News
Prepare your files for Microsoft Copilot with this guide to Microsoft 365 storage locations: OneDrive, Teams, and SharePoint. Learn best practices for permissions, data cleansing, and optimising cloud storage for AI integration.
As part of preparing files ready for a Microsoft Copilot integration, you must first understand the key areas in Microsoft 365 in which documents can reside, as some of these locations will hold the data that Copilot interacts with.
Within this blog post I am going to cover the 3 key storage areas within Microsoft 365. What they are? Why we use them?
OneDrive, Microsoft Teams and SharePoint will be covered, inclusive of permissions consideration when working with each. Although this article is focussed on files be prepared for Microsoft Copilot, the recommendations made are applicable in general for any Microsoft 365 roll-out, and migration to the cloud.
Whilst working with many clients, I introduce these file storage locations as ONE, SOME and ALL, while highlighting the need for a data/document cleanse. This will all be detailed in the sections that follow.
Starting with Microsoft OneDrive. As the name suggests this is the solution that I discuss as being for ONE. What I mean by this is that the storage location should be primarily used for your personal files. You may be thinking that you have options to share files from OneDrive, and you would be right, but I still advise that other solutions are more appropriate for this need and OneDrive should remain for personal documents. Furthermore, I see clients having different definitions of what “personal” means to them. In my opinion these documents are items that no one else needs to access. This could simply be files that are downloaded in the workplace like theatre tickets, or maybe pictures of your family! I do not believe that anybody can define a personal document as something that they created, like times of old with users all having their own folder on a file server. It is my opinion that documents created in the workplace belong to your organisation, therefore saving them in a central location ensures that they can be picked up and used even if you were to be on holiday or off on long term sickness. Throughout my career I have seen examples of inefficiencies when it comes to OneDrive. This has been through documents being stored there and then unavailable to those that need to use them, leading to duplicate documents being created which wastes time or incorrect versions of documents being used which also wastes time and potentially causes much larger concerns – failed projects, false information, legal issues and poor reputation to name a few. Believe it or not, I have also come across organisations who have migrated their file servers to the cloud, through a simple lift and shift into OneDrive with all users accessing a shared folder! If you are planning on migrating, then please do not do this! If this sounds like your organisation, then please reach out so we can support updating your structure and give you the best return on investment (ROI) on your Microsoft 365 licences. Microsoft Copilot will bring in documents from your personal OneDrive, inclusive of documents that are shared from other individuals OneDrive locations. Therefore, my recommendation is to limit the data that is stored here and be cautious when sharing files amongst other users.
Next up in Microsoft Teams, this is where I discuss access being related to SOME people within your organisation. My definition for Microsoft Teams is that it is an environment that brings a collective group of individuals together who are striving to achieve a common goal. This may be a department collaborating to deliver the best service to the organisation, it may be people from across departments coming together to achieve a successful project or it may be different people coming together to socialise – much like our Valto hiking group and football team. Microsoft Teams allows users to collaborate on documents. As a user you will be a member of a few different teams, having access to work on the documents within them and get involved in conversational threads. All this content that you have access to will also be available for your instance of Microsoft Copilot, as it will access everything that you can access. Microsoft Teams is only available to SOME individuals in the majority of instances, as this is where a lot of day-to-day work may take place. As an example, the Human Resources (HR) department will work on recruitment contracts and salary information – this should only be accessible to HR and would not be something publicly available on an Intranet. A further consideration of Microsoft Teams is the structure and architecture, a popular service we frequently provide our clients. This is because Microsoft Teams are split into channels. The 2 key types of channels are Standard Channels and Private Channels. Standard Channels: These channels, like the “General” channel, which is created by default, will inherit permissions from the Microsoft Team. As an example, you have create a Team for HR and then split channels into some functions to keep related documents and conversations together e.g. recruitment, benefits, contracts etc. Note that this is like the creation of a folder structure, as in reality each channel is creating a folder within a SharePoint Site that supports the Microsoft Teams environment. Private Channels: These channels allow for a subset of users within the Microsoft Team to access conversations and documents. This will allow for channels to remain with the same team for ease but minimise the access rights. Continuing the HR example, a channel named “Confidential” may be created – this channel may only be accessible to a couple of senior HR staff members. When it comes to Microsoft Copilot, you are reminded that data and documents being retrieved are based on your access rights. Therefore, creating the correct Microsoft Teams with the correct channel architecture will again enforce that users can work with artificial intelligence (AI) but only see content that they already have access to.
Finally, I advise on the act of creating Communication Sites within SharePoint as being available for ALL. Once again permissions can be adjusted, but the majority of time these are being created for the purpose of an Intranet in which content is being shared with a much wider audience for reading reasons.
