Preparing for Microsoft 365 Copilot: finding and fixing SharePoint oversharing

Microsoft 365 Copilot doesn't change anyone's permissions: it can only use content the signed-in user can already open. What changes is speed: Copilot surfaces in seconds what nobody would have stumbled on, so years of "Everyone except external users" grants, organization-wide links and open team sites suddenly matter. In this post I'll show how to find SharePoint oversharing, contain the riskiest sites quickly, fix permissions with site owners and keep the problem from coming back.

Prerequisites and how it works#

Copilot grounds its answers in Microsoft Graph and the semantic index, and both are trimmed to what the user can access. Oversharing therefore means content people can open but shouldn't. In most tenants it comes from four places:

• "Everyone except external users" (or "Everyone") granted on a site, library, folder or file.
• Public teams and Microsoft 365 groups, whose content everyone in the organization can open.
• Organization-wide and Anyone sharing links, which work for whoever receives or is forwarded the link.
• Old sites with broken inheritance, stale direct permissions and no active owner.

The tools below, data access governance reports, site access reviews and Restricted Content Discovery, are SharePoint Advanced Management (SAM) features. Microsoft includes SAM for tenants with Microsoft 365 Copilot licences; otherwise it's a paid add-on, so check the SAM prerequisites against your licences. You need the SharePoint Administrator role, plus the SharePoint Online Management Shell for bulk changes; the special-groups report in step 1 also needs the SharePoint Advanced Management Administrator role, assigned by a Global Administrator.

Step-by-step#

1. Find oversharing with data access governance reports#

In the SharePoint admin center, open Reports › Data access governance.

• Start with the snapshot report Site permissions across your organization, Microsoft's recommended baseline. It highlights the sites with the broadest access: large audiences, guests and "Everyone except external users". Run it quarterly.
• Add the activity reports, which cover the last 28 days: Sharing links (Anyone, People in your organization and Specific people links) and Shared with 'Everyone except external users'.
• If you use the activity reports without SAM, you must turn on data collection first. Reports appear 24 hours later and hold 28 days of data, so do it early.
• The Site permissions for users snapshot report lists every site a chosen user can reach; run it for pilot users to see what Copilot could draw on.
• The Sites and files shared via special SharePoint groups snapshot report lists every site, folder and file in SharePoint and OneDrive that "Everyone except external users" or "Everyone" can reach. Run it from View reports in that section; you can rerun it every 30 days.

The reports show breadth of access, not sensitivity, so add business context: which sites hold HR, finance, legal or executive material? Broad access to sensitive content is your first wave.

2. Contain the riskiest sites#

Restricted Content Discovery (RCD) takes a site's content out of Copilot and organization-wide search for people who don't own it and haven't recently worked with it. Permissions don't change and members still open files normally, but the site's AI entry points disappear, such as the Copilot button, AI actions menus (including creating agents) and Create pages with AI. For one site, go to Sites › Active sites, select the site, and on the Settings tab turn on Restrict content from Microsoft Copilot. For a batch:

Connect-SPOService -Url "https://contoso-admin.sharepoint.com"

# rcd-sites.csv has a Url column
Import-Csv .\rcd-sites.csv | ForEach-Object {
    Set-SPOSite -Identity $_.Url -RestrictContentOrgWideSearch $true
}

# Stop new "Everyone except external users" grants from the people picker
Set-SPOTenant -ShowEveryoneExceptExternalUsersClaim $false

Hiding the claim stops new grants but doesn't remove existing ones. For sites that must be limited to one group whatever has been shared, Restricted Access Control goes further: once it's enabled for the tenant, Set-SPOSite -RestrictedAccessControl $true -RestrictedAccessControlGroups <group ID> blocks everyone outside the named groups, including people with existing links.

3. Fix permissions with site owners#

Except for the special-groups report, whose item list you can script against, these reports stop at site level for compliance reasons, and site owners know what should be shared. From a data access governance report, select up to 100 sites and start a site access review. Each owner gets an email linking to a review page for the finding: groups and items that include "Everyone except external users", sharing links, or the permissions baseline. Reviews cover SharePoint sites only, not OneDrive. Typical fixes are:

• Remove "Everyone except external users" from SharePoint groups and items.
• Delete organization-wide and Anyone links, or replace them with Specific people links.
• Make public teams private when their content isn't meant for everyone.
• Give ownerless sites an owner, and archive or delete inactive ones.

Also change the default link type to Specific people so new links don't recreate the problem; see SharePoint and OneDrive external sharing explained. When a site is clean, turn RCD off again; to let site admins manage it on their own sites, run Set-SPOTenant -DelegateRestrictedContentDiscoverabilityManagement $true. They must justify each change, and changes are audited in Microsoft Purview.

4. Protect sensitive content with labels and DLP#

Permissions drift, so sensitive content needs protection of its own. With Microsoft Purview sensitivity labels that apply encryption, Copilot uses a file only for users who have the VIEW and EXTRACT usage rights. Default labels on sensitive libraries and auto-labeling raise coverage without relying on users. A Purview DLP policy scoped to Microsoft 365 Copilot can also keep content with chosen labels out of Copilot responses.

5. Run it as a phased rollout#

Verify#

• Compare snapshot reports between runs: the number of broadly accessible sites should fall.
• Check RCD with Get-SPOSite -Identity <url> | Select-Object Url, RestrictContentOrgWideSearch (good looks like True); the site also shows a Restricted tag and no Copilot button.
• Sign in as a test user who has access to an RCD site but has never opened a particular document there. Ask Copilot about it: it shouldn't cite that document, and organization-wide search shouldn't return it. Allow time for large sites to propagate.
• Track site access reviews to completion, then rerun the report to confirm the findings are gone.

Tips & gotchas#

• RCD is not a security boundary. Anyone with permissions can still open the files directly, so it buys time; it doesn't fix access.
• RCD also hides content from people who should see it in Copilot and removes the site's AI features for its own members, so treat it as temporary.
• Don't wait for perfection. Fix the sites with broad access and sensitive content first, and start the pilot in parallel.
• Agents follow the same rules. Agents grounded in SharePoint see what their users can see, so this clean-up protects them too.
• Cover OneDrive separately. Site access reviews and RCD skip OneDrive, so use the sharing links and special-groups reports, which cover it.

References#

• Data access governance reports for SharePoint and OneDrive sites
• Restrict discovery of SharePoint sites and content
• Initiate site access reviews for data access governance reports