Fixing SharePoint Oversharing Before You Turn On Copilot

Microsoft 365 Copilot does not break SharePoint permissions — it makes bad permissions discoverable at conversational speed. EPC Group sequences pre-Copilot remediation as contain, then correct, then constrain: restrict discovery on high-risk sites first, fix permissions second, and enforce secure defaults last.

Last updated: 2026-07-31

EPC Group is a Houston-based Microsoft consulting firm operating since 1997, with six Microsoft Solutions Partner designations and 216+ M&A tenant migrations covering 1.83M users. Governed Microsoft AI, Data & Cloud — since 1997.

Key facts

Remediation is surface 3; the eight-surface standard sets the order for the rest.

• Copilot grounds answers in content the user already has permission to access. It adds no access. It removes the friction that hid bad access.
• SharePoint Advanced Management (SAM) is entitled through Microsoft 365 Copilot — one assigned Copilot licence enables it for administrators. A SAM Plan 1 add-on covers tenants without Copilot.
• Microsoft 365 E5 alone gets a degraded subset: Data Access Governance reporting is visible, but no snapshot reports, no remedial actions, and activity reports capped at 10,000 sites.
• Restricted SharePoint Search is retiring — new enablement is blocked starting July 31, 2026. Restricted Content Discovery is the supported control.
• DAG activity reports cover the last 28 days; the EEEU report returns the top 100 sites; reports take up to 24 hours and re-run every 24 hours.
• Site access reviews cover up to 100 sites from the report web view and 1,000 per calendar month from the site permissions report. Beyond that, PowerShell.
• Restricted Content Discovery is a site-level index property with real latency — above 500,000 items an update can take over a week to reflect in Copilot.

Quick facts

Why Copilot converts latent oversharing into an incident

Nothing about your permissions changes when you assign a Copilot licence. Microsoft is explicit: Copilot retrieves data from Microsoft Graph and respects existing permissions, sharing settings and policies. The tenant is exactly as exposed the day before you deploy as the day after.

What changes is the cost of discovery. Finding the salary workbook someone shared with "Everyone except external users" in 2021 used to require guessing it existed, guessing a matching search term, and scrolling past the noise. Enterprise search punished vague intent. That friction was never a control, but it functioned as one, and organisations have quietly relied on it for a decade. Copilot removes it three ways at once: it accepts vague natural-language intent, it reads across containers and summarises instead of returning links, and it answers with confidence, so a user who would never open an unfamiliar site reads a paragraph synthesised from it.

This is why "Copilot leaked our data" incidents are almost never Copilot defects. They are permission defects with a new witness. That framing matters commercially: this is not an AI project, it is an access-governance project that AI gave you a deadline for. Run it that way and the output also feeds SOC 2 evidence and insider-risk work.

One corollary: Copilot is also an oversharing detector. A small instrumented pilot with a fast triage channel teaches more in two weeks than a scripted permission crawl teaches in two months — deliberately, with a contained population, not accidentally with 8,000 people.

The Contain–Correct–Constrain Model

The Contain–Correct–Constrain Model is EPC Group's sequencing framework for pre-Copilot remediation. Its governing rule: you cannot correct fast enough to outrun a deployment date, so contain first and correct on your own schedule. Teams that invert this either miss the date or ship with the worst sites still discoverable.

Two rules are non-negotiable. Containment is temporary and must have an expiry. Microsoft designs Restricted Content Discovery as an interim control and warns that excessive use degrades the completeness of Copilot answers — the value you are paying for. Every contained site needs a named owner and a review date. And constraint precedes broad rollout. Correcting 400 sites while users keep creating company-wide links buys you a treadmill.

Discovery: exactly which reports to run, and where

Run these in order. All live in the SharePoint admin center except where noted.

1. Content Management Assessment — Advanced Management → Start assessment. The hub, and the correct 2026 starting point. It runs five reports in one pass: inactive sites (no activity in 180 days), site ownership, broken inheritance, unrestricted internal sharing via EEEU, and unrestricted sharing links. Expect 2 to 72 hours by tenant size, and no action without consent. Re-run every 30 days.

2. Site permissions across your organization (snapshot) — Reports → Data access governance. Your baseline across every SharePoint and OneDrive site: which carry the broadest access, thousands of users, external guests, or EEEU. Run quarterly. It produces the number your sponsor will quote.

3. Sites and files shared via special SharePoint groups (snapshot) — the report most teams miss. Where report 2 names which sites are overshared, this names which items are effectively public through EEEU or Everyone, and how. That is what lets you script cleanup instead of waiting on 300 site owners.

4. Sharing links and Shared with 'Everyone except external users' (activity, last 28 days) — these catch oversharing as it happens. Run monthly. The EEEU report returns the top 100 sites; the detailed CSV extends to a million rows with administrator, template, privacy and sensitivity label.

