Most UK IT teams I speak to genuinely believe their Microsoft 365 environment is reasonably locked down. They’ve set up conditional access, they’ve got MFA running, maybe they’ve even deployed Defender for Endpoint. Job done, right? Not quite. The part that keeps getting overlooked, and that the ICO is increasingly interested in, is the default tenancy configuration sitting beneath all of that. Specifically, the way Copilot permissions, SharePoint access controls, Teams data retention and audit logging ship out of the box. Left unreviewed, those defaults are quietly creating a Microsoft 365 compliance risk UK organisations cannot afford to ignore in 2026.
Why default settings are the problem nobody audits
When a business provisions a Microsoft 365 tenant, Microsoft applies sensible-enough defaults for a generic organisation of unknown size, sector and regulatory context. The trouble is that your organisation is not generic. A law firm in Bristol, a fintech in Canary Wharf and an NHS-adjacent health tech company in Leeds all have entirely different obligations under UK GDPR, and none of those obligations map neatly to Microsoft’s out-of-the-box settings.
The specific defaults I’d flag as the most underappreciated risks are these: SharePoint’s default sharing scope (which allows anyone with a link to access documents if an internal user shares one), the absence of mandatory retention labels on newly created SharePoint sites, Teams messages not being captured under any retention policy unless one is explicitly configured, and Copilot for Microsoft 365 inheriting the access permissions of the user running it, with no additional permission boundary.
That last one deserves a longer look, because it’s the newest and the most consequential.
Copilot’s permission inheritance problem
Copilot for Microsoft 365 does not introduce its own access controls. It operates entirely within the Microsoft Graph, pulling from whatever data the signed-in user can already reach. In theory this sounds sensible. In practice, it means that if your SharePoint permissions are messy, which they almost certainly are if the tenant is more than two years old, Copilot can surface documents that an individual technically has access to but would never normally encounter in the course of their work.
I’ve seen this described as an “oversharing amplifier”, and that framing is accurate. A marketing executive who was added to a finance project SharePoint site three years ago and forgotten about can now ask Copilot to summarise Q3 payroll data, and it will, because the Graph says they have permission. This is not a Copilot bug. It’s a data governance debt problem that Copilot has just made dramatically more visible and exploitable.
From an ICO perspective, this matters because the ICO’s AI guidance makes clear that organisations are responsible for the outputs of AI tools they deploy, including the data those tools access. Saying “Copilot inherited the permissions” is not a defence. The accountability sits with the data controller, which is you.
Teams retention and the audit logging gap
Microsoft Teams message retention is off by default. Unless a Teams retention policy has been explicitly created and published in the Microsoft Purview compliance portal, messages are retained indefinitely (or deleted after a user-defined period if the user themselves deletes them). For regulated industries, indefinite retention of unstructured chat data is its own headache. For sectors with specific record-keeping obligations, the absence of a defined retention schedule is potentially a direct regulatory breach.
Audit logging is a separate but related issue. The basic audit log is enabled by default, but it only retains events for 90 days on most licence tiers. If your organisation suffers a data incident and the ICO asks you to reconstruct what happened, 90 days may not be enough. Advanced audit (which extends retention to a year or longer) requires Microsoft 365 E5 or the E5 Compliance add-on. Many UK businesses running on Business Premium or E3 are unaware that their audit trail is functionally shorter than the ICO’s recommended incident investigation window.
The ICO’s own accountability and governance guidance is explicit that organisations must be able to demonstrate compliance, not just claim it. An audit log that expires before an investigation completes is not a demonstration of anything.
SharePoint access controls: the oversharing architecture
At the tenant level, SharePoint has three external sharing settings: Anyone, New and existing guests, and Only people in your organisation. The default for most commercial tenants is “New and existing guests”, which allows internal users to share content with external parties by invitation. That’s not inherently wrong, but it becomes a problem when combined with the following: no mandatory sensitivity labels, no expiration on sharing links, and no Data Loss Prevention policy scanning outbound file transfers.
Many UK businesses that have been running Microsoft 365 for several years have accumulated thousands of sharing links they’ve lost track of. If those links include personally identifiable information, and in a business context they frequently do, even inadvertently, this is a live data breach risk sitting in plain sight. If you work at an organisation that has never run a SharePoint sharing link audit, the likelihood of finding externally accessible files containing personal data approaches certainty rather than possibility.
This connects directly to the kind of shadow IT and unsanctioned data flow problems that are already creating headaches for UK finance and legal teams. SharePoint link sprawl is essentially the same problem in a first-party tool, which somehow makes organisations less likely to treat it seriously.
A practical audit checklist for UK IT teams
I’d approach this in four passes. The first is a Copilot readiness audit: use the SharePoint Advanced Management tool (or a third-party tenant scanner) to identify sites with overly broad permissions, particularly any with “Everyone except external users” access. Address those before Copilot is rolled out further.
The second is a sharing link review. In the SharePoint admin centre, run the sharing report to surface all active sharing links. Prioritise any set to “Anyone” and any that have no expiration date. Set a default link expiration policy at the tenant level if you haven’t already, 30 days is a reasonable starting point.
Third, check your Teams retention policies in the Purview compliance portal. If you have none, create them. Work with your legal and compliance teams to agree a retention period that satisfies both your business needs and any sector-specific record-keeping requirements. Financial services firms should check their FCA obligations; legal firms their SRA obligations.
Fourth, audit your audit logging. Confirm which licence tier you’re on, check the audit log retention period, and decide whether the Microsoft 365 E5 Compliance add-on is worth the cost given your regulatory exposure. For most regulated businesses with 50 or more users, I’d argue the answer is yes.
The licence tier trap
One thing that rarely gets discussed is how heavily Microsoft 365’s compliance capability depends on licence tier. Many UK businesses bought Business Premium during the pandemic for the Teams access and the endpoint management, without realising that the compliance tools in that tier are significantly stripped back compared to E3 or E5. SaaS licence sprawl is a real cost problem, but in the Microsoft 365 context, the risk runs the other way: being on a tier that feels sufficient but lacks the compliance tooling your regulatory obligations actually require.
If your organisation has not done a formal Microsoft 365 Secure Score review in the last six months, do one. It won’t catch everything described here, but it’ll give you a baseline and surface the most obvious gaps. The admin centre makes it relatively straightforward, and the output is a prioritised list of actions with estimated score improvements and rough implementation effort. It’s not a compliance audit in itself, but it’s a reasonable place to start before you bring in an external Microsoft partner to do the deeper work.
The Microsoft 365 compliance risk UK businesses are sitting on is not theoretical. It’s configured into their tenants right now, compounding quietly every time a new site gets created, a new Copilot licence gets assigned, or a sharing link gets forwarded to someone who was never supposed to see it.
Leave a Reply