Getting End Users to Care About Governance: My CollabDays New England Recap

Raise your hand if your organization has Copilot. Now keep it up if you think your users know how much Copilot can actually see.

That is how I kicked off my session at CollabDays New England on October 16 in the Jefferson room at the Microsoft Technology Center in Burlington, MA. Almost every hand went up for the first question. Far fewer stayed up for the second. That gap is exactly what Getting End Users to Care About Governance: Because Copilot Is Reading Everything They Ignore was all about.

Here is the thing. I hear people say Copilot “isn’t that good” or “just isn’t doing what I need it to do.” A lot of the time, Copilot is doing exactly what it was built to do. It is reading everything your users can access, including the stale content nobody cleaned up and the habits nobody corrected.

If you could not make it (or you were there and want the notes without squinting at photos of my slides), here is the recap.

Copilot Does Not Create Oversharing. It Reveals It.

Your content was probably overshared long before Copilot showed up. That is not me pointing fingers at how anyone provisions their sites. It is just reality. Copilot searches what a user already has access to, so the file from 2019 and the folder shared with the whole company are fair game, whether you want them to be or not.

Data governance runs on four pillars: people, process, technology, and data. As tech professionals, our brains think tech and we speak tech, so most of our energy goes into the technology pillar. You can bring in consultants, configure everything by the book, and end up with a beautiful tenant. But governance is not something you set up once and walk away from. It takes ongoing effort, and it takes people who actually care.

So I asked the room another question: do the people in your departments actually apply the controls you put in place? I got a lot of no head shakes. Good. That meant everyone was in the right session.

Why End Users Do Not Care About Governance (Yet)

Our marketing, HR, and operations folks are not ignoring governance to be difficult. In my experience, it comes down to four things.

The risk is invisible. To them, Copilot is a faster way to get work done. Until they see it surface something it should not, oversharing is just a word IT keeps saying.
We speak tech. Start talking about DLP and sensitivity labels and it flies right over their heads. Honestly, before I got technical, I had no idea what data governance meant either.
It feels like more work. “Please start labeling your files” lands as one more step on top of the approvals and reviews they already have.
Nobody notices when they get it right. Humans are incentivized creatures. When we were kids, we got gold stars. (I passed out stickers (lended to me by the generous Heather Severino) to this session for exactly this reason.)

The fix starts with the message. “You are violating policy” does not motivate anyone. “If your content lives in the right place with the right access, Copilot gets better for you” does.

The CARE Framework for Copilot Governance Adoption

When we roll out technology, we tend to follow the same loop: assess, enable, measure, govern. If you have followed my Copilot Readiness Loop, this will look familiar. CARE is the people side of that loop, and it is the easiest way I have found to remember what the human layer needs.

Technical step	CARE step	The question it answers
Assess	Connect	How do we make the risk personal?
Enable	Activate	How do we make the right path the easy path?
Measure	Reinforce	How do we keep people doing it?
Govern	Embed	How do we keep it going through turnover and new hires?

Connect: Make the Risk Personal

People nod along when you say “Copilot could find something it should not.” It does not feel real until Copilot actually finds it. So show them.

My favorite way to do this is a safe oversharing demo, and compensation is one of the most common examples I hear about. While prepping for this session, I asked Copilot in my demo tenant how much someone makes, and it politely declined. But when I grounded the prompt in a broadly shared compensation file and asked for the average pay of our teammates in Arizona, it happily did the math. Now picture someone reading that answer and realizing they make less than the average. Dang.

Tie the message to what is in it for them: better Copilot answers, protected client data, fewer surprises. And if you can get a leader to share their own “Copilot surfaced something it should not have” story, even better. Bonus points if it is a VP. If the boss says it, people listen.

