Copilot Search is coming to SharePoint and OneDrive — does that amplify oversharing before we’ve finished Wave 0?

You’re right to treat “search that summarises” as a permissions problem with a nicer UI, not a free productivity win. If a file is overshared today, a natural-language answer with a citation will surface it faster than a keyword hunt ever did.

Here’s what’s going on. Roadmap 573696 (Copilot Search in SharePoint and OneDrive) is In development, with Preview targeted for October 2026 and general availability for January 2027 (Worldwide; Web). The MRC promise is AI-powered natural-language search in SharePoint and OneDrive: relevant results, AI-generated summaries with source references, filters, and a seamless handoff into Copilot. That is related to — but not the same as — Microsoft Copilot Search in the Copilot app, which Learn already describes as a licensed Search module with no admin setup required for eligible Copilot users, semantic results across Graph and connectors, and a path into Chat. 573696 is the SharePoint/OneDrive surface getting that class of experience; treat licence gates, admin toggles and Message Centre as “verify in your tenant” until Learn documents the SharePoint-specific controls.

Search still honours what the user can already access. Learn’s readiness guidance is blunt: remediate oversharing before you celebrate discovery. Use SharePoint Advanced Management and Purview to find broad links and oversized audiences; apply Restricted Content Discovery (RCD) on high-risk sites so they stay out of organisation-wide search and Copilot/agent discovery while owners fix ACLs; remember RCD does not change permissions and is not a security boundary. Restricted SharePoint Search was a temporary allow-list and is retiring — don’t rebuild Wave 0 on it.

This is Schofield’s Third Law for libraries: the easier it is for you to find “that budgeting site you forgot existed,” the easier it is for everyone else’s Copilot Search to find it too. Steady before scale puts Security and GRC ahead of Preview seat chatter.

Options that actually work:

1. Finish the hotspot list before Preview rings. Name Finance/HR/Legal sites with EEEU or Anyone links, turn RCD on those sites, assign owners and dates. Best Steady default while 573696 is still In development.
2. Pilot Copilot Search surfaces with a cleared cohort only. Targeted Release / early rings for people whose sites passed SAM/DAG review — then expand. Matches how you’d pilot Copilot Chat itself.
3. Curate answers (bookmarks, acronyms) so Search has a trusted path. Learn already lets admins promote authoritative resources in Copilot Search — useful once the SharePoint surface arrives, not a substitute for fixing ACLs.
4. Assume “Copilot Search in SharePoint” invents a new permission model. It doesn’t. Same Graph, same overshare debt, louder amplifier.

12 Panes action / comms: Tell SharePoint admins: 573696 Preview is October 2026 intent — RCD and SAM reports are the brake, not a hope that summaries only cite “good” sites. Tell GRC: Add 573696 to the AI register with “permissions hygiene → RCD on hotspots → pilot → Message Centre verify”. Tell users: A Copilot Search summary is not clearance to share; check the citation and who owns the library. Leadership: Natural-language search is value only after Wave 0 discovery controls hold.

Benefits / risks: Faster findability and Chat handoff are real; Preview/GA dates move; SharePoint-surface admin docs may lag the Copilot-app Search pages; RCD propagation takes time on large sites — don’t brief “we flipped the toggle this morning” as instant invisibility.

I’d suggest one Steady note this week: publish the hotspot list, confirm RCD on the top ten risk sites, and put 573696 Preview on the change calendar with an owner to re-check MRC and Message Centre before anyone demos summaries of a half-open Finance library. You’ll get the search win without teaching Copilot where the skeletons live.

DIGITAL SKILL WORKS LTD / 12 PANES · You ask, we answer