Use Data Access Governance to Find Overshared SharePoint Sites

To find overshared SharePoint sites before Copilot, run the Data access governance reports in the SharePoint admin center (Reports > Data access governance). Start with the site permissions report, then the sharing links and “Everyone except external users” activity reports. Then fix what they show in order: tighten external sharing, harden the riskiest sites, and hide sites that still need cleanup from search and Copilot while you review them.

The steps stay focused on what matters for Copilot: who can see files in SharePoint and OneDrive, how links behave, and which sites are discoverable in search.

Before you start: roles, scope, and Copilot context

Microsoft documents that Copilot experiences are powered by large language models, grounded in web and organizational data from Microsoft Graph and Work IQ, and scoped by existing user permissions. Copilot works within what each user can already access, but it makes that access much easier to use, so overshared sites become a Copilot risk.

This workflow is most critical if you plan to license users for Microsoft 365 Copilot (Premium), but it also reduces oversharing for organizations using only Copilot Chat (Basic) or Microsoft 365 Copilot (Basic). As a SharePoint administrator, you can change organization level sharing settings for SharePoint and OneDrive in the SharePoint admin center; these steps assume you have that role.

The Data access governance reports and restricted content discovery are SharePoint Advanced Management features, so check the SharePoint Advanced Management prerequisites first. Restricted content discovery also needs a Microsoft Copilot license in your organization. Admins with Microsoft 365 E5 but without SharePoint Advanced Management can still use the Data access governance activity reports (up to 10,000 sites), but not the snapshot reports.

For broader data classification, protection, and lifecycle beyond external sharing, Microsoft Purview provides data governance, security, and compliance solutions that complement sharing governance. If you need a wider readiness plan, including information architecture and permissions, the SharePoint Copilot readiness checklist and the Microsoft 365 Copilot Readiness service can help you put these steps in a larger rollout.

Understand how Microsoft 365 Copilot uses SharePoint content

Microsoft 365 Copilot (Premium) responses are grounded in organizational data through Microsoft Graph, and that access is scoped by each user’s permissions. So if a user can open a sensitive file that was shared too widely, Copilot can draw on it for that user. The same overview highlights SharePoint Advanced Management and restricted content discovery for reducing oversharing and limiting discovery of specific sites during reviews. This article follows that order: find the overshared sites, fix global sharing defaults, lock down specific sites, then use restricted content discovery while you remediate.

Find overshared sites with the Data access governance reports

In the SharePoint admin center, expand Reports and select Data access governance. Microsoft describes the Data access governance reports as a way to discover sites that contain potentially overshared or sensitive content. Use them in this order:

1. Run the site permissions report first.
   Site permissions across your organization is a snapshot of the permission structure across all SharePoint and OneDrive sites. It shows the sites with the broadest access, such as sites with thousands of users, external guests, or “Everyone except external users” permissions. Microsoft suggests running snapshot reports quarterly.

2. Then run the two activity reports.
   The Sharing links report shows the sites where users created the most sharing links (Anyone, People in the organization and Specific people) in the last 28 days. The Shared with ‘Everyone except external users’ report shows sites where content was shared with every internal user. Microsoft suggests running activity reports monthly.

3. Check where your sensitive files live.
   The Sensitivity label applied to files report lists sites that contain files with specific sensitivity labels. A site that holds labeled files and also appears in the broad-access reports goes to the top of your list.

4. Write the “under review” list.
   The sites at the top of that list are the ones to fix first and to hide from Copilot while you fix them.

Without SharePoint Advanced Management, you must turn on data collection before the activity reports can be generated. Reports are available 24 hours later and only contain data from that point on. Microsoft also notes that the reports might not work if your organization shows concealed user, group and site names in reports; a Global Administrator can change that under Reports in the Microsoft 365 admin center.

Set a safer baseline for external sharing in SharePoint and OneDrive

The fastest way to improve data access governance for Copilot is to set a safer organization wide external sharing baseline in the SharePoint admin center Policies > Sharing page. This controls how far content can be shared from any SharePoint site or OneDrive by default.

1. Open the SharePoint admin center and go to Policies > Sharing.
   This page controls the organization level external sharing settings for both SharePoint and OneDrive.

2. Review the External sharing options for SharePoint and OneDrive.
   There are four levels: Anyone, New and existing guests, Existing guests, and Only people in your organization. Anyone allows unauthenticated link access and also lets users share sites with new and existing guests who authenticate, while Only people in your organization turns off external sharing.

3. Choose the most permissive level you are comfortable with before Copilot rollout.
   For many organizations preparing for Copilot, a good starting point is to avoid Anyone at the organization level and use New and existing guests instead, so people who receive invitations must sign in with a work, school or Microsoft account, or verify their identity with a code.

4. Configure More external sharing settings to reduce long lived access.
   On the same page, expand More external sharing settings. Consider turning on Guest access to a site or OneDrive will expire automatically after this many days, and requiring people who use a verification code to reauthenticate regularly.

5. Set safer default link types under File and folder links.
   Set the default link type to Only people in your organization or Specific people, so broad Anyone with the link sharing is an exception, not the norm.

6. If you keep Anyone links, limit their power.
   Under Advanced settings for “Anyone” links, require link expiration and, where possible, restrict links to view only permissions. This keeps long lived, broad read access to a minimum.

