Microsoft Copilot in law firms: what it can see in your SharePoint

By Michael Nadalin, Founder, Market Lead · 14 October 2026 · 9 min read

A second-year solicitor in your property team types a harmless prompt into Copilot: 'summarise what we know about the vendor'. The answer comes back in seconds, tidy and confident. It also draws on a file note from the family law team, who happen to act against that vendor's director in a separate matter. Nobody hacked anything. Nobody did anything wrong. The file note sat in a SharePoint site that every person in the firm had technically been able to open for four years.

That is the real Copilot risk for law firms, and it has very little to do with artificial intelligence. Microsoft 365 Copilot works on a simple rule: it can retrieve whatever the signed-in user already has permission to open. It does not grant new access. It removes the one thing that was protecting badly permissioned documents, which was that nobody knew where to look.

If your permissions are clean, Copilot is a reasonably well-contained tool. If they are not, and in most firms that have used SharePoint and Teams for a few years they are not, you are about to give every staff member a very good search engine over material they were never meant to read.

What Copilot can see, in plain terms

Microsoft 365 Copilot does not read 'the firm's documents' in the abstract. When a user asks a question, it queries Microsoft Graph as that user and pulls back content that user is permitted to open: SharePoint and OneDrive files, Teams chats and channel messages they are part of, their own mailbox and calendar, meeting transcripts they can access. It then hands the relevant pieces to the language model to draft an answer.

Two consequences follow. First, two people asking the same question can get different answers, because they have different access. Second, the boundary of what Copilot can surface is set entirely by your existing permissions, sharing links and group memberships. Copilot inherits every shortcut anyone has ever taken with the Share button.

Microsoft's published position is that prompts, responses and the data retrieved through Graph are not used to train its foundation models, and that processing stays within the Microsoft 365 service boundary. Check the current product terms and your own tenant configuration instead of relying on a blog post, including this one. Even taking that at face value, it addresses leakage to the outside world. It does nothing about leakage inside the firm.

Why permissions that looked fine are not fine

Before Copilot, most firms relied on security through obscurity without admitting it. A partner's remuneration spreadsheet saved to the wrong library was safe in practice, because finding it required knowing the site, the folder and the file name. Search in SharePoint existed, but few people used it well.

Copilot changes the economics of discovery. It searches by meaning, it does so in response to casual questions, and it volunteers content the user did not know to ask for. The classic oversharing patterns in Microsoft 365 are well known: sites shared with 'Everyone except external users', sharing links set to 'People in your organisation', Teams created as public, folders with broken inheritance that nobody remembers, and matter sites that stayed open after the matter closed.

None of these are exotic. They are the ordinary residue of busy people getting documents to colleagues quickly. In a law firm, the residue includes privileged advice, client financial records, HR files and material from matters on the other side of an information barrier.

The professional obligations this touches

The duty of confidentiality under rule 9 of the Australian Solicitors' Conduct Rules is not limited to disclosure outside the firm. Where a firm acts, or has acted, for clients with adverse interests, the conflict rules contemplate effective information barriers. A barrier that exists in a policy document but not in SharePoint permissions was always weak. With Copilot in place, it becomes very hard to describe as effective if you are ever asked to prove it to a court or a regulator.

Litigators have a further problem. Documents received on discovery or under subpoena carry the implied undertaking, often called the Harman undertaking, not to use them for a purpose outside the proceeding. If that material sits in a broadly accessible site, Copilot can pull it into an answer for a different client's matter without anyone intending it. The Supreme Court of New South Wales has addressed generative AI directly in Practice Note SC Gen 23, which restricts putting certain categories of material into generative AI programs, including material subject to the implied undertaking and to suppression or non-publication orders, unless the practitioner is satisfied about the confidentiality safeguards. Other Australian courts have issued their own guidance. Read the current version for each court you appear in.

Then there is the Privacy Act 1988 (Cth). Firms covered by the Act must take reasonable steps to protect personal information from unauthorised access, and unauthorised access by your own staff is still unauthorised access. Depending on what was exposed and to whom, an internal oversharing event can raise notifiable data breach questions. Privilege is a separate worry: careless internal circulation does not automatically waive it, but it is not a fact pattern you want to be explaining.