If I were to continue the HR example from Microsoft Teams earlier, I would be advising that a department site is generated within SharePoint.
This site would be editable by some identified HR champions but would be for the purpose of HR sharing content with the organisation e.g. leaflets and documents about company benefits.
It is within an Intranet where solutions like Microsoft Copilot or potentially custom ChatBot applications via Microsoft Copilot Studio can really shine, as they provide interfaces for users to get at information and knowledge quickly.
Here at Valto we deliver a number of Knowledgebase and Controlled Documents solutions, which will contain pages of information about company processes and links to company policies.
These have always been extremely successful, with great feedback as they support organisations in sharing the most important content. However, imagine if we now introduce a layer of AI over the top with Microsoft Copilot. Rather than searching for benefits I can simply ask a natural language question and the receive the answer that I need.
When developing an intranet in SharePoint you will likely be using the “Everyone Except External Users” permissions group to ensure that all users can read content, including new users who are joining the organisation.
This will give users the ability to access the content manually of via Microsoft 365 Copilot, therefore you just need to ensure that risk is minimise by governing what content is uploaded to the Intranet.
Ok, so this is not a storage location in Microsoft 365 but it is extremely important when considering your migration to the cloud. Just because you have it does not mean you need to keep it!
I frequently advise my clients that a cleanse should be considered when moving to Microsoft 365 or if having just moved. In most organisations this can be considered as a one-time opportunity to make this change, as the file server has likely grown for a great number of years.
In a previous migration engagement, I was heavily supported by the Legal and Compliance Teams in pushing the message of “The Bin!” across the organisation.
In their analysis they had come to the conclusion that if a subject access request (SAR) was to be raised then it could potentially grind their entire organisation to a halt due to the amount of data they held outside of their retention period – in this case 30 to 35 years of data being held, when it was only legally meant to be kept for 7!
I would hope that by now it is clear, but Microsoft 365 Copilot will have access to all the data that you have access to. Do you need Copilot to be retrieving data that is 30 years old?
A key point to note is that Microsoft Copilot will utilise the logged in users’ permissions to retrieve documents and data.
Therefore, the introduction of Copilot does not put your company at risk, it just shines a light on the risk that may already exist in your organisation.
Additional options, such as Restricted Search, Sensitivity Labels, Permissions and Retention Labels will be discussed in other more focussed articles, but just note that these are all areas of exploration to help maintain data integrity.
However, once again these areas are something that should have already been considered by your organisation, but it is common for the discussion to only now take place now that AI has been introduced into Microsoft 365, making it easier for people to find data that may have previously been accessible but difficult to locate.
As an example, many of you may remember Microsoft Delve and the concerns that raised with individuals.
As a product it was successful in easily providing me data and documents related to other individuals in my organisation. When consulting, I commonly had concerns raised about publicly displaying documents as users saw this as a breach of permissions.
However, this always needed to be explained away as Microsoft Delve only showcased documents based on permissions e.g. if I visited the CEOs Delve Profile and saw a document they had been working on, then that was only because I already had access, either through permissions or sharing. The same can be said for Microsoft Copilot.
Microsoft Copilot does not impact data security, it only highlights security issues that you already have in place and may have had for many years. So, with this in mind I see the release of Copilot as an aid to restart these discussions that may have been swept under the rug, and an opportunity for customers to improve their security even if not yet adding AI into their day-to-day working practices.
If you are thinking about migrating to the cloud the above considerations of what content is stored for ONE vs SOME vs ALL, as well as what does not need to come across and needs to be binned with greatly support your project.
If already migrated, and looking to introduce Microsoft Copilot, then the same considerations should still be reviewed.
I may have said this many times, but once more will not hurt. Microsoft 365 Copilot does not put your company at risk, it will only uncover the risk that is already within your company.
Microsoft 365 Copilot will have access to the data that you can see.
Copilot does not put you at risk, it just uncovers the risk that already exists in your organisation.
The only difference is that private documents that are mistakenly publicly available may be buried deep in a folder structure, with Microsoft Copilot ignoring this and quickly bringing it to people’s attention if related to the natural language query it is given.
“We work with organisations across many sectors of different shapes and sizes from 10 to 100,000 employees.”
Contact our team today!
Explore how Microsoft Copilot supports IT and Marketing teams with real-world scenarios, helping automate tasks, analyse data, create content, and accelerate project delivery.
7 May 2025
Learn the key differences between Microsoft Copilot’s free and paid versions, including features, use cases, pricing, and how to boost productivity with the right setup.
7 May 2025
Discover how our consultancy team uses Microsoft Copilot across Outlook, Teams, Excel, Word and more to streamline workflows, boost productivity, and deliver high-quality client engagements.
7 May 2025