Activate: Make the Right Path the Easy Path

These are the two places I see users trip the most in training:

Copy link vs. Share. For non-technical users, these look the same, and Share sounds friendlier because it sends an email. What they do not realize is that direct sharing can break permission inheritance and create a real headache for whoever has to clean it up, usually the site owner.
Where does this file go? For us, OneDrive vs. Teams vs. SharePoint is obvious. For everyone else, it sounds like “I can share it from my OneDrive, so that’s fine, right?” Not quite. OneDrive is for your own drafts. Teams is great for work in progress. SharePoint is the home for finalized policies and published content. And once you mention that OneDrive and Teams are both SharePoint under the hood, do not even get me started.

I do not think Microsoft is trying to trick anyone with these options. But a simple one-page “where does this go?” guide lands a lot better than setting people loose in the tenant.

Labels need the same treatment. I will admit I have some secret demo tenants with about ten sensitivity labels, and some organizations really do have that many in production. Simplify to three or four. Apply a default label so content starts protected. And write tooltips that actually explain when to use each one, because color coding alone is not enough.

Reinforce: Nudge People at the Point of Action

Everyone has their own job and their own goals. Nobody is going to memorize your governance training. Policy tips, label recommendations, and explicit tooltips teach people while they work, which beats a one-time session every time. Add champions, regular reminders, and public shout-outs when someone gets it right.

Embed: Build Governance Into How You Operate

Every company has turnover. If governance only lives in a one-time rollout, it walks out the door with the people who sat through it.

Onboarding. New hires already face a mountain of material. Give data governance its own intentional spot in the data security section instead of burying it.
Site owners as data champions. Just like we have Copilot champions, every SharePoint site needs an accountable owner who reviews permissions monthly or quarterly. Give them their own training on what is a red flag and what can be dismissed. SharePoint Advanced Management can show where permissions have changed at the site level.
Copilot adoption reviews. When I help organizations roll out Copilot, I put together before and after reporting from the Microsoft 365 admin center and Viva Insights. I add SharePoint Advanced Management and Microsoft Purview reports to that same review. When governance health sits right next to Copilot usage, people start connecting the two on their own.

Translate the Governance Jargon

In tech, acronyms roll off the tongue because our peers already know them. Step out of that bubble, and someone hears “DLP policy” and just scratches their head. Here is how I humanize the most common terms:

Technical term	How I explain it
Sensitivity label	A visible sticker on a file. Apply it, and your information is protected.
DLP policy	A firewall or gate that keeps a file from crossing into Copilot
Oversharing	Too many people got invited to a party they were not supposed to go to. Or the reply-all you did not mean to send (I have done it more than once).
Access review	An audit of where our data lives and who can see it
Retention policy	Keep what is fresh and relevant. That deal file from 2005 can probably go to cold storage.

One attendee made a great point here: we are speaking Microsoft’s language, and compliance teams often speak a completely different one. Whatever metaphor you land on has to work for the industry and department in front of you. What clicks in banking may not click in life sciences.

Tailor the Governance Message to Your Audience

Depending on where someone sits, the message needs a different translation. The higher up you go, the more your job is worrying about things.

Audience	What keeps them up at night	How to frame governance
Executives	Risk and reputation	Protecting the company’s public image and the Copilot investment
Managers	Team productivity	Less data sprawl, fewer cross-team sharing mistakes, better team results
Site owners	Their site is their domain	Owning the access model now means less cleanup every review cycle
Employees	Their own day-to-day work	Organized, correctly shared content means better Copilot answers

To keep it simple, I use a formula, kind of like an elevator pitch: when you [do this], Copilot will [see or do this], so you get [this benefit]. For example: when you share with specific people instead of everyone, Copilot keeps your drafts out of unrelated answers, so your teammates get results that actually matter to them.

The Technical Controls That Back It Up

This presentation would not be complete without the technical side. The human layer only works if the tenant gives people guardrails.

This is one of the easiest grabs, and one I still see a lot of organizations skip. Many tenants still have both SharePoint and OneDrive sharing set to Anyone. An Anyone link is basically a website link. Anyone who has the URL can get in.

Default to people in your organization, or at least the guest level, so outside users get provisioned properly through Entra instead of just getting a link.
Set expiration dates on links, and require a passcode where it makes sense.
Restrict access on your sensitive sites specifically.

