Why This Audit Is Required Pre-Copilot
Microsoft 365 Copilot respects existing SharePoint permissions. Over the past 10-15 years, your SharePoint tenant has accumulated:
- "Everyone in your company" shares on sites that should be restricted
- External sharing links that were created for a one-time purpose and never revoked
- Departed-employee content that retains their original permissions
- Microsoft 365 groups created for projects that ended years ago
- Files shared via "anyone with the link" that have been forgotten
When Microsoft 365 Copilot is deployed, it shows content based on user permissions. Users may find they can access:
- HR records
- M&A documents
- Executive compensation information
- Source code
- Internal financial reports
These are documents that they were never meant to see.
EPC Group standard pre-Copilot SharePoint audit finds 30-50% of permissions need remediation before safe Copilot rollout.
The 4 Deliverables
Full Permission Inventory Report
Every SharePoint site + library + file inventoried with permission map. Risk-scored.
External Sharing + Overshare Exposure
"Everyone in your company" shares + external sharing links + "anyone with the link" files surfaced and risk-prioritized.
Orphaned Permissions Report
Content with departed-employee permissions still active. Categorized by sensitivity + age.
30-90 Day Remediation Runbook
PowerShell scripts + manual remediation steps + Microsoft Purview sensitivity label plan + Microsoft 365 group cleanup plan.
The findings land in one register. Download the SharePoint permission-risk register (CSV): one row per finding, with sites, sharing links, users or groups and items counted in separate columns so a total never mixes units; the Microsoft report it came from (the data access governance reports in the SharePoint admin center: site permissions, sharing links, ‘Everyone except external users’ and sensitivity labels); the remediation, such as restricted access control, a site access review or expiring links; an interim Copilot control such as Restricted Content Discovery; and the closure evidence. Its example rows are synthetic, not client data.
Fixed-Fee Tiers
Frequently Asked Questions
What is a SharePoint oversharing + permissions audit?
A 3-week fixed-fee engagement that scans your entire SharePoint Online estate (sites, lists, libraries, files) for orphaned permissions, external sharing exposures, "Everyone in your company" overshares, link-anywhere sharing risks, and group sprawl. Output: prioritized remediation plan with 30-90 day execution roadmap. Critical pre-Copilot deployment because Copilot surfaces content users have access to — and over-sharing becomes immediately visible.
Why do enterprises need a SharePoint permissions audit before Copilot?
Microsoft 365 Copilot respects existing SharePoint permissions. Over a decade of accumulated permission drift means "Everyone in your company" shares, orphaned permissions on departed-employee content, and external sharing links that were never revoked. Without audit + remediation, Copilot surfaces this content to users who shouldn't see it. EPC Group typical finding: 30-50% of permissions need remediation.
How long does the SharePoint permissions audit take?
3 weeks fixed timeline. Week 1: full tenant scan (sites, libraries, sharing logs, group inventory). Week 2: risk-scored finding categorization + remediation plan. Week 3: deliverable + executive readout + remediation runbook.
What deliverables come from the SharePoint audit?
4 documents: (1) Full permission inventory report — every site + library + sharing risk, (2) "Everyone in your company" shares + external sharing exposure report, (3) Orphaned permission report (departed-employee content access), (4) Prioritized 30-90 day remediation runbook with PowerShell scripts.
What does the SharePoint oversharing + permissions audit cost?
Fixed-fee, scoped to SharePoint tenant size (under 500 sites, 500-5,000 sites, 5,000+ sites). No hidden fees. Includes deliverables + executive readout + remediation runbook.
Does the audit include remediation?
The audit produces the remediation plan + runbook. Execution of remediation can be done by your internal IT team or extended to EPC Group, scoped separately based on remediation scope. Most clients self-execute using EPC Group runbook.
What about Microsoft Purview sensitivity labels?
Audit includes recommended Microsoft Purview sensitivity label deployment plan aligned with the permission cleanup. Many enterprises use this audit as the trigger to roll out Purview labels concurrent with permission remediation.
Can the audit happen in production / will it impact users?
Yes — audit is read-only and zero impact on users. Microsoft Graph API + Microsoft 365 Defender + PowerShell scans run during business hours without performance impact. Remediation (post-audit) is the impactful workstream.
Related Resources
Schedule Your SharePoint Permissions Audit
3 weeks. Fixed-fee. Required pre-Copilot. Microsoft + Microsoft Solutions Partner Modern Work Since 1997.
Documented and anonymized engagements
Named engagements come first; anonymized summaries follow under the anonymized-engagement rule — the client is not named and every statement is EPC-reported. Documents behind named engagements are in the Evidence Center.
- Samsung Semiconductor, Inc. — SharePoint Server 2019 build and deployment: custom user experience, navigation, web parts, search, enterprise-application integration, quality assurance and training (2021)Samsung Semiconductor, Inc. · 2021 · Contracted — countersigned
- Canadian Forces Morale & Welfare Services (CFMWS) — SharePoint consulting support (2014)Canadian Forces Morale & Welfare Services (CFMWS) · 2014 · Contracted
- Stryker Corporation — SharePoint Center of Excellence development (2012)Stryker Corporation · 2012 · Delivered — payment-corroborated (client payment records published)
- Federal Reserve Bank of New York — SharePoint best-practices needs assessment, architecture and governance gap analysis, roadmap for a global SharePoint Center of Excellence across the twelve Reserve Bank districts (2010)Federal Reserve Bank of New York · 2010 · Contracted — countersigned, with historical work product
- Copilot and SharePoint AI Governance: Regional Bank (2024)Anonymized engagement summary · Regional bank · 2024
- SharePoint Intranet Permission Automation: Contractor (2024)Anonymized engagement summary · Federal government contractor · 2024
- Two SharePoint Farms to SharePoint Online: Regional BankAnonymized engagement summary · Regional bank · 2024
- SharePoint Health Check, Upgrade and Support: ManufacturerAnonymized engagement summary · Consumer-products manufacturer · 2017–2023
More engagements: NASA (agency-wide, across the NASA Centers) — Agency SharePoint Phase 1 Initiative: needs assessment, architectural review, governance, and a global SharePoint Center of Excellence for knowledge management, intranet and enterprise content management across the NASA Centers (2009–2010) · National Archives and Records Administration (NARA) — SharePoint records management and Center of Excellence advisory and implementation support (2010) · National Institutes of Health — SharePoint Center of Excellence design (2010) · Northrop Grumman — 'Finance I.R.M. Automation Process' statement of work on SharePoint (2010) · NASA Johnson Space Center — SharePoint Site Provisioning Solution (2009) · YMCA (Houston) — Microsoft Office SharePoint Server 2007 implementation (2007) · SharePoint Support and Custom Apps: Professional Services · SharePoint 2010 to 2019 Migration: Regional Bank (2020) · SharePoint Online Document Management: Transportation (2020) · SharePoint 2010 to Online Design: Global Law Firm (2018) · SharePoint 2016 Intranet Redesign: Energy Company (2018) · SharePoint Intranet Redesign: Financial Services · SharePoint Migration: Major Healthcare Network