If left unaddressed, M365's default permissions and Copilot's discoverability can create major cybersecurity risks for organizations and their data.