vinayaklatthe Microsoft 365 Copilot Oversharing Controls
Microsoft 365 Copilot honours existing permissions - so if content is overshared, Copilot can surface it to users who technically have access but shouldn't. This skill covers reducing that blast radius before and during Copilot rollout using SharePoint Advanced Management, sensitivity labels, restricted content discovery, and DLP for Copilot.
When to use
Preparing a tenant for Microsoft 365 Copilot and continuously controlling what Copilot can reach across SharePoint, OneDrive, and Teams.
Do not use this skill to monitor sensitive data in prompts (use purview-dspm-ai) or to design a
broader DLP program (use purview-dlp-policy).
Pick the right oversharing lever
| Symptom | Lever |
|---|---|
| "Everyone except external users" (EEEU) on too many sites | SAM data access governance report + permission cleanup |
| Sensitive content in broadly shared sites | Sensitivity labels (encrypt) + container labels for sites |
| Site shows up in Copilot results when it shouldn't | Restricted content discovery (RCD) on the site |
| Labelled content should be excluded from Copilot grounding | DLP for Microsoft 365 Copilot |
| Sharing links sprawl | SAM sharing link report + cleanup policies |
Rule of thumb: assess (DAG report) -> classify (labels) -> restrict (RCD, link policy) -> exclude (DLP for Copilot) -> govern (site lifecycle). Skipping the assess step is the most common failure.
Approach
- Assess - Use SharePoint Advanced Management (SAM) data access governance reports to find oversharing: "everyone/EEEU" access, broadly shared sites, sharing links, and permissioned but sensitive content. Verify: DAG report identifies top-N risky sites with owners.
- Engage site owners - Notify owners of risky sites with the remediation expected; do not remediate centrally without owner context. Verify: owner remediation tickets/issues opened with deadline.
- Classify & label - Apply sensitivity labels to sensitive content; container labels for sites; labels can encrypt and restrict, and Copilot respects label permissions. Verify: top-tier label encrypts and Copilot cannot surface the file to unauthorised test user.
- Restrict - Use restricted access control / restricted content discovery (RCD) on sensitive sites, tighten "everyone except external users" grants, and clean up sharing links. Verify: RCD-flagged site no longer appears in test user's Copilot answers.
- Apply DLP for Copilot - Use DLP for Microsoft 365 Copilot to exclude labelled content from Copilot processing where required. Verify: a test prompt referencing labelled content is excluded or warned.
- Govern lifecycle - Apply site lifecycle/access reviews to prevent regression; set inactive site policies in SAM. Verify: inactive sites archived or owners re-attested per cadence.
- Monitor with DSPM for AI - Continuously surface unlabelled sensitive files Copilot can access; loop back to label + restrict. Verify: weekly DSPM for AI report shrinks unlabelled-sensitive count.
Guardrails
- Remediate oversharing before broad Copilot enablement; a pilot can proceed on a scoped, clean set of sites but tenant-wide turn-on without assessment generates user complaints fast.
- Sensitivity-label encryption is the strongest control - Copilot can't use content the user can't decrypt/extract; reserve for genuinely sensitive content.
- Oversharing control is ongoing governance, not a one-time cleanup - new sites are created daily and sharing links sprawl without policy.
- Coordinate with site owners; bulk permission stripping from the centre breaks legitimate collaboration and erodes trust in the program.
- SAM is licensed separately (E5 / standalone SKU) - confirm before assuming reports are available.
Common anti-patterns
- Enabling Copilot tenant-wide and then trying to remediate oversharing - users have already seen the wrong files.
- Running the DAG report once, fixing the top 20 sites, and declaring done.
- Encrypting everything with the top label "to be safe" - breaks external collaboration and Copilot grounding alike.
- Restricted content discovery applied to half the tenant - users complain Copilot is useless.
- Ignoring sharing links because the report is long.
Example prompts
Make SharePoint Copilot-ready by remediating oversharing.Use SharePoint Advanced Management to tighten site permissions before Copilot.How do I stop Copilot surfacing files users should not see?Run data access governance to limit Copilot content.Apply restricted content discovery to a sensitive site.
Microsoft Learn
- Copilot data protection considerations: https://learn.microsoft.com/purview/ai-microsoft-purview-considerations
- SharePoint Advanced Management: https://learn.microsoft.com/sharepoint/advanced-management
- Data access governance reports: https://learn.microsoft.com/sharepoint/data-access-governance-reports
- Restricted content discovery: https://learn.microsoft.com/sharepoint/restricted-content-discovery
- Prepare for Copilot: https://learn.microsoft.com/copilot/microsoft-365/microsoft-365-copilot-requirements
- DLP for Microsoft 365 (overview): https://learn.microsoft.com/purview/dlp-learn-about-dlp