5. Sensitivity labels for files and Purview DSPM data risk assessments — run both in parallel, not after. They overlay classification onto the same estate and flag overshared sites holding regulated content.

Two cautions. Reports will not run with concealed report data enabled — a Global Administrator must clear Display concealed user, group, and site names in all reports. And permissioned-user counts are not deduplicated: group, direct and link access are each counted. Rank with the number; never give it to an auditor.

The EEEU problem, and the order you fix it in

"Everyone except external users" is a built-in SharePoint group containing every internal user, present and future. It is the largest single source of enterprise oversharing, granted through two structurally different paths needing different fixes.

Path 1 — EEEU in site membership. A public site puts EEEU into owners, members or visitors, exposing every item. The easy case: one object, one owner, one decision.

Path 2 — EEEU on individual items. A user picks EEEU in the people picker on a file or folder inside an otherwise private site. The site looks locked down in every site-level report. The file is not. This produces the incidents, and it is why the item-level report matters.

Remediate in this order:

1. Contain. Apply Restricted Content Discovery to the top EEEU sites carrying sensitive data. Permissions stay intact; discovery stops; nobody loses access to work in flight.
2. Kill the source before the symptom. Turn off or restrict company-wide links and EEEU grants at tenant level. Cleaning items while the tap runs is wasted effort.
3. Fix site membership. Remove EEEU from SharePoint groups on sites that should not be public; convert to Entra security groups. No security-group model? Stop and build one — usually the real long pole.
4. Fix items with script, not people. Use the item-level report and SharePoint Online PowerShell for bulk removal. The SharePoint Advanced Management Administrator role exists for exactly this.
5. Delegate the judgement calls. Where an administrator cannot legitimately decide, initiate site access reviews — compliance often prevents IT from seeing item-level detail, and owners can. Customise the email; an uncustomised request looks like phishing.
6. Verify with a canary. Prompt Copilot from a deliberately low-privilege test account for the content you just remediated. If it answers, you are not done. "We turned it on Friday" is not evidence.

Control-to-licence map

This is the table the Microsoft blog cannot publish. Every control is native; the licence column is what actually blocks projects.

Underneath it all: a base subscription of Office 365 E3/E5/A5 or Microsoft 365 E1/E3/E5/A5, or the GCC equivalents. Our E3 vs E5 comparison works the Purview side; the Copilot pricing and licensing guide the Copilot side.

The remediation runbook: week 1, week 4, ongoing

Week 1 — contain and measure. Assign the SharePoint Advanced Management Administrator role. Clear the concealed-report-data setting. Start the assessment, the site permissions snapshot and the Purview DSPM assessment in parallel — they run for hours to days, so start them before planning anything. Apply Restricted Content Discovery to sites you already know are dangerous: HR, legal, corporate development, payroll, executive. Turn off anonymous "Anyone" links absent a documented business case. Stand up the Exposure Register — one row per site carrying owner, sensitivity, exposure vector, containment state, remediation owner and due date. That spreadsheet is the project.

Weeks 2–3 — correct the top of the list. Rank by the intersection of broad audience and sensitive content, never either alone; a public site of cafeteria menus is not a finding. Run the item-level report and script EEEU removal where the answer is unambiguous. Initiate site access reviews for the rest, using PowerShell above the 100-site cap. Resolve ownerless sites by policy, not email. Archive or delete dead sites — inactive content degrades answer quality as well as widening exposure.

Week 4 — constrain and gate. Set tenant sharing defaults to the least permissive setting the business tolerates, with link expiry. Require site sensitivity labels at provisioning so privacy and sharing follow the label, not the creator. Apply Restricted Access Control by default to business-critical sites. Configure inactive-site, ownership and attestation policies. Then run the gate.

Ongoing. Re-run the assessment every 30 days; snapshots quarterly, activity reports monthly. Lift RCD once a site is remediated — leaving it on degrades the answers you pay $30 per user per month for. Review the Exposure Register monthly in a governance forum.

The pre-Copilot go/no-go gate

Ship when every line is true for the population you are enabling, not the whole tenant. Gate per wave.

Criterion 11 is not bureaucracy. Residual risk is never zero, and whoever owns it should know they own it — see our note on the CFO conversation about AI governance.

Effort drivers: what makes this four weeks versus six months

The variable is never tenant size. It is the shape of the mess.

Four to six weeks looks like: fewer than 2,000 sites; a working Entra security-group model; EEEU concentrated in site membership rather than items; ownership largely intact; one business unit. That is configuration plus a bounded cleanup.

Three to six months means at least three of these are true. Item-level EEEU sprawl — thousands of files shared organisation-wide inside private sites, unfixable at site level and unsafe to delegate. No group model — a decade of permissions granted to individuals, so there is nothing to migrate access to; a directory project wearing a SharePoint costume. Migrated legacy structures — file-share folder permissions with broken inheritance everywhere; you cannot break or reinherit permissions on a list or library above 100,000 items, so some must be restructured rather than repermissioned. Absent ownership — every review request bounces. Federated business units — no single administrator has authority, so remediation moves at the speed of negotiation. Regulatory constraint — legal or works councils limit what IT may inspect. Guest accumulation — years of unmanaged B2B invitations with standing access.

