Many companies buy Copilot the way people buy a robot vacuum: they switch it on and expect the house to clean itself. But corporate AI doesn't clean anything. It reads.
And it reads whatever it finds. After fifteen years of intranet, that usually includes three versions of the vacation policy, the 2019 travel policy, the site of a project that ended two years ago, and a salary spreadsheet shared "only with the company".
Copilot can't tell the current policy from the expired one if the company never did either. It answers fast, writes well and cites its source. Sometimes the wrong source.
What Copilot reads when nobody is watching
Copilot looks for answers in the Microsoft 365 content the person asking has access to: SharePoint sites, libraries, lists, OneDrive. It doesn't invent permissions or bypass security. That's good.
What it lacks is editorial judgment. It doesn't know which document is the official one. It follows signals: the title, the date, where the file lives, the metadata, the text. If those signals are in order, the answer comes out in order. If not, the AI does what a new hire with no one to guide them would do: it picks the first thing that looks reasonable.
AI has no institutional memory. It borrows your intranet's, with everything good and bad in it.
Five habits of an intranet that AI understands
| Habit | When it's missing | What the AI does |
|---|---|---|
| One version of each truth | Duplicates and "final_v3" copies | Mixes data from several versions |
| An owner and a review date | Orphaned content | Cites documents nobody stands behind |
| Structure and metadata | Everything in "Shared Documents" | Finds nothing, or finds the wrong thing |
| Well-set permissions | Sites open to the whole organization | Shows what it shouldn't |
| Archiving old content | Old competes with current | Answers with an expired policy |
None of these habits is new. Information architects have been repeating them for two decades, with the enthusiasm of a dentist recommending floss. The difference is that a mess used to cost search time. Now it costs wrong answers delivered with total confidence.
The silent enemy is called "the whole organization"
The most uncomfortable risk isn't old content. It's overshared content.
Copilot follows permissions to the letter. If a spreadsheet with sensitive data was shared with "everyone except external users", the AI will treat it as just as legitimate as the onboarding guide. There's no leak: there's a badly set permission that someone finally found.
Microsoft knows this, which is why one of its governance reports shows exactly the top 100 sites shared with the entire organization in the last 28 days. Opening that report for the first time tends to be an educational experience.
The tools you already paid for and nobody opened
The good news: with at least one Microsoft 365 Copilot license assigned, the SharePoint admin already has access to a good part of SharePoint Advanced Management, at no extra cost.
| Tool | What it's for |
|---|---|
| Site ownership policy | Detects sites without enough owners and sends alerts |
| Inactive sites policy | Finds abandoned sites and notifies their owners |
| Site attestation policy | Asks owners to confirm the site, its members and permissions are still valid |
| Access and sharing link reports | Show what's shared with the whole company and with which kind of link |
| Restricted Content Discovery | Removes a site from Copilot and search without changing its permissions |
| Restricted Access Control | Limits a site to a specific group, even if old links exist |
There's also a calendar detail. The PowerShell commands many tenants used to limit Copilot in SharePoint during the preview stop working on November 1, 2026. After that, control moves to each site's AI settings and to Restricted Content Discovery.
A word of caution about that last tool: hiding a site from AI is a patch, not a fix. The content is still there, messy and with the same permissions. It buys time while you review, it doesn't replace the review.
Even Microsoft has started doing its share of visual cleanup: when a team site homepage hasn't been edited in 30 days and has no published news, the News web part collapses on its own. It's a nice gesture. But hiding the shop window doesn't tidy the warehouse.
Thirty days before switching on the AI
A realistic plan for a mid-sized intranet, without a two-year project in between:
Week 1, the inventory. Review the reports on sites shared with the whole organization and on sharing links. Flag the sites with sensitive content.
Week 2, the owners. Turn on the ownership and attestation policies. Every site needs a person who answers for it.
Week 3, the cleanup. Apply the inactive sites policy, archive what has reached the end of its life and remove duplicates. Use Restricted Content Discovery only on sensitive content still under review.
Week 4, the test. Pick the 20 questions HR, finance and IT get most often (vacation, expenses, benefits, access) and ask Copilot. Compare each answer with the official source. Where it fails, the problem has an address and a name: a specific document.
The last week is the most revealing. It's the first content audit that runs itself, with the AI as an unwitting auditor.
The point
For years, the intranet was internal communications territory: a place to publish news and store forms. With Copilot, it became something else. It's the knowledge base of the company's AI, and the quality of its answers depends directly on how it's organized.
Buying AI without cleaning up the intranet is like hiring the fastest analyst in the world and handing them an archive with no labels. They'll work very fast. And they'll get things wrong at the same speed.
If you like understanding technology before believing the announcement, subscribe to the macareno.net newsletter. Every week, a little less hype and a little more context.
Sources
- SharePoint Advanced Management features included with Microsoft 365 Copilot, Microsoft Learn
- Get ready for Copilot with SharePoint Advanced Management, Microsoft Learn
- Microsoft plans to enable Copilot in SharePoint on all sites in November 2026, Topedia
- Team site homepages will automatically collapse inactive News web parts (MC1287368), Microsoft Message Center
