Copilot works inside the access your people already have, and it’s much better at finding things than they ever were. Microsoft’s own Copilot privacy documentation says Copilot only surfaces organizational data that a user has at least view permission to reach. That one sentence is why SharePoint oversharing stops being a quiet housekeeping issue the day Copilot turns on.
We treat it as part of data security posture management, which means it needs an owner with authority over access. Find the reach, fix the reach, then widen the rollout.
A naming note before we start: Microsoft now calls Microsoft 365 Copilot “Microsoft Copilot,” and some screens and licenses still use the old name during the transition. This post says Copilot for both.
Why SharePoint oversharing matters more once Copilot is on
For years, some SharePoint content was protected mainly by obscurity. A site got shared with the whole company in a hurry, nobody remembered it existed, and search was clumsy enough that nobody stumbled onto it. The permissions were wrong the whole time. Nobody noticed because nobody looked.
Copilot looks. Microsoft says the Semantic Index honors each user’s identity-based access boundary, so grounding only touches content that user is authorized to see. That’s the system working as designed. The trouble starts when that boundary is wider than anyone intended, because now there’s a tool that will search all of it on request and summarize what it finds.
So the real question is what your permissions say. Copilot is enforcing your SharePoint permissions faithfully. If those permissions say the whole firm can read the compensation folder, Copilot agrees.
Where oversharing hides in SharePoint
Four habits are worth checking first. None of them look dangerous when someone does them.
"Everyone" and "Everyone except external users"
Everyone except external users (EEEU) is a built-in SharePoint group that automatically includes every internal user. Add it to a site, a library, a folder or a single file, and that content is open to the whole tenant. It can show up when someone wanted a link to “just work,” or when a site was set up as an intranet page years ago and later started holding real documents.
Organization-wide and "Anyone" sharing links
Sharing links are easy to create and easy to forget. “People in your organization” links widen internal reach, and “Anyone” links can reach outside the tenant entirely, depending on how your sharing settings are configured. Neither shows up when a site owner looks at the site’s member list, which is exactly why they linger.
Broken inheritance
By default, folders and files inherit permissions from the site. When someone grants access directly on a folder or file, that item gets its own unique permissions. Now the site owner can review membership, see a tidy list of the right people, and miss that one folder of HR files was shared with a large group three reorganizations ago.
Big groups that grew quietly
Public Teams and Microsoft 365 groups that anyone in the organization can join, plus security groups that started small and absorbed whole departments, give broad access without any one sharing decision looking wrong.
How to find it: the reports to run first
Microsoft’s data access governance reports in the SharePoint admin center are the most direct way to see SharePoint oversharing. They’re part of SharePoint Advanced Management, which Microsoft’s Copilot deployment blueprint says is included with the Copilot license.
| Report | What it tells you | When to use it |
|---|---|---|
| Site permissions across your organization (snapshot) | Sites with the broadest access: thousands of users, external guests, or EEEU permissions | First. This is your baseline. |
| Sites and files shared via special SharePoint groups (snapshot) | The exact sites, folders and files open through EEEU or Everyone, and how access was granted | When you’re ready to clean up, including by script |
| Site permissions for users (snapshot) | Every site a specific person can reach, and whether it’s the whole site or specific sections | Spot checks, like a new hire or a departing partner |
| Sensitivity labels for files (snapshot) | Which sites hold files with specific labels | Matching broad access against your most sensitive content |
| Sharing links (activity) | Sites where people created the most sharing links in the last 28 days | Ongoing monitoring |
| Shared with Everyone except external users (activity) | Sites where content was shared with all internal users in the last 28 days | Ongoing monitoring |
Microsoft suggests running the snapshot reports first and the activity reports after, with snapshots roughly quarterly and activity reports monthly. Two licensing details are easy to miss. Admins with Microsoft 365 E5 but without SharePoint Advanced Management can open data access governance reporting, but they don’t get the snapshot reports or the remediation actions. And organizations without SharePoint Advanced Management have to turn on data collection before activity reports work, since those reports only cover activity from that point forward.
Microsoft Purview Data Security Posture Management is the other place to look. Microsoft announced the current version as generally available in May 2026, and it brings the old DSPM and DSPM for AI experiences into one solution. It reports oversharing risk for AI apps and agents, and Microsoft says it can automate steps such as removing public sharing links.
If you’d like an outside read on where your exposure sits before you add more Copilot seats, our free AI Readiness Snapshot looks at exactly that.
