Most businesses I work with have the same retention policy, even if nobody wrote it down: keep everything, forever, just in case. Storage feels cheap, deleting feels risky, and nobody wants to be the person who threw out the one file the lawyers asked for.
I get it. But in a world of Copilot and constant breaches, “keep everything” isn’t the safe option anymore. It’s quietly making both your security and your AI worse.
More data, more risk
Every file you keep is a file someone can steal. An old client spreadsheet from 2014 does nothing for you today, but it’s just as damaging when it turns up in a breach. The bigger the pile, the bigger the attack surface and the more there is to lose.
Old data is also usually the worst-governed data. Sites from long-finished projects still have “Everyone” links. Ex-staff’s shares never got cleaned up. And if you ever end up in a dispute, everything you kept is potentially discoverable, including things you’d forgotten existed.
For Australian businesses there’s a legal angle too. Under APP 11.2, once you no longer need personal information for any permitted purpose, you must take reasonable steps to destroy or de-identify it (with limited exceptions). Hoarding isn’t neutral. It can be a compliance problem.
Why Copilot cares about your mess
Microsoft is clear that Copilot “only surfaces organizational data to which individual users have at least view permissions.” (Microsoft Learn). That’s good security design, but it means Copilot grounds its answers in everything a user can reach, rubbish included.
Picture asking Copilot for the current pricing policy. It finds five versions across SharePoint, Teams and someone’s OneDrive, including the 2019 draft that was never approved. Stale, duplicated and conflicting content produces confused answers, and users then decide “AI doesn’t work”.
Worse is oversharing. Copilot doesn’t create permission problems, it reveals them. The salary file that was technically open to everyone but buried six folders deep can suddenly appear in an answer. I wrote more about this in Data Governance Is the Real Copilot Readiness Test.
What good looks like: Microsoft’s tools for tidying up
The good news is Microsoft 365 already has the tools. Here’s where I’d start:
- Retention policies and labels. Purview Data Lifecycle Management lets you retain-only, delete-only, or retain and then delete. Retain-then-delete is the one most businesses are missing.
- Records management. For content you genuinely must keep, use Purview records management so it’s protected deliberately, not by accident.
- Archive, don’t hoard. Microsoft 365 Archive provides cost-effective storage for inactive SharePoint sites and files.
- Find dead sites. SharePoint site lifecycle management includes inactive site, site ownership and site attestation policies, part of SharePoint Advanced Management.
- Buy time while you clean up. Restricted Content Discovery limits specific sites from appearing in organisation-wide search and Copilot responses while you review them.
- Watch AI usage. Data Security Posture Management for AI is Purview’s front door to discover, secure and apply compliance controls to AI use.
- Follow the blueprint. Microsoft’s secure and governed foundation for Copilot guide pulls these pieces together.
Tidy data is a competitive advantage
Deleting things feels scary. Keeping everything feels safe. The reality is the reverse. A smaller, well-governed data estate is easier to secure, cheaper to defend in a dispute, and gives Copilot something worth reasoning over.
If you’re an MSP, this is a conversation worth having with every client now. Start with retain-then-delete and inactive sites. Your clients’ security and their AI results will both thank you.
