Your Copilot is hallucinating? It might be your data, not the model

Copilot for Microsoft 365 grounds every answer in the content the current user can access — SharePoint, OneDrive, Teams, Exchange. That is by design and it is what makes it useful. It is also why the same rollout that made the demo look magic makes production feel unreliable a month later.

The old-file problem

A typical mid-size tenant we scan has:

• 3-8 versions of the same "HR Policy" document, differing on the small print, spread across departmental sites.
• A "Pricing 2018 draft" PDF that surfaces above the 2026 pricing site because it was pinned at some point.
• Half-written SOPs whose "final" version lives in someone's OneDrive under a slightly different name.
• A "Sales one-pager" from a product line the company sold off two years ago, still labelled with the corporate branding.

Copilot cannot tell which one is authoritative unless you tell it. When it is asked "what is our expenses policy", it will happily quote from the 2018 draft alongside the 2026 official. That is not a hallucination in the model sense — it is the ground truth being wrong.

Fixing the data before you fix the prompt

The order of operations we recommend to customers rolling out Copilot at any scale:

1. Run a duplicate scan. Copies of the same document are the single biggest source of "which one wins".
2. Find the stale-owner list. Any policy or SOP owned by an ex-employee is suspect — Copilot will still surface it.
3. Retire the pre-Copilot draft folders. Marketing drafts from 2018 that nobody archived are the most common Copilot embarrassment.
4. Add sensitivity labels to the sources of truth. Copilot respects them and will prefer up-to-date, labelled content when ranking.

TSO produces the ranked reclaim list for steps 1-3 in one scan. Step 4 is Purview territory, but you cannot label what you have not surfaced.

“Bad data plus a good model equals a confidently wrong answer at scale.”— Any Copilot lead you talk to, off the record