Copilot exposure report: My Pharma
This is the summary you get from a free exposure scan, shown here for My Pharma, a fictional company. Every name and figure is an example.
Summary
2,456 sensitive files, including payslips, bank details, unreleased results and plain-text passwords, can be reached by every one of My Pharma's 18,400 employees, which means Copilot can use them in its answers. 10 fixes remove access that nobody has used in 90 days and raise the safety score from 47 to 83 without anyone noticing. The rest need an approval or the site owner.
Where sensitive files reach too far
| Severity | Site | Widest reach | Sensitive files | Exposed | What's inside |
|---|---|---|---|---|---|
| Critical | Payroll Archive 2019–2024Payslips folder (permissions not inherited) | Organisation-wide group | 1,186 | 1,186 | Bank account numbers, National Insurance numbers |
| Critical | Finance – Month-end CloseSite visitors | Everyone in My Pharma | 520 | 520 | Unreleased financial results, Bank account numbers |
| Critical | HR Shared DriveDocuments library | Everyone in My Pharma | 412 | 412 | National Insurance numbers, Salary details |
| High | Customer Support12 Anyone links | Anyone with the link | 1,742 | 332 | Email addresses, Phone numbers |
| Medium | Legal – Contracts410 company-wide links | Company-wide links | 940 | 205 | Contract values, Personal addresses |
| Critical | R&D Formulations“Shared” folder (permissions not inherited) | Everyone in My Pharma | 205 | 205 | Formulation codes, Patent drafts |
| High | Clinical Trial CT-20423 Anyone links | Anyone with the link | 268 | 129 | Patient identifiers, Dates of birth |
| Critical | Benefits & PensionsSite members | Everyone in My Pharma | 96 | 96 | Health data, Pension details |
| Critical | IT OperationsSite visitors | Everyone in My Pharma | 37 | 37 | Passwords, API keys |
| Medium | OneDrive – Mark Ellis (left Aug 2026)64 company-wide links | Company-wide links | 64 | 32 | Salary details, Performance reviews |
| Low | Project Falcon6 guest advisers | Guests | 88 | 26 | Deal terms, Target financials |
| Medium | Marketing Hub4 company-wide links | Company-wide links | 4 | 2 | Customer email addresses |
Fix plan
Safe to apply now 10
No one has used this access in the last 90 days.
- Hide Payroll Archive from Copilot and search, then archive itTurns on Restricted Content Discovery and moves the site to Microsoft 365 Archive. Nobody has opened it in 14 months.
- Remove Everyone from Benefits & Pensions membersNobody outside HR opened these files in the last 90 days.
- Restore inherited permissions on the R&D “Shared” folderThe folder goes back to R&D members only. Nobody outside R&D opened it in 90 days.
- Convert 410 company-wide links on contracts to specific-people linksThe 1,120 people who opened a contract keep access. Nobody else can find them.
- Convert 610 company-wide links on ticket exportsThe 900 people who opened an export keep access through a specific-people link.
- Expire 12 Anyone links on customer data exportsNone of these links has been opened in 60 days.
- Remove 5 guests inactive for more than 90 days from CT-204Their last sign-in was over 90 days ago. The 9 active guests keep access.
- Remove 2 advisers from a firm no longer engaged on Project FalconNeither has opened a file since the engagement ended.
- Hand Mark Ellis's OneDrive to his manager and remove company-wide linksFormer employee. 64 files with salary and review data stop being reachable.
- Convert 4 company-wide links on event sign-up listsThe 60 people who opened them keep access.
Needs your approval 3
Some people will lose access they've used recently.
- Remove Everyone from HR Shared Drive members31 people outside HR opened files here in 90 days. Radius adds the 4 in HR Operations to Members. The other 27 lose access.
- Remove Everyone from Finance Close visitorsUnreleased results visible to all staff are an insider-dealing risk. 12 people outside Finance opened files in 90 days.
- Replace 23 Anyone links on CT-204 with links for named CRO staffThe 9 links opened in the last 30 days become specific-people links for the people who used them.
Needs the site owner 1
Radius removes the access; the owner finishes the job.
- Remove Everyone from IT Operations and move 37 secrets to Key VaultRadius removes the access straight away. The owner must rotate the passwords and keys, because they've been readable by everyone.
Safety score: the share of sensitive files that only the right people can reach, weighted by how widely each file is exposed. Radius lists file names and permissions; it never opens or copies file contents.
Not sure where to start?
Book a 30-minute call and tell us what worries you about Microsoft 365: oversharing, an audit, or a Copilot rollout. Or email us and we'll reply within one working day.