My SharePoint permissions are too messy for Copilot rollout

I started the day with a leadership question I could not answer cleanly: are our SharePoint permissions safe enough for Copilot rollout? I opened the SharePoint admin center, pulled up the sites that looked most sensitive, and immediately ran into the usual mess of old owners, broad links, guest access, and broken inheritance.

By lunchtime, I had narrowed the problem to a first batch of sites instead of trying to review the whole tenant. I could see which ones needed owner follow-up, which ones had obvious sharing concerns, and which ones might need a temporary restriction before anyone treated Copilot as ready.

The win was that the risk stopped being vague. I had enough evidence to tell leadership, "Here are the sites I would review first, here is why they worry me, and here is what I need each owner to confirm."

The painful part was the judgement work. The reports gave me signals, but they did not decide whether an old project site should be archived, whether a guest still needed access, or whether a broadly shared library was acceptable for the department using it.

What I wish existed is a simple triage rhythm: pick the first 10 risky SharePoint sites, rank the exposure, document the next action, and give leadership an honest readiness view without pretending we have cleaned the whole tenant.