| name | purview-copilot-oversharing |
| description | Guidance for assessing and remediating oversharing before and during Microsoft 365 Copilot adoption, using SharePoint Advanced Management (SAM), sensitivity labels, restricted content discovery, and DLP for Copilot so Copilot only surfaces content users should access. Covers data access governance reports, EEEU cleanup, and ongoing governance. WHEN: Copilot oversharing, prepare data for Copilot, restrict Copilot access, SharePoint Advanced Management, data access governance, oversharing remediation, Copilot readiness data security, limit Copilot content, Copilot is surfacing files users should not see, too many people have access to SharePoint sites, tighten up permissions before Copilot rollout, how do I make SharePoint Copilot-ready. DO NOT USE when the goal is monitoring what sensitive data users are actively sending in AI prompts (use purview-dspm-ai). |
| license | MIT |
| metadata | {"author":"Microsoft","version":"0.1.0"} |
Microsoft 365 Copilot Oversharing Controls
Microsoft 365 Copilot honours existing permissions - so if content is overshared, Copilot can
surface it to users who technically have access but shouldn't. This skill covers reducing that
blast radius before and during Copilot rollout using SharePoint Advanced Management, sensitivity
labels, restricted content discovery, and DLP for Copilot.
When to use
Preparing a tenant for Microsoft 365 Copilot and continuously controlling what Copilot can reach
across SharePoint, OneDrive, and Teams.
Do not use this skill to monitor sensitive data in prompts (use purview-dspm-ai) or to design a
broader DLP program (use purview-dlp-policy).
Pick the right oversharing lever
| Symptom | Lever |
|---|
| "Everyone except external users" (EEEU) on too many sites | SAM data access governance report + permission cleanup |
| Sensitive content in broadly shared sites | Sensitivity labels (encrypt) + container labels for sites |
| Site shows up in Copilot results when it shouldn't | Restricted content discovery (RCD) on the site |
| Labelled content should be excluded from Copilot grounding | DLP for Microsoft 365 Copilot |
| Sharing links sprawl | SAM sharing link report + cleanup policies |
Rule of thumb: assess (DAG report) -> classify (labels) -> restrict (RCD, link policy) ->
exclude (DLP for Copilot) -> govern (site lifecycle). Skipping the assess step is the most common
failure.
Approach
- Assess - Use SharePoint Advanced Management (SAM) data access governance reports to
find oversharing: "everyone/EEEU" access, broadly shared sites, sharing links, and permissioned
but sensitive content.
Verify: DAG report identifies top-N risky sites with owners.
- Engage site owners - Notify owners of risky sites with the remediation expected; do not
remediate centrally without owner context.
Verify: owner remediation tickets/issues opened with deadline.
- Classify & label - Apply sensitivity labels to sensitive content; container labels for
sites; labels can encrypt and restrict, and Copilot respects label permissions.
Verify: top-tier label encrypts and Copilot cannot surface the file to unauthorised test user.
- Restrict - Use restricted access control / restricted content discovery (RCD) on
sensitive sites, tighten "everyone except external users" grants, and clean up sharing links.
Verify: RCD-flagged site no longer appears in test user's Copilot answers.
- Apply DLP for Copilot - Use DLP for Microsoft 365 Copilot to exclude labelled content from
Copilot processing where required.
Verify: a test prompt referencing labelled content is excluded or warned.
- Govern lifecycle - Apply site lifecycle/access reviews to prevent regression; set inactive
site policies in SAM.
Verify: inactive sites archived or owners re-attested per cadence.
- Monitor with DSPM for AI - Continuously surface unlabelled sensitive files Copilot can
access; loop back to label + restrict.
Verify: weekly DSPM for AI report shrinks unlabelled-sensitive count.
Guardrails
- Remediate oversharing before broad Copilot enablement; a pilot can proceed on a scoped,
clean set of sites but tenant-wide turn-on without assessment generates user complaints fast.
- Sensitivity-label encryption is the strongest control - Copilot can't use content the user
can't decrypt/extract; reserve for genuinely sensitive content.
- Oversharing control is ongoing governance, not a one-time cleanup - new sites are created daily
and sharing links sprawl without policy.
- Coordinate with site owners; bulk permission stripping from the centre breaks legitimate
collaboration and erodes trust in the program.
- SAM is licensed separately (E5 / standalone SKU) - confirm before assuming reports are
available.
Common anti-patterns
- Enabling Copilot tenant-wide and then trying to remediate oversharing - users have already seen
the wrong files.
- Running the DAG report once, fixing the top 20 sites, and declaring done.
- Encrypting everything with the top label "to be safe" - breaks external collaboration and
Copilot grounding alike.
- Restricted content discovery applied to half the tenant - users complain Copilot is useless.
- Ignoring sharing links because the report is long.
Example prompts
Make SharePoint Copilot-ready by remediating oversharing.Use SharePoint Advanced Management to tighten site permissions before Copilot.How do I stop Copilot surfacing files users should not see?Run data access governance to limit Copilot content.Apply restricted content discovery to a sensitive site.
Microsoft Learn
