Notes · Microsoft 365

Before Copilot starts: find overshared content

Microsoft 365 Copilot grounds its answers in the data the person asking already has permission to access. That sounds reassuring. In many companies, that is exactly the problem.

Over the years a lot builds up: a team created as “public”, a folder shared with everyone in the company, an “Anyone with the link” link nobody remembers. So far it hardly mattered, because nobody went looking. Copilot looks. If an employee asks about “salaries 2026” and the payroll list sits in an open location, it can show up in the answer. The example is made up, the pattern is not.

What Microsoft provides

First, licensing. As soon as at least one person in your company has a Microsoft 365 Copilot licence, your SharePoint administrators get the SharePoint Advanced Management features that support Copilot. Without Copilot, SharePoint Advanced Management is available as an add-on (Plan 1). With Microsoft 365 E5 alone you only see some of the reports, without snapshots and without remediation. The most important tools:

• Data access governance reports in the SharePoint admin center. The site permissions report gives a snapshot of which SharePoint and OneDrive sites have the broadest access, for example thousands of users, guests or the group “Everyone except external users”. Two more reports show where many sharing links were created in the last 28 days, or where content was shared with everyone in the company.
• Site access review. You send a flagged site to its owners, and they review the permissions themselves.
• Restricted Content Discovery. A site no longer appears in organisation-wide search and in Copilot, while its permissions stay the same. Microsoft describes it as a temporary measure while reviews are under way. It is not available for OneDrive.
• Restricted Access Control. A site is then only accessible to members of a specific group, even if others had access or a link before.
• Policies for inactive sites and site ownership. They find sites without owners or without use, which you can archive or delete.

I no longer use the older Restricted SharePoint Search. Microsoft is retiring it, and since 31 July 2026 it can no longer be newly switched on.

For sensitivity labels and data loss prevention, Microsoft Purview comes in. The report on files with sensitivity labels requires E5. Purview also runs a weekly risk assessment for the 100 most-used SharePoint sites. I check in your tenant which of these features your licences cover.

In this order

1. Check sharing settings. According to Microsoft, SharePoint is set to the most permissive option by default. I check whether “Anyone” links are needed and set an expiry date.
2. Take a snapshot. The site permissions report produces a list of the sites with the broadest access.
3. Protect the sensitive parts first. I take HR, finance and management out of Copilot with Restricted Content Discovery until they have been reviewed.
4. Clean up with the owners. Owners review their sites. Where needed, I restrict access to a group.
5. Remove what is left over. Archive or delete ownerless and inactive sites. What no longer exists, Copilot cannot find.
6. Start Copilot with a small group. After that, the activity reports run monthly and the snapshot quarterly, as Microsoft recommends.

What I do

• I produce a report for your tenant: which locations are too open, ordered by risk, with a proposal for each.
• I carry out the fixes with you and the site owners, so nobody suddenly finds a locked folder.
• I support the start with a pilot group.
• Every change is documented, for your team and your auditors.