AB-900 lesson 8: oversharing in SharePoint
Oversharing means content is reachable by more people than it should be, usually through broad groups, open sharing links or inherited permissions that nobody reviewed. Copilot makes it visible because it searches everything its user can open, so an old “everyone in the company” permission suddenly shows up in answers. The standard response is a sequence: find the overshared sites with data access governance reports in the SharePoint admin center, contain the worst cases with SharePoint Advanced Management, and fix permissions at the source.
What oversharing looks like
Four patterns cause most of it:
- A site or file shared with Everyone except external users (EEEU), the built-in group that holds all internal users.
- A large number of sharing links, especially links open to anyone in the organisation.
- Sites with thousands of members or with external guests who were never removed.
- Sensitive content in a site with weak permissions, such as contracts in a general team site.
None of these is a Copilot defect. Copilot returns only what the user could already open, so the fix belongs in SharePoint permissions, not in Copilot settings.
Finding it: data access governance reports
In the SharePoint admin center, the reports are under Reports, then Data access governance. They fall into two families:
| Family | What it tells you | Examples |
|---|---|---|
| Snapshot reports | The state of the tenant on the day the report was run | Site permissions across the organisation (the recommended starting point), site permissions for a given user, sensitivity labels applied to files, sites and files shared through special groups |
| Activity reports | Sharing activity in the last 28 days | Sharing links created, content shared with Everyone except external users |
Microsoft’s own recommended routine is to start with the snapshot report for a baseline, then use activity reports regularly to catch new exposure. Reports need the SharePoint Advanced Management prerequisites, and organisations without SharePoint Advanced Management have to switch on data collection before activity reports work; it takes about a day for data to appear.
The figure above shows the loop. Reports find, SharePoint Advanced Management contains, and owners fix.
Containing it: SharePoint Advanced Management
SharePoint Advanced Management (SAM) is a set of governance controls managed mainly in the SharePoint admin center. For oversharing, the actions to know are:
- Restricted access control. The admin names up to 10 Microsoft 365 or Entra security groups for a site. Only people who are both members of one of those groups and already permitted on the content can reach the site, even if they had a direct permission or a shared link before. Copilot and organisation-wide search honour the policy too. Adding someone to the group does not give them access by itself. The tenant switch is under Policies, Access control, Site-level access restriction; per site, it is under Sites, Active sites, Settings.
- Site access review. Sends the job of reviewing permissions to the site owners, starting from a report.
- Restricted content discovery. Keeps chosen high-risk sites and files from surfacing in Copilot and agent experiences.
- Block download policy, conditional access for sites and change history reports that show recent permission changes behind an exposure.
Sensitivity labels on sites, and DSPM for AI data risk assessments in Purview, complement these tools.
Worked example: preparing a 200-person company for Copilot
A company plans a Copilot rollout in a month. The SharePoint admin runs the site permissions report and finds that the Finance site is shared with Everyone except external users, from a project years ago. The sharing links activity report also shows one HR site with many new links in the last 28 days.
Triage follows the sensitivity of the content and the amount at risk. For Finance, the admin applies restricted access control with the finance security group, which cuts off everyone outside that group, including holders of old links (search and Copilot can take a little while to reflect the change). For HR, the admin starts a site access review so the owners remove unneeded links. The admin then asks the owners to replace the EEEU group with the real finance membership, and runs the snapshot report again to confirm that the exposure fell. Restricted access is a containment step; the final cleanup still happens in the site’s own permissions.
Easy to confuse
- Snapshot versus activity report. One shows the current state, the other shows the last 28 days of sharing.
- Restricted access control versus normal site permissions. Normal permissions grant access; restricted access control is an extra gate that can only narrow it.
- Restricted access control versus restricted content discovery. The first blocks people from the site; the second keeps content from surfacing in Copilot and search discovery.
- SharePoint Advanced Management versus Purview. The first governs SharePoint and OneDrive sites in the SharePoint admin center; Purview governs data across services with labels, DLP and retention.
- Fixing the model versus fixing access. Oversharing is never resolved by changing Copilot.
Key points
- Oversharing is broad or forgotten access: EEEU, open links, huge membership, sensitive files in weakly protected sites.
- Copilot only exposes what the user may open, so fixes are permission fixes.
- Data access governance reports (SharePoint admin center, Reports) include snapshot reports and 28-day activity reports.
- Restricted access control limits a site to named groups, up to 10, and is honoured by Copilot and search.
- Site access reviews hand permission clean-up to site owners; change history reports explain how an exposure arose.
- Typical order: discover, contain, fix at the source, run the report again.
Check yourself
Question 1. Before a Copilot rollout, an admin needs a list of sites where sharing links were created most often in the last month. What should the admin run?
- A. The site permissions snapshot report
- B. The sharing links activity report in data access governance
- C. A retention policy report
- D. A Compliance Manager assessment
Show answer
Answer: B
The sharing links report is an activity report in data access governance and covers the last 28 days. The site permissions report is a snapshot of the permission structure, not recent link activity. A retention policy and a Compliance Manager assessment do not report on sharing links.
Want more questions like this? Full AB-900 practice tests →
Question 2. A site holding merger documents is shared with Everyone except external users. The admin wants only the deal team's security group to reach it right away, including people holding old sharing links. What should be used?
- A. Move the files to a new document library
- B. A DLP policy for sensitive information types
- C. An inactive site policy
- D. Restricted access control with the deal team’s security group
Show answer
Answer: D
Restricted access control limits the site to members of the named group who also have permission, and people outside the group lose access even with previous links. Moving files to a new library does not remove links on the site. A DLP policy reacts to content patterns and does not narrow site access. An inactive site policy deals with unused sites.
Want more questions like this? Full AB-900 practice tests →
Question 3. A manager says: Copilot showed an employee the salary file, so Copilot must have broken permissions. What is the best response?
- A. Check the file’s permissions and sharing, because the user could already open it
- B. Ask Microsoft to retrain the Copilot model
- C. Disable Microsoft Graph for the whole tenant
- D. Treat it as a Copilot bug that bypassed security
Show answer
Answer: A
Copilot returns only content the user can already open, so the file was reachable, most likely through a broad group or sharing link. Fixing the permission at the source and reviewing similar sites is the correct next step. Retraining a model, disabling Graph or assuming a bug misunderstands how grounding works.
Want more questions like this? Full AB-900 practice tests →
This lesson closes the data protection and governance domain of AB-900 (35-40% of the exam); the recap in AB-900 data protection and governance condenses it, and the topic page on sensitivity labels shows how labels complement site controls.