Copilot surfaces content your users can already access — which means unprotected "Confidential" files are fair game. This guide walks through the full sensitivity label setup in Microsoft Purview: the tenant prerequisite most admins miss, creating and scoping your first label, configuring encryption and permissions, and publishing a label policy to users. All screenshots from a real Microsoft 365 tenant.

Microsoft 365 Copilot does not create permission problems. It exposes the ones already in your tenant. This guide covers the three areas to fix before rollout: SharePoint oversharing, sensitivity labels, and DLP for Copilot.