Budget three buckets: platform configuration (days), discovery and analysis (mostly elapsed waiting), and remediation (large, almost entirely human judgement). The licence covers none of the third. Firms quoting this as a licensing exercise are quoting the wrong project — see our delivery-partner risk analysis.

What breaks — failure modes

What changed in 2026

• Restricted SharePoint Search is retiring. New enablement is blocked starting July 31, 2026. It was always a short-term measure, capped at a 100-site allow list and explicitly "not a security boundary." Restricted Content Discovery replaces it.
• Content Management Assessment is now the front door to SAM, replacing the menu-based "All features" navigation with a one-click assessment returning categorised findings and recommended actions.
• An item-level exposure report shipped. Sites and files shared via special SharePoint groups identifies which files and folders are effectively public through EEEU or Everyone — enabling scripted cleanup instead of owner-by-owner delegation.
• A dedicated admin role exists. SharePoint Advanced Management Administrator carries all SharePoint Administrator rights plus metadata visibility across content and permission removal at scale.
• Microsoft published a real blueprint. Secure and govern Microsoft 365 Copilot: foundational deployment guidance organises the work into remediate oversharing, set up guardrails, meet regulations — the closest first-party equivalent to a sequence.
• Entitlement paths widened. SAM reaches tenants three ways: any assigned Copilot licence, the SAM Plan 1 add-on, or Microsoft 365 E7 (the Frontier Suite: E5 plus Copilot plus Entra Suite plus Agent 365). Site attestation policies also went generally available.

Where to go next

If your Copilot go-live date is set and your Exposure Register is not, the date is the risk. EPC Group runs pre-Copilot oversharing remediation as a fixed-scope engagement: assessment, Exposure Register, containment, item-level EEEU cleanup, and a signed go/no-go gate. Start with SharePoint consulting or data governance consulting.

Related: SharePoint migration services · My Sites in SharePoint · SharePoint vs Google Drive · Box vs SharePoint · SharePoint network drive mapping · Microsoft 365 E3 vs E5 · Copilot vs ChatGPT Enterprise · Microsoft consulting firms · Microsoft Frontier Company · EPC Group

Frequently asked questions

Sources and verification

1. Microsoft Learn — Configure a secure and governed foundation for Microsoft 365 Copilot
2. Microsoft Learn — Secure and govern Microsoft 365 Copilot: Foundational deployment guidance
3. Microsoft Learn — Get ready for Microsoft 365 Copilot and agents with SharePoint Advanced Management
4. Microsoft Learn — What is SharePoint Advanced Management?
5. Microsoft Learn — Prerequisites for SharePoint Advanced Management
6. Microsoft Learn — SharePoint Advanced Management features in Microsoft 365 Copilot licenses
7. Microsoft Learn — Assess your organization's content management status (Content Management Assessment)
8. Microsoft Learn — Data access governance reports for SharePoint and OneDrive sites
9. Microsoft Learn — Monitor "Everyone except external users" (EEEU) sharing with the EEEU activity report
10. Microsoft Learn — Initiate site access reviews for data access governance reports
11. Microsoft Learn — Restrict discovery of SharePoint sites and content (Restricted Content Discovery)
12. Microsoft Learn — Restrict access to a SharePoint site (Restricted Access Control)
13. Microsoft Learn — Restricted SharePoint Search (retirement notice)
14. Microsoft Learn — Manage site lifecycle policies
15. Microsoft Learn — Microsoft 365 Copilot data and compliance readiness
16. Microsoft Learn — Minimum requirements to deploy Microsoft 365 Copilot
17. Microsoft Learn — Learn about Microsoft Purview Data Loss Prevention for Microsoft 365 Copilot
18. Microsoft Learn — Data Security Posture Management: oversharing assessments
19. Microsoft Learn — Apply principles of Zero Trust to Microsoft 365 Copilot
20. Microsoft Learn — Configure external collaboration settings for B2B in Microsoft Entra External ID
21. Microsoft Learn — Secure external access to Microsoft Teams, SharePoint, and OneDrive with Microsoft Entra ID
22. Microsoft Learn — SharePoint limits (unique permission scopes, list and library limits)
23. Microsoft Learn — Pay-as-you-go services and pricing (Microsoft 365 Archive, Backup, SharePoint storage rates)
24. Microsoft — Microsoft 365 Copilot pricing
25. Microsoft SharePoint Blog — Sesha Mani, What's new in Content Governance in SharePoint, OneDrive, and Teams for AI era, May 7, 2025 (the citation this article replaces)