One attendee added something I loved: do not block Anyone links across the board. Nearly every organization has at least one team with a legitimate workflow that needs them. Train that team, set expiration dates, and lock down the sensitive sites instead.

Sensitivity Labels and Copilot-Scoped DLP

Copilot-scoped DLP is one of my favorite things to talk about right now. A DLP policy scoped to Microsoft 365 Copilot can stop Copilot from using a labeled file in its responses.

One common misconception: the label does not make the file invisible. A user with access can still find it in OneDrive or pull it into a prompt with the forward slash. Copilot will just tell them it cannot use that file.

Anyone can watch a YouTube video and figure out the clicks. What matters is knowing that all three pieces have to be in place:

The sensitivity label, the visible marker on the content.
The label policy, which controls who can see and apply the label.
The DLP policy, which defines what Copilot can and cannot use.

Save this for the far end of your label scale and very specific use cases. People still want Copilot to see as much as it can. If an entire site should be off-limits, Restricted Content Discovery can hide it from Copilot and org-wide search instead of labeling every file across five different libraries. Use that one sparingly too.

Applying Sensitivity Labels at Scale

Whenever I bring this up, the next thing I hear from executives and IT stakeholders is, “This sounds great, but I have thousands of files.” My answer is a PnP PowerShell script that calls the Microsoft Graph assignSensitivityLabel API to label a designated SharePoint file automatically.

The catch: it is a metered API. When I looked at Microsoft’s list of metered API calls, this was the only one on it. It is a tiny cost per call, but it adds up, so budget for it before you run it across a large tenant. My hope is that it makes its way onto the free list someday.

Measure the Human Layer with a Readiness Scorecard

I wrapped up with a readiness scorecard you can run against your own organization or your clients. Score each dimension on four maturity levels: unaware, aware, practicing, and habitual.

Dimension	What good looks like
Labeling	Active files carry the right label, and users understand the choices
Sharing	Sensitive sites avoid broad links, and users know when org-wide vs. Anyone links fit
Ownership	Every site has an accountable owner who reviews access on a schedule
Content hygiene	Stale, duplicate, and orphaned content gets archived or cleaned up
Awareness	Users can explain what Copilot can see and why it matters
Behavior	Policy tip overrides and DLP alerts trend down over time

We turned this into a quick activity, and the most common answer landed right in the middle. People know governance matters, but that does not mean they have changed how they work. That gap between aware and practicing is exactly where reinforcement earns its keep.

Three Things to Remember

If I had to narrow the whole session down to three things:

Copilot exposes people’s habits, not just your configuration. Even if your governance is perfect tomorrow, the same problems will show up again in a month, two months, three months if people do not understand the why.
Lead with the benefit, not the punishment. Skip “apply this label or else.” Try “follow these principles and your Copilot results get a lot better.”
Measure the human layer. I know we think in binary sometimes, but the emotional side matters. If you do not measure it, it will not improve.

Where to Start on Monday

After the session, someone asked me for a good first step. My answer: if you have Microsoft 365 Copilot licenses, you already have access to SharePoint Advanced Management features. Head to the SharePoint admin center, find the big button that says Start Assessment, and let it run. It will surface oversharing, site lifecycle issues, sites with missing owners, and sites nobody has touched in years. That gives you real examples for your Connect step and a baseline for your scorecard.

Slides and Resources

My slides and the readiness scorecard are available on my link tree. For the technical controls, these Microsoft Learn pages are the best place to go deeper:

So yes, Copilot is reading everything your users ignore. The goal is to give them a lot less to ignore. That was my TED Talk (not really, but maybe one day) for the day.

Thank you so much to everyone who packed into the Jefferson room, shared their stories, and kept the conversation going after we wrapped. And a huge thank you to the CollabDays New England organizers, volunteers, and sponsors for making the day possible. See you at the next one!

Disclosure: This post was drafted with the assistance of AI, using the recording and transcript of my CollabDays New England session as source material. All content was reviewed and edited by me prior to publication. The ideas, examples, and frameworks presented are my own.