work account, how personal ChatGPT plans differ, and who in your business can read your chats.How do we stop people using AI tools we have not approved?Give people an approved tool, write down what is allowed, then use Microsoft Defender and Purview to find and block the rest. A practical guide for Microsoft 365 businesses.