ChatGPT Now Reads SharePoint, Teams and Outlook Live – What to Check Before You Switch It On

ChatGPT Enterprise now reaches your company data in SharePoint, Teams, Outlook and Google Drive through live access only, using each person's own permissions. That is the right approach – but it makes every over-shared file instantly findable by the AI.

OpenAI announced the change on 16 October 2026 in its release notes for ChatGPT Enterprise and Edu. Administrator-managed sync connectors have been retired, and OpenAI points users to the real-time apps for Google Drive, SharePoint and Microsoft Teams instead. At the same time, new content controls arrived for live access to Google Drive, Teams and Outlook email.

What exactly is changing

Until now there were two ways to bring company data into ChatGPT. With sync, content was copied in advance and indexed by OpenAI. With live access, ChatGPT only queries the data at the moment someone asks a question. Sync is being phased out:

• Since 10 August 2026: No new sync connections that individuals set up themselves.
• From 14 August 2026: Existing personal sync connections switched off, and the synced data is being deleted.
• Since 16 October 2026: Administrator-managed sync connectors have been retired as well.
• What remains: The real-time apps. According to OpenAI, each person's existing Microsoft 365 or Google permissions continue to apply.

For data protection and traceability, this is good news. There is no longer a second copy of your documents sitting in a separate index, where it can go stale or be forgotten. Whatever is deleted or locked in SharePoint is gone for ChatGPT too.

The real risk sits in your Microsoft 365

"The AI only sees what the person is allowed to see" sounds reassuring. In practice it means the AI finds everything the person could see – including things they would never have come across before.

In many SMEs, permissions have grown organically over the years. A Teams channel set up as open for a project. A folder of payroll lists accidentally shared with "everyone in the organisation". An old quote with a key customer's terms on an open SharePoint site. As long as you had to search for such files deliberately, they stayed practically invisible. An AI assistant that searches across every accessible source in response to a harmless question brings them to the surface.

This is not a flaw in ChatGPT. The same applies to any assistant that accesses Microsoft 365 with the user's rights – including Claude and its Microsoft 365 connector, which we wrote about here. The AI exposes the sharing you already have. Cleaning it up is your job.

The levers you now have

The new controls are useful but coarse. According to OpenAI's documentation, administrators in Enterprise workspaces can, among other things:

• Google Drive: Allow or block entire shared drives and control access to "My Drive" separately. Individual folders or files cannot be excluded.
• Microsoft Teams: Allow or block specific teams and exclude teams carrying chosen sensitivity labels.
• Outlook: Exclude emails carrying chosen sensitivity labels.
• Actions: Decide per app whether ChatGPT asks before every action or may, for example, carry out read-only actions automatically.

Two points matter here. First, the sensitivity-label controls only work if your documents and emails actually carry such labels. In many SMEs Microsoft Purview is licensed but was never set up. Second, the defaults depend on the plan. According to OpenAI, apps are off by default in ChatGPT Enterprise but on by default in ChatGPT Business. If you use Business, check what is already active.

Then there is the Microsoft side: for some features in Outlook, Teams and SharePoint, an administrator has to grant the required permissions in Microsoft Entra. That consent should be a deliberate decision, not a click to make an error message go away.

Our view

For some time we have recommended that companies handling sensitive data choose enterprise plans such as ChatGPT Enterprise or Claude Enterprise – precisely because they offer controls like these. The move to live access confirms that path. But it shifts the responsibility: the quality of your AI security now depends directly on the quality of your Microsoft 365 permissions.

So the order matters. Clean up sharing first, then open access step by step – not the other way round. Start with a pilot group and a few clearly defined locations. That fits our building-block approach to AI adoption: small, controlled steps rather than one big switch.

What to do now

• Take stock: Check in the ChatGPT admin area which apps are active and for whom – especially if you use ChatGPT Business.
• Clean up sharing: Have SharePoint and Teams reviewed for content shared with the whole organisation or by link. Start with HR, finance and contracts.
• Introduce sensitivity labels: Even two or three levels such as "Internal" and "Confidential" are what make the new exclusion rules in Teams and Outlook work.
• Limit actions: At first, let ChatGPT only read, or ask before every action. Grant more freedom once the setup has proven itself.
• Find out where you stand: Our free AI Readiness Check shows in a few minutes where your company stands on data, rules and responsibilities.