Remember that the OneDrive external sharing setting can be more restrictive than SharePoint’s, but not more permissive. If you want tighter control over personal workspaces before Copilot, reduce OneDrive’s level one step below SharePoint’s.

Tighten sharing on known high-risk sites

SharePoint lets you configure more restrictive sharing settings for individual sites, as long as each site’s setting is at the same or more restrictive level as the organization, as documented in Manage sharing settings for SharePoint and OneDrive in Microsoft 365. Use this to protect high risk areas such as HR, finance, or executive sites while keeping collaboration flexible elsewhere.

1. Start with the sites the reports flagged.
   Focus on sites that store sensitive content and have broad access, or where the sharing links report shows many new Anyone links.

2. Set a more restrictive external sharing level per site.
   Each site has its own sharing setting and it must be as or more restrictive than the organization level setting. For sensitive sites, move them to Existing guests or Only people in your organization, following Microsoft’s “Change the external sharing setting for a site” guidance referenced from the sharing settings article.

3. Prevent old guests from regaining access accidentally.
   Microsoft notes that if you turn off external sharing for your organization and later turn it back on, guests regain access. If you plan a tenant wide switch, first turn off external sharing for specific sensitive sites so that guests do not automatically regain access later.

For more patterns on controlling oversharing at the site level, see the broader guidance in SharePoint external sharing governance in Microsoft 365.

Keep risky sites out of Copilot search while you fix them

Restricted content discovery limits discovery of content from specific SharePoint sites, including recently interacted files, in organization-wide search results and Microsoft Copilot responses while reviews are taking place. Microsoft designed it as a temporary control: it does not change permissions, so people who already have access can still open the content directly. It works on SharePoint sites only, not OneDrive.

1. Take the sites from your “under review” list.
   Use it selectively. Microsoft warns that applying it too widely reduces the content available to search and Copilot, which makes their answers less complete.

2. Turn it on for each site.
   In the SharePoint admin center, expand Sites, select Active sites, and select the site. On the Settings tab, turn on Restrict content from Microsoft Copilot and select Save. The change takes time to reach search and Copilot; for sites with more than 500,000 items, Microsoft says it can take more than a week.

3. Remove the restriction once access is correct.
   After site owners have tightened sharing and cleaned up links, turn the restriction off so content from those sites can appear again in search and Copilot for people who are entitled to see it. Microsoft documents removal with PowerShell: Set-SPOSite -Identity https://contoso.sharepoint.com/sites/finance -RestrictContentOrgWideSearch $false.

If you are already using SharePoint Advanced Management, the overview in SharePoint Advanced Management: what to review before Copilot expands access can help you align restricted content discovery with broader oversharing and lifecycle controls.

Confirm external sharing changes and Copilot behavior

You should verify that your data access governance changes are working at the sharing layer and in Copilot responses. Microsoft notes in the sharing settings article that if you restrict or turn off external sharing, guests typically lose access within about an hour of the change. Copilot access is scoped by user permissions, so once a user can no longer open content, Copilot should no longer use it for that user, as described in the Copilot overview.

Use these quick checks:

1. Test an existing guest link.
   Before changing settings, have a test guest open a shared file or site. Then reduce external sharing for that site or turn it off; within about an hour, the guest should no longer be able to open the same URL.

2. Check default link behavior for internal users.
   Ask a user to share a file after you change the default link type on the Sharing page. Confirm that the default is now Only people in your organization or Specific people, not Anyone with the link.

3. Validate Copilot behavior for a pilot user.
   Have a pilot user with a Microsoft 365 Copilot (Premium) license ask Copilot to summarise content from a site they can currently access, then remove their access. After the change has propagated, Copilot should stop returning content from that site in responses for that user.

4. Check a restricted site in organization-wide search.
   For a site with restricted content discovery turned on, search SharePoint home or Office.com for a document you know is on it. Once the setting has propagated, it should not appear, while site members can still open the site directly.

5. Run the reports again next month.
   The sharing links and “Everyone except external users” reports should show fewer new broad shares on the sites you fixed.

Common issues when tightening sharing before Copilot

Tightening sharing is necessary for Copilot readiness, but a few product behaviors described in Manage sharing settings for SharePoint and OneDrive in Microsoft 365 can surprise teams if they are not planned for.

• Guests regain access when org-level sharing is toggled.
  If you turn off external sharing for your organization and later turn it back on, guests regain access. Protect sensitive sites by setting their site level sharing to Only people in your organization before any tenant wide toggles.

• Entra external collaboration settings still block sharing.
  Microsoft Entra external collaboration settings determine who can invite guests for site sharing, and allowed or blocked domains in Microsoft Entra ID also affect SharePoint and OneDrive sharing. If users cannot share externally even though SharePoint shows external sharing as allowed, review those Entra settings.

• File requests stop working if you disable Anyone links on OneDrive.
  Microsoft notes that file requests require OneDrive to be set to Anyone and for edit permissions on Anyone links to be enabled; any other OneDrive setting disables file requests. Plan alternative intake methods before tightening OneDrive sharing.

Combining the Data access governance reports, safer external sharing defaults, site level hardening, and restricted content discovery gives you a concrete, Microsoft supported way to reduce oversharing before Copilot expands how people discover your SharePoint and OneDrive content.