What to fix before anyone gets a licence

The order matters. Firms that hand out licences first and audit later are running a live experiment on client confidentiality. The audit is not glamorous work and it will take longer than your Microsoft partner's proposal suggests, mainly because someone with legal judgement has to decide who should see what. IT can tell you a site is open to the whole firm. Only a practitioner can tell you whether that is a problem.

Microsoft provides tooling for this, though what you get depends on licensing. SharePoint Advanced Management includes data access governance reports that show overshared sites and broad sharing links. Restricted SharePoint Search lets you limit Copilot and organisation-wide search to a short allowed list of sites while you clean up, and Microsoft describes it as a temporary measure, not a permanent design. Restricted Content Discovery can hide specific sites from Copilot. Purview sensitivity labels and data loss prevention policies can exclude labelled content from Copilot processing.

What does not work: a policy telling staff not to ask Copilot about matters they are not on. People will not be trying to breach a barrier. They will ask a general question and receive a specific answer. Controls have to sit in the permissions, not in the acceptable use policy.

The records Copilot creates about itself

One point that gets little attention: Copilot prompts and responses are themselves stored in your tenant. They can be captured by retention policies, searched through eDiscovery and reviewed in audit logs. That is useful if you need to investigate who retrieved what. It also means there is a new class of record to think about.

A solicitor's prompt, and the draft answer it produced, may reveal instructions, strategy or a line of reasoning that was later abandoned. Whether such records are privileged, whether they are discoverable in a dispute involving the firm, and how long they should be kept are questions to settle before rollout. Meeting transcripts and recaps generated in Teams deserve the same thought, particularly for client conferences and calls with counsel. A verbatim transcript of a conference with a barrister is a very different record from a solicitor's file note.

Set the retention period deliberately. The default is rarely the right answer for a law firm, and 'we never looked at it' is not a position you want to defend.

Where Copilot fits, and where it does not

Copilot is a productivity layer over your own documents. With clean permissions it is good at summarising a long email chain, drafting a first pass of a routine letter from your precedent, or finding the version of a document you know exists. Those are real time savings and there is no reason to be precious about them.

It is not a legal research tool. It reasons from whatever is in your tenant plus general model knowledge, which means it can state a proposition of law with confidence and no reliable authority behind it. Australian courts have already dealt with practitioners who filed material containing authorities that do not exist, and the consequences have included costs orders and referrals to regulators. For research you need a tool built to ground its answers in Australian primary sources and show them to you, which is the job Legal Brain was built for, and you still need to read the authority yourself. Verification stays with the practitioner whichever product you use.

The practical position is this. Copilot will not create a confidentiality problem in a firm that has its permissions in order. It will expose one, quickly, in a firm that does not. Do the audit first, involve someone with a practising certificate in deciding who sees what, and treat the rollout as a risk project with an IT component, not the reverse.

Frequently asked questions

Can Microsoft Copilot see all the files in our firm's SharePoint?

No. It can only retrieve content that the individual user already has permission to open. The difficulty is that most users have access to far more than they realise, through firm-wide groups, open Teams and organisation-wide sharing links, and Copilot makes all of that easy to find.

Does Microsoft use our client documents to train Copilot?

Microsoft's published position for Microsoft 365 Copilot is that prompts, responses and data accessed through Microsoft Graph are not used to train its foundation models. Confirm this against the current product terms and your own tenant settings. It does not address the separate risk of staff inside the firm seeing material they should not.

Is it a breach of confidentiality if Copilot shows a lawyer a file from another matter?

It can be. The duty of confidentiality and the rules on conflicts expect client information to be confined to those who need it, and an information barrier has to work in practice. If the exposure involves personal information, the Privacy Act may also be engaged. The breach lies in the underlying permission, and Copilot is simply how it comes to light.

How do we stop Copilot accessing sensitive SharePoint sites?

Fix the permissions at the source by removing firm-wide access and broad sharing links from sensitive sites. While that work is under way, Microsoft's controls such as Restricted SharePoint Search, Restricted Content Discovery and Purview sensitivity labels can limit what Copilot is able to surface. A staff policy alone is not an adequate control.