How to fix it without breaking the firm
This is where rollout timing starts to matter. Ripping EEEU out of every site in one afternoon will fix the report and break a dozen workflows by Monday. The order matters.
- Triage by sensitivity first. A site open to the whole firm that holds the lunch menu can wait. Cross-reference the broad-access sites against the sensitivity label report and against what you already know is sensitive: HR, finance, partner compensation, client matter sites, deal rooms.
- Contain the worst sites while you work. Restricted Content Discovery keeps a SharePoint site out of organization-wide search and Copilot responses without changing anyone’s permissions. Microsoft describes it as a temporary control, it doesn’t apply to OneDrive, and on very large sites (more than 500,000 items) the change can take over a week to take effect. Treat it as a pause button while the cleanup happens. Restricted access control is the stronger option when a site should only be open to one specific group.
- Remove EEEU and Everyone where they don’t belong. The special SharePoint groups report shows exactly which items to change, which makes scripted cleanup realistic, so you aren’t waiting on every site owner.
- Replace broad links with specific-people links. Start with sites that show up in both the sharing links report and the sensitive-content list.
- Restore inheritance where unique permissions aren’t justified. Sometimes a folder has unique permissions for a good reason, and sometimes it’s a leftover. Ask the site owner which.
- Send site access reviews to owners. Site access review in SharePoint Advanced Management asks owners to confirm or update who has access. They know the business context better than IT does.
- Label what has to stay protected. When content is encrypted with a sensitivity label, Copilot honors the usage rights granted to each user. That gives your most sensitive files a second layer that doesn’t depend on every permission being right.
Then keep the monthly activity reports running. Oversharing comes back, because the habits that caused it are still convenient.
What this looks like at a law firm
Law firms have a specific version of this problem. Ethical walls and client confidentiality depend on permissions being right, and Copilot inherits whatever SharePoint says. If a matter team’s site was shared broadly during a busy trial, the ethical wall has a hole in it, and Copilot can find it.
A hypothetical to make it concrete: picture a firm where a litigation support folder was shared with EEEU years ago so paralegals in another office could reach exhibits. Nobody revisited it. Once Copilot is live, an associate on an unrelated matter asks for a summary of recent deposition themes, and that folder is fair game because the permissions allow it. Nothing malfunctioned. The access was always there.
The same logic reaches past SharePoint. Microsoft says data from Graph connectors can show up in Copilot responses when the user has permission to see it, so permissions in connected systems deserve the same review.
Quick answers
Does Copilot give users access to files they couldn’t open before?
No. Microsoft documents that Copilot only surfaces content a user already has at least view permission to reach. The risk is that users may already reach more than anyone intended, and Copilot makes that content much easier to find and summarize. Fixing SharePoint permissions is how you shrink what Copilot can surface.
What’s the fastest way to find SharePoint oversharing?
Start with the data access governance reports in the SharePoint admin center. Run the site permissions report across your organization first to find sites with the broadest access, then the special SharePoint groups report to see exactly which items are open through EEEU or Everyone. Use the monthly activity reports after that to catch new oversharing.
Does Restricted Content Discovery fix oversharing?
No. It keeps selected SharePoint sites out of organization-wide search and Copilot responses while you review them, but it doesn’t change permissions. Anyone with access can still open the content directly. Microsoft positions it as a temporary governance control during a Copilot rollout, so plan the permission cleanup alongside it.
Do I need SharePoint Advanced Management for this?
Microsoft’s Copilot deployment blueprint says SharePoint Advanced Management is included with the Copilot license, and features like Restricted Content Discovery require it. Admins with Microsoft 365 E5 but without it can use data access governance reporting in a limited form, without snapshot reports or remediation actions. Confirm what your tenant has before you plan.
Before you widen the rollout
Copilot will show your people what your SharePoint permissions allow. That’s the whole argument for doing this first. Clean up the broadest access, contain the sensitive sites you can’t fix yet, label what has to stay protected, and keep watching. Our guide to SharePoint permissions goes deeper on the access model, and the data security posture management guide covers how oversharing fits into the bigger picture, and our DSPM vs CSPM comparison explains where cloud configuration checks come in.
If you want to know where you stand before more licenses go out, start with the free AI Readiness Snapshot. If it turns up real exposure, our paid AI Readiness Assessment reviews SharePoint permissions across the full tenant and turns the findings into a prioritized 90-day remediation plan.
Cocha Technology Inc. is a Houston-based AI governance and security advisory firm, serving organizations across the US, Canada and the EU.
