Microsoft 365 Copilot respects every permission in your tenant, which is exactly the problem. It does not grant anyone new access; it makes the access they already had usable for the first time. A folder shared organization-wide in 2021 and forgotten stops being harmless the moment an employee can simply ask for what is in it.
So we do the unglamorous part first. We find and fix oversharing, apply sensitivity labels where they matter, then run a pilot with a defined group and a baseline to measure against. Licences come after the tenant is